test(plc): add realistic OpenPLC-style traffic-light sample

Second demo fixture (public-sample shape) to complement the all-rules
pump_station.st: a timed pedestrian-crossing state machine adapted from
the OpenPLC traffic-light example, extended with a SCADA/Modbus uplink and
a maintenance override. Mostly sound control logic with three planted,
field-realistic defects (hardcoded SCADA password, cleartext Modbus master,
maintenance mode that drops the pedestrian safety permit).

The regression test asserts the scanner surfaces those defects while staying
quiet on the guarded duty-cycle division and the JMP-free CASE machine —
demonstrating low false positives on real-world-shaped code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -34,24 +34,6 @@ SCAN_SCHEDULE=0 0 */6 * * *
 CVE_MONITOR_SCHEDULE=0 0 0 * * *
 GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
 
-# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
-# enabled; requires the agent container to have Docker access (socket mount).
-# When on, a PLC/SPS target with control logic but no reachable device gets its
-# logic instantiated on a throwaway OpenPLC, probed, then torn down.
-PLC_RUNTIME_ENABLED=0
-PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
-PLC_RUNTIME_NETWORK=certifai
-PLC_RUNTIME_MEMORY=512m
-PLC_RUNTIME_CPUS=0.5
-PLC_RUNTIME_MAX_LIFETIME_SECS=180
-PLC_RUNTIME_OPENPLC_USER=openplc
-PLC_RUNTIME_OPENPLC_PASSWORD=openplc
-
-# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
-# When set, mounts the runner-facing queue + artifact endpoints behind this
-# bearer token; runners present the same token. Unset = endpoints not mounted.
-WERKBANK_RUNNER_TOKEN=
-
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001

.gitea/workflows/ci.yml

@@ -107,10 +107,6 @@ jobs:
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
-      - name: Clippy (werkbank-exec)
-        run: cargo clippy -p werkbank-exec -- -D warnings
-      - name: Clippy (control-map)
-        run: cargo clippy -p control-map -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -119,8 +115,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent + werkbank-exec + control-map)
+      - name: Tests (core + agent)
-        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
+        run: cargo test -p compliance-core -p compliance-agent --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)
@@ -206,13 +202,11 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.meghsakha.com/certifai/compliance-agent
+          IMAGE=registry.meghsakha.com/compliance-agent
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -232,13 +226,11 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.meghsakha.com/certifai/compliance-dashboard
+          IMAGE=registry.meghsakha.com/compliance-dashboard
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -256,12 +248,10 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.meghsakha.com/certifai/compliance-docs
+          IMAGE=registry.meghsakha.com/compliance-docs
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
@@ -281,13 +271,11 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.meghsakha.com/certifai/compliance-mcp
+          IMAGE=registry.meghsakha.com/compliance-mcp
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
-          cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
           RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"

Cargo.lock

@@ -666,7 +666,6 @@ dependencies = [
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
- "control-map",
  "dashmap",
  "dotenvy",
  "futures-core",
@@ -700,7 +699,6 @@ dependencies = [
  "urlencoding",
  "uuid",
  "walkdir",
- "werkbank-exec",
  "zip",
 ]
 
@@ -725,7 +723,6 @@ dependencies = [
  "sha2",
  "thiserror 2.0.18",
  "tokio",
- "toml",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
@@ -969,15 +966,6 @@ dependencies = [
  "charset",
 ]
 
-[[package]]
-name = "control-map"
-version = "0.1.0"
-dependencies = [
- "serde",
- "serde_json",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "convert_case"
 version = "0.8.0"
@@ -5099,12 +5087,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "sha1_smol"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
-
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -6488,7 +6470,6 @@ dependencies = [
  "getrandom 0.4.1",
  "js-sys",
  "serde_core",
- "sha1_smol",
  "wasm-bindgen",
 ]
 
@@ -6732,25 +6713,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "werkbank-exec"
-version = "0.1.0"
-dependencies = [
- "compliance-core",
- "compliance-dast",
- "futures-util",
- "hex",
- "regex",
- "reqwest",
- "secrecy",
- "sha2",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "uuid",
- "walkdir",
-]
-
 [[package]]
 name = "which"
 version = "6.0.3"

Cargo.toml

@@ -7,8 +7,6 @@ members = [
     "compliance-dast",
     "compliance-mcp",
     "compliance-smoke",
-    "werkbank-exec",
-    "control-map",
 ]
 resolver = "2"
 
@@ -18,7 +16,6 @@ expect_used = "deny"
 
 [workspace.dependencies]
 compliance-core = { path = "compliance-core", default-features = false }
-control-map = { path = "control-map" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
@@ -26,11 +23,11 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
-uuid = { version = "1", features = ["v4", "v5", "serde"] }
+uuid = { version = "1", features = ["v4", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }

compliance-agent/Cargo.toml

@@ -8,12 +8,8 @@ workspace = true
 
 [dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
-control-map = { workspace = true }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
-# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
-# used by the Werkbank runner.
-werkbank-exec = { path = "../werkbank-exec" }
 # Native firmware build/target detection for bare-metal & RTOS artifacts.
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this
@@ -38,7 +34,7 @@ hex = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
 regex = { workspace = true }
-axum = { version = "0.8", features = ["multipart"] }
+axum = "0.8"
 tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
 git2 = "0.20"
 octocrab = "0.44"
@@ -69,5 +65,5 @@ tokio = { workspace = true }
 mongodb = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
-axum = { version = "0.8", features = ["multipart"] }
+axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }

compliance-agent/rules/cra_semgrep.yaml

@@ -1,117 +0,0 @@
-# Custom semgrep rules for CRA controls that no off-the-shelf ruleset digs out.
-# Each rule id is `cra-ai-<n>-<slug>` and is keyed back to its control via the
-# `control-map` LUT (by rule-id suffix, so semgrep's path prefix on check_id does
-# not matter). Detection here is deterministic; the grounded LLM judge downstream
-# only confirms/refutes — it never detects. Keep patterns tight: a false positive
-# that the judge refutes marks the whole finding a false positive.
-rules:
-  # --- cra-ai-1: Secure-by-Default-Konfiguration -------------------------------
-  - id: cra-ai-1-flask-debug-enabled
-    languages: [python]
-    severity: WARNING
-    message: Flask app started with debug=True — ships an interactive debugger / code execution in production (secure-by-default violation).
-    metadata:
-      cwe: ["CWE-489: Active Debug Code"]
-      control: cra-ai-1
-    patterns:
-      - pattern: '$APP.run(..., debug=True, ...)'
-
-  - id: cra-ai-1-django-debug-true
-    languages: [python]
-    severity: WARNING
-    message: Django DEBUG = True — leaks stack traces / settings in production (secure-by-default violation).
-    metadata:
-      cwe: ["CWE-489: Active Debug Code"]
-      control: cra-ai-1
-    patterns:
-      - pattern: 'DEBUG = True'
-
-  - id: cra-ai-1-tls-verify-disabled
-    languages: [python]
-    severity: ERROR
-    message: TLS certificate verification disabled (verify=False) — defeats transport security by default.
-    metadata:
-      cwe: ["CWE-295: Improper Certificate Validation"]
-      control: cra-ai-1
-    patterns:
-      - pattern: 'requests.$M(..., verify=False, ...)'
-
-  - id: cra-ai-1-cors-wildcard
-    languages: [javascript, typescript]
-    severity: WARNING
-    message: CORS Access-Control-Allow-Origin set to "*" — opens the API to any origin by default.
-    metadata:
-      cwe: ["CWE-942: Permissive Cross-domain Policy with Untrusted Domains"]
-      control: cra-ai-1
-    patterns:
-      - pattern-either:
-          - pattern: '$RES.header("Access-Control-Allow-Origin", "*")'
-          - pattern: '$RES.setHeader("Access-Control-Allow-Origin", "*")'
-
-  # --- cra-ai-7: Starke Authentifizierung (weak password hashing) --------------
-  - id: cra-ai-7-weak-password-hash
-    languages: [python]
-    severity: ERROR
-    message: Password/secret hashed with a fast, broken digest (md5/sha1) — use a password KDF (bcrypt/scrypt/argon2).
-    metadata:
-      cwe: ["CWE-916: Use of Password Hash With Insufficient Computational Effort"]
-      control: cra-ai-7
-    patterns:
-      - pattern-either:
-          - pattern: 'hashlib.md5($PW)'
-          - pattern: 'hashlib.sha1($PW)'
-      - metavariable-regex:
-          metavariable: $PW
-          regex: '(?i).*(pass|pwd|secret|cred|token).*'
-
-  # --- cra-ai-10: Sitzungsmanagement (insecure session cookies) ----------------
-  - id: cra-ai-10-session-cookie-insecure
-    languages: [python]
-    severity: ERROR
-    message: Session cookie hardened flag explicitly disabled (Secure/HttpOnly = False) — session token exposed to theft.
-    metadata:
-      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
-      control: cra-ai-10
-    patterns:
-      - pattern-either:
-          - pattern: 'SESSION_COOKIE_SECURE = False'
-          - pattern: 'SESSION_COOKIE_HTTPONLY = False'
-
-  - id: cra-ai-10-express-cookie-insecure
-    languages: [javascript, typescript]
-    severity: ERROR
-    message: Express cookie set with secure/httpOnly = false — session token exposed to interception / XSS theft.
-    metadata:
-      cwe: ["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"]
-      control: cra-ai-10
-    patterns:
-      - pattern-either:
-          - pattern: '$RES.cookie($NAME, $VAL, {..., secure: false, ...})'
-          - pattern: '$RES.cookie($NAME, $VAL, {..., httpOnly: false, ...})'
-
-  # --- cra-ai-14: Speicher-Schutz / Data at Rest (weak cipher) -----------------
-  - id: cra-ai-14-python-weak-cipher
-    languages: [python]
-    severity: ERROR
-    message: Data-at-rest encrypted with a broken cipher/mode (ECB, DES, 3DES) — provides no real confidentiality.
-    metadata:
-      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
-      control: cra-ai-14
-    patterns:
-      - pattern-either:
-          - pattern: 'AES.new($K, AES.MODE_ECB, ...)'
-          - pattern: 'DES.new(...)'
-          - pattern: 'DES3.new(...)'
-
-  - id: cra-ai-14-node-weak-cipher
-    languages: [javascript, typescript]
-    severity: ERROR
-    message: Data-at-rest encrypted with a broken cipher (DES / deprecated createCipher) — provides no real confidentiality.
-    metadata:
-      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
-      control: cra-ai-14
-    patterns:
-      - pattern-either:
-          - pattern: 'crypto.createCipheriv("des-ecb", ...)'
-          - pattern: 'crypto.createCipheriv("des", ...)'
-          - pattern: 'crypto.createCipher(...)'

compliance-agent/src/api/handlers/mod.rs

@@ -10,12 +10,10 @@ pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
-pub mod oscal;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod sbom;
 pub mod scans;
-pub mod werkbank_jobs;
 
 // Re-export all handler functions so routes.rs can use `handlers::function_name`
 pub use dto::*;

compliance-agent/src/api/handlers/onboarding.rs

@@ -5,7 +5,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-use axum::extract::{Extension, Multipart, Path, Query};
+use axum::extract::{Extension, Path, Query};
 use axum::http::StatusCode;
 use axum::Json;
 use mongodb::bson::{doc, oid::ObjectId, to_bson};
@@ -377,116 +377,6 @@ pub async fn add_artifact(
     get_target(Extension(agent), tenant, Path(id)).await
 }
 
-/// POST /api/v1/targets/{id}/artifacts/upload — attach an artifact by uploading
-/// its file (PLC project, firmware image, source archive, mobile package). The
-/// bytes are written to the artifact blob store and referenced by `stored_path`,
-/// so ingest resolves them locally (no URL fetch).
-///
-/// Multipart fields: `file` (required), `kind` (required, snake_case
-/// `ArtifactKind`), `plc_format` (optional, for PLC projects).
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn upload_artifact(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    mut multipart: Multipart,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    if db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .is_none()
-    {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    let mut kind: Option<ArtifactKind> = None;
-    let mut plc_format: Option<PlcFormat> = None;
-    let mut filename = String::from("upload.bin");
-    let mut bytes: Option<axum::body::Bytes> = None;
-
-    while let Some(field) = multipart
-        .next_field()
-        .await
-        .map_err(|_| StatusCode::BAD_REQUEST)?
-    {
-        match field.name().unwrap_or("") {
-            "kind" => {
-                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
-                kind = parse_enum(&v);
-            }
-            "plc_format" => {
-                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
-                plc_format = parse_enum(&v);
-            }
-            "file" => {
-                if let Some(fname) = field.file_name() {
-                    filename = fname.to_string();
-                }
-                bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
-            }
-            _ => {}
-        }
-    }
-
-    let (Some(kind), Some(bytes)) = (kind, bytes) else {
-        return Err(StatusCode::BAD_REQUEST);
-    };
-
-    // Store the uploaded bytes under the artifact blob store.
-    let safe_name: String = filename
-        .chars()
-        .map(|c| {
-            if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
-                c
-            } else {
-                '_'
-            }
-        })
-        .collect();
-    let dir = std::path::Path::new(&agent.config.artifact_store_base_path)
-        .join("uploads")
-        .join(&id);
-    std::fs::create_dir_all(&dir).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    let dest = dir.join(format!("{}_{safe_name}", uuid::Uuid::new_v4()));
-    std::fs::write(&dest, bytes.as_ref()).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    // Build the artifact for this kind, referencing the stored file.
-    let mut artifact = match kind {
-        ArtifactKind::PlcProject => Artifact::plc_project(
-            filename.clone(),
-            plc_format.unwrap_or(PlcFormat::PlcopenXml),
-        ),
-        ArtifactKind::FirmwareImage => Artifact::firmware_image(filename.clone()),
-        ArtifactKind::SourceArchive => Artifact::source_archive(filename.clone()),
-        ArtifactKind::MobilePackage => Artifact::mobile_package(filename.clone()),
-        // Non-file kinds (git repo, live URL, container ref, text) use the JSON
-        // add-artifact endpoint, not upload.
-        _ => return Err(StatusCode::BAD_REQUEST),
-    };
-    artifact.stored_path = Some(dest.to_string_lossy().to_string());
-    artifact.size_bytes = Some(bytes.len() as u64);
-
-    let artifact_bson = to_bson(&artifact).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$push": { "artifacts": artifact_bson }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// Deserialize a snake_case enum value from a plain string.
-fn parse_enum<T: for<'de> Deserialize<'de>>(s: &str) -> Option<T> {
-    serde_json::from_value(serde_json::Value::String(s.to_string())).ok()
-}
-
 /// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn applicable_scans_for_target(

compliance-agent/src/api/handlers/oscal.rs

@@ -1,48 +0,0 @@
-//! OSCAL assessment endpoint.
-//!
-//! Returns a standard OSCAL assessment-results document for a target's findings,
-//! driven by each finding's stamped `control_refs` (from the scan's control-triage
-//! stage): mapped findings target their controls, unmapped findings are reported
-//! as-is. See `compliance_core::models::oscal_assessment`.
-
-use axum::extract::Extension;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use mongodb::bson::doc;
-use serde::Deserialize;
-
-use compliance_core::models::oscal_assessment::assess;
-use compliance_core::models::Finding;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use super::dto::{collect_cursor_async, tenant_db, AgentExt};
-
-#[derive(Debug, Deserialize)]
-pub struct AssessRequest {
-    /// The target / repo id whose findings are assessed.
-    pub target_id: String,
-}
-
-/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
-pub async fn assess_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<AssessRequest>,
-) -> Response {
-    let db = match tenant_db(&agent, &tenant).await {
-        Ok(db) => db,
-        Err(code) => return code.into_response(),
-    };
-
-    let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
-            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
-        }
-    };
-
-    Json(assess(&findings, chrono::Utc::now())).into_response()
-}

compliance-agent/src/api/handlers/werkbank_jobs.rs

@@ -1,289 +0,0 @@
-//! Werkbank runner endpoints (`/api/v1/werkbank/jobs/*`).
-//!
-//! The pull API a Werkbank runner talks to: lease a job, heartbeat while it runs,
-//! and post the result back. Machine auth is a **static bearer token**
-//! (`WERKBANK_RUNNER_TOKEN`) — not a Keycloak JWT, because a runner acts across
-//! tenants (each request names its `tenant`). Routes are only mounted when the
-//! token is configured; with none set they don't exist (404).
-//!
-//! On completion the runner's findings are persisted against the job's target,
-//! so a job run by a remote runner lands the same findings an in-process run
-//! would (WB-05, the control-plane cut-over).
-
-use axum::extract::{Extension, Path, Request};
-use axum::http::{header, StatusCode};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use mongodb::bson::{doc, oid::ObjectId};
-use secrecy::ExposeSecret;
-use serde::{Deserialize, Serialize};
-use std::time::Duration;
-
-use compliance_core::models::werkbank::{
-    CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
-};
-use compliance_core::models::ArtifactKind;
-
-use super::dto::AgentExt;
-use crate::database::Database;
-use crate::werkbank::JobQueue;
-
-/// Gate the runner endpoints behind the static runner bearer token.
-pub async fn require_runner_token(
-    Extension(agent): AgentExt,
-    request: Request,
-    next: Next,
-) -> Response {
-    let Some(expected) = agent.config.werkbank_runner_token.as_ref() else {
-        return (StatusCode::NOT_FOUND, "werkbank runner API disabled").into_response();
-    };
-    let presented = request
-        .headers()
-        .get(header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|s| s.strip_prefix("Bearer "))
-        .map(str::trim)
-        .filter(|s| !s.is_empty());
-    let Some(presented) = presented else {
-        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
-    };
-    if !constant_time_eq(presented, expected.expose_secret()) {
-        return (StatusCode::UNAUTHORIZED, "Invalid runner token").into_response();
-    }
-    next.run(request).await
-}
-
-/// `POST /api/v1/werkbank/jobs/lease` — lease the oldest runnable job, or `204`.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, runner = %req.runner_id))]
-pub async fn lease(
-    Extension(agent): AgentExt,
-    Json(req): Json<LeaseRequest>,
-) -> Result<Response, StatusCode> {
-    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
-    let leased = queue
-        .lease(
-            &req.runner_id,
-            req.executor,
-            &req.labels,
-            Duration::from_secs(req.lease_ttl_secs),
-            chrono::Utc::now(),
-        )
-        .await
-        .map_err(internal)?;
-    Ok(match leased {
-        Some(job) => Json(job).into_response(),
-        None => StatusCode::NO_CONTENT.into_response(),
-    })
-}
-
-/// `POST /api/v1/werkbank/jobs/heartbeat` — extend the lease; `409` if it's lost.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
-pub async fn heartbeat(
-    Extension(agent): AgentExt,
-    Json(req): Json<HeartbeatRequest>,
-) -> Result<Response, StatusCode> {
-    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
-    let ack = queue
-        .heartbeat(
-            &req.job_id,
-            &req.lease_token,
-            Duration::from_secs(req.lease_ttl_secs),
-            chrono::Utc::now(),
-        )
-        .await
-        .map_err(internal)?;
-    Ok(match ack {
-        Some(ack) => Json(ack).into_response(),
-        // Lease lost — the runner should abandon the job.
-        None => StatusCode::CONFLICT.into_response(),
-    })
-}
-
-/// `POST /api/v1/werkbank/jobs/complete` — record the result and persist findings.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
-pub async fn complete(
-    Extension(agent): AgentExt,
-    Json(req): Json<CompleteRequest>,
-) -> Result<Json<CompleteResponse>, StatusCode> {
-    let db = tenant_db(&agent, &req.tenant).await?;
-    let queue = JobQueue::new(&db);
-    let now = chrono::Utc::now();
-    let recorded = queue
-        .complete(&req.job_id, &req.lease_token, &req.result, now)
-        .await
-        .map_err(internal)?;
-
-    // Only persist findings for the run that actually recorded the result, so a
-    // duplicate/late completion can't double-insert.
-    if recorded {
-        if let Some(record) = queue.get(&req.job_id).await.map_err(internal)? {
-            persist_findings(&db, &record.job.target_id, &req.result).await;
-        }
-    }
-    Ok(Json(CompleteResponse { recorded }))
-}
-
-/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
-/// program a runner needs to load). The hash is validated against traversal by
-/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
-/// input.
-#[tracing::instrument(skip_all, fields(hash = %hash))]
-pub async fn serve_artifact(
-    Extension(agent): AgentExt,
-    Path(hash): Path<String>,
-) -> Result<Response, StatusCode> {
-    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
-    match crate::ingest::blob::read_blob(base, &hash) {
-        Ok(bytes) => {
-            Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
-        }
-        Err(_) => Err(StatusCode::NOT_FOUND),
-    }
-}
-
-/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
-/// stash it as a content-addressed blob (which the runner fetches via
-/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
-/// half of the loop — a runner then leases it, provisions, and posts results.
-#[derive(Debug, Deserialize)]
-pub struct EnqueueRequest {
-    /// The tenant whose queue to enqueue into.
-    pub tenant: String,
-    /// The onboarded target to test.
-    pub target_id: String,
-}
-
-/// The enqueued job's id.
-#[derive(Debug, Serialize)]
-pub struct EnqueueResponse {
-    /// The new job id.
-    pub job_id: String,
-    /// Whether this call inserted it (false = already queued).
-    pub enqueued: bool,
-}
-
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
-pub async fn enqueue(
-    Extension(agent): AgentExt,
-    Json(req): Json<EnqueueRequest>,
-) -> Result<Json<EnqueueResponse>, StatusCode> {
-    let db = tenant_db(&agent, &req.tenant).await?;
-    let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(internal)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // Extract the control-logic program from the target's PLC-source artifacts
-    // (same selection as the in-process PLC scan).
-    let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
-    let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
-    let program = target
-        .artifacts
-        .iter()
-        .filter(|a| {
-            matches!(
-                a.kind,
-                ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-            )
-        })
-        .find_map(|a| {
-            let path = ingest_set
-                .get(&a.id)
-                .and_then(|ia| ia.working_path.clone())?;
-            werkbank_exec::plc::extract_program(&path)
-        })
-        .ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
-
-    // Stash the program source so the runner can fetch it by hash.
-    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
-    let hash =
-        crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
-
-    let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
-    let job = Job::plc_provision(
-        &job_id,
-        &req.tenant,
-        &req.target_id,
-        InputRef::blob(hash),
-        agent.config.plc_runtime.max_lifetime_secs,
-    );
-    let enqueued = JobQueue::new(&db)
-        .enqueue(job, chrono::Utc::now())
-        .await
-        .map_err(internal)?;
-    Ok(Json(EnqueueResponse { job_id, enqueued }))
-}
-
-/// Persist a job result's findings against its target: general findings
-/// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
-/// is logged, not surfaced to the runner (its result is already recorded).
-async fn persist_findings(db: &Database, target_id: &str, result: &JobResult) {
-    for finding in &result.findings {
-        let exists = db
-            .findings()
-            .find_one(doc! { "fingerprint": &finding.fingerprint })
-            .await
-            .ok()
-            .flatten()
-            .is_some();
-        if !exists {
-            if let Err(e) = db.findings().insert_one(finding).await {
-                tracing::warn!(target_id, error = %e, "werkbank: persist finding failed");
-            }
-        }
-    }
-    for finding in &result.dast_findings {
-        if let Err(e) = db.dast_findings().insert_one(finding).await {
-            tracing::warn!(target_id, error = %e, "werkbank: persist DAST finding failed");
-        }
-    }
-    tracing::info!(
-        target_id,
-        findings = result.findings.len(),
-        dast = result.dast_findings.len(),
-        "werkbank: persisted runner results"
-    );
-}
-
-/// Resolve the tenant-scoped database for a request.
-async fn tenant_db(
-    agent: &crate::agent::ComplianceAgent,
-    tenant: &str,
-) -> Result<Database, StatusCode> {
-    agent.db_pool.for_tenant_id(tenant).await.map_err(internal)
-}
-
-/// Map any internal error to a 500.
-fn internal<E: std::fmt::Display>(e: E) -> StatusCode {
-    tracing::error!("werkbank endpoint error: {e}");
-    StatusCode::INTERNAL_SERVER_ERROR
-}
-
-/// Length-checked, constant-time-ish token comparison.
-fn constant_time_eq(a: &str, b: &str) -> bool {
-    if a.len() != b.len() {
-        return false;
-    }
-    let mut diff = 0u8;
-    for (x, y) in a.bytes().zip(b.bytes()) {
-        diff |= x ^ y;
-    }
-    diff == 0
-}
-
-#[cfg(test)]
-mod tests {
-    use super::constant_time_eq;
-
-    #[test]
-    fn token_compare() {
-        assert!(constant_time_eq("secret", "secret"));
-        assert!(!constant_time_eq("secret", "secrex"));
-        assert!(!constant_time_eq("secret", "secretx"));
-        assert!(!constant_time_eq("", "x"));
-    }
-}

compliance-agent/src/api/routes.rs

@@ -6,7 +6,6 @@ use crate::api::handlers;
 pub fn build_router() -> Router {
     Router::new()
         .route("/api/v1/health", get(handlers::health))
-        .route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
         .route("/api/v1/stats/overview", get(handlers::stats_overview))
         .route(
             "/api/v1/settings/ssh-public-key",
@@ -27,10 +26,6 @@ pub fn build_router() -> Router {
             "/api/v1/targets/{id}/artifacts",
             post(handlers::onboarding::add_artifact),
         )
-        .route(
-            "/api/v1/targets/{id}/artifacts/upload",
-            post(handlers::onboarding::upload_artifact),
-        )
         .route(
             "/api/v1/targets/{id}/applicable-scans",
             get(handlers::onboarding::applicable_scans_for_target),

compliance-agent/src/api/server.rs

@@ -1,10 +1,10 @@
 use std::sync::Arc;
 
-use axum::extract::{DefaultBodyLimit, Request};
+use axum::extract::Request;
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
-use axum::routing::{delete, get, post};
+use axum::routing::{delete, get};
 use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
@@ -72,46 +72,8 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
         Router::new()
     };
 
-    // Werkbank runner API. Like admin, only mounted when its bearer token is
-    // configured; runners authenticate with WERKBANK_RUNNER_TOKEN (not a JWT).
-    let werkbank_router: Router = if agent.config.werkbank_runner_token.is_some() {
-        tracing::info!(
-            "Werkbank runner API enabled — /api/v1/werkbank/jobs/* behind WERKBANK_RUNNER_TOKEN"
-        );
-        Router::new()
-            .route(
-                "/api/v1/werkbank/jobs/lease",
-                post(handlers::werkbank_jobs::lease),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/heartbeat",
-                post(handlers::werkbank_jobs::heartbeat),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/complete",
-                post(handlers::werkbank_jobs::complete),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/enqueue",
-                post(handlers::werkbank_jobs::enqueue),
-            )
-            .route(
-                "/api/v1/werkbank/artifacts/{hash}",
-                get(handlers::werkbank_jobs::serve_artifact),
-            )
-            .layer(middleware::from_fn(
-                handlers::werkbank_jobs::require_runner_token,
-            ))
-    } else {
-        Router::new()
-    };
-
     let mut app = routes::build_router()
         .merge(admin_router)
-        .merge(werkbank_router)
-        // Allow large artifact uploads (PLC .projectarchive, firmware images,
-        // mobile packages) — axum's default request-body limit is only 2 MiB.
-        .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
         .layer(Extension(Arc::new(agent.clone())))
         .layer(CorsLayer::permissive())
         .layer(TraceLayer::new_for_http())

compliance-agent/src/config.rs

@@ -1,4 +1,3 @@
-use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -64,47 +63,5 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
         pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
         admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
         tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
-        plc_runtime: load_plc_runtime_config(),
-        werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
-        breakpilot: load_breakpilot_config(),
     })
 }
-
-/// Build the ephemeral soft-PLC provisioning config from the environment,
-/// falling back to [`PlcRuntimeConfig::default`] for any unset knob. Disabled
-/// unless `PLC_RUNTIME_ENABLED` is truthy — it requires Docker access.
-fn load_plc_runtime_config() -> PlcRuntimeConfig {
-    let d = PlcRuntimeConfig::default();
-    PlcRuntimeConfig {
-        enabled: env_var_opt("PLC_RUNTIME_ENABLED")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.enabled),
-        image: env_var_opt("PLC_RUNTIME_IMAGE").unwrap_or(d.image),
-        network: env_var_opt("PLC_RUNTIME_NETWORK").unwrap_or(d.network),
-        memory: env_var_opt("PLC_RUNTIME_MEMORY").unwrap_or(d.memory),
-        cpus: env_var_opt("PLC_RUNTIME_CPUS").unwrap_or(d.cpus),
-        max_lifetime_secs: env_var_opt("PLC_RUNTIME_MAX_LIFETIME_SECS")
-            .and_then(|v| v.parse().ok())
-            .unwrap_or(d.max_lifetime_secs),
-        openplc_user: env_var_opt("PLC_RUNTIME_OPENPLC_USER").unwrap_or(d.openplc_user),
-        openplc_password: env_secret_opt("PLC_RUNTIME_OPENPLC_PASSWORD")
-            .unwrap_or(d.openplc_password),
-    }
-}
-
-/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
-/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
-fn load_breakpilot_config() -> BreakpilotConfig {
-    let d = BreakpilotConfig::default();
-    BreakpilotConfig {
-        base_url: env_var_opt("BREAKPILOT_BASE_URL"),
-        token: env_secret_opt("BREAKPILOT_TOKEN"),
-        snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
-        semantic_mapping: env_var_opt("BREAKPILOT_SEMANTIC_MAPPING")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.semantic_mapping),
-        grounded_control_checks: env_var_opt("BREAKPILOT_GROUNDED_CHECKS")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(d.grounded_control_checks),
-    }
-}

compliance-agent/src/controls/checker.rs

@@ -1,114 +0,0 @@
-//! The grounded control checker: judge each candidate region for a control, then
-//! keep only the verdicts that survive the grounding gate.
-//!
-//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
-//! the whole recognize → ground path is then exercised without an LLM. With the
-//! real judge, determinism comes from temperature 0 plus the gate.
-
-use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
-use compliance_core::models::Finding;
-
-use super::judge::ControlJudge;
-
-/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
-pub struct GroundedControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> GroundedControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Judge every candidate region for `spec` and return the grounded findings.
-    /// A verdict that doesn't quote real code in its region is dropped by
-    /// [`ground`], so nothing fabricated reaches the caller.
-    pub async fn check(
-        &self,
-        spec: &ControlCheckSpec,
-        regions: &[CandidateRegion],
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let mut findings = Vec::new();
-        for region in regions {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::LlmVerdict;
-    use compliance_core::models::finding::Severity;
-
-    /// Deterministic stub: returns a fixed verdict for every region, so the
-    /// recognize → ground composition is tested without an LLM.
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "No default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    fn region(content: &str) -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: content.into(),
-        }
-    }
-
-    #[tokio::test]
-    async fn keeps_grounded_and_drops_ungrounded() {
-        let checker = GroundedControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let regions = vec![
-            region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
-            region("totally unrelated code\n"),      // snippet absent → dropped
-        ];
-        let findings = checker.check(&spec(), &regions, "repo").await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
-        assert_eq!(findings[0].line_number, Some(2));
-    }
-
-    #[tokio::test]
-    async fn non_violation_yields_nothing() {
-        let checker = GroundedControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: false,
-                snippet: String::new(),
-                cwe: None,
-                confidence: 0.0,
-            },
-        });
-        let findings = checker
-            .check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
-            .await;
-        assert!(findings.is_empty());
-    }
-}

compliance-agent/src/controls/index.rs

@@ -1,245 +0,0 @@
-//! In-memory embedding index over the control corpus, for region → control
-//! retrieval.
-//!
-//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
-//! controls carry none), so we map by *similarity*: embed each control's
-//! requirement text once, then for a code region pull the top-K nearest controls
-//! to hand to the grounded judge. This is the retrieval half of the semantic path.
-
-use std::path::Path;
-
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-
-use compliance_core::control_check::ControlCheckSpec;
-use compliance_core::error::CoreError;
-
-use crate::llm::LlmClient;
-
-/// A control spec paired with its requirement-text embedding.
-pub struct ControlIndex {
-    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
-}
-
-/// On-disk form of the index: the corpus identity hash plus every spec+embedding.
-/// The hash lets a later scan reuse the embeddings only if the corpus is unchanged.
-#[derive(Serialize, Deserialize)]
-struct PersistedIndex {
-    corpus_hash: String,
-    entries: Vec<PersistedEntry>,
-}
-
-#[derive(Serialize, Deserialize)]
-struct PersistedEntry {
-    spec: ControlCheckSpec,
-    embedding: Vec<f64>,
-}
-
-/// Stable hash of the corpus identity (each control's id + requirement text, in
-/// order). Same catalog → same hash → the cached embeddings are reused instead of
-/// re-embedding the whole corpus.
-fn corpus_hash(specs: &[ControlCheckSpec]) -> String {
-    let mut hasher = Sha256::new();
-    for s in specs {
-        hasher.update(s.control_id.as_bytes());
-        hasher.update([0u8]);
-        hasher.update(s.requirement.as_bytes());
-        hasher.update([0u8]);
-    }
-    format!("{:x}", hasher.finalize())
-}
-
-impl ControlIndex {
-    /// Build directly from precomputed embeddings (used by tests + callers that
-    /// already embedded the corpus).
-    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
-        Self { entries }
-    }
-
-    /// Load the index from `cache_path` if it still matches the current corpus,
-    /// otherwise embed the corpus and persist it there. This turns the per-scan
-    /// re-embed of the whole (~13.6k) master-control corpus into a one-time cost
-    /// that survives across scans; the cache self-invalidates when the catalog
-    /// changes (its [`corpus_hash`] no longer matches).
-    pub async fn load_or_build(
-        llm: &LlmClient,
-        specs: Vec<ControlCheckSpec>,
-        cache_path: &Path,
-    ) -> Result<Self, CoreError> {
-        let hash = corpus_hash(&specs);
-        if let Some(index) = Self::load_cache(cache_path, &hash).await {
-            tracing::debug!(
-                controls = index.len(),
-                "reusing cached control embedding index"
-            );
-            return Ok(index);
-        }
-        let index = Self::build(llm, specs).await?;
-        if let Err(e) = index.write_cache(cache_path, &hash).await {
-            tracing::warn!(error = %e, "failed to persist control embedding index");
-        }
-        Ok(index)
-    }
-
-    /// Read a persisted index, returning it only if its corpus hash matches.
-    async fn load_cache(path: &Path, hash: &str) -> Option<Self> {
-        let raw = tokio::fs::read(path).await.ok()?;
-        let persisted: PersistedIndex = serde_json::from_slice(&raw).ok()?;
-        if persisted.corpus_hash != hash {
-            return None;
-        }
-        Some(Self {
-            entries: persisted
-                .entries
-                .into_iter()
-                .map(|e| (e.spec, e.embedding))
-                .collect(),
-        })
-    }
-
-    /// Persist the index atomically (temp file + rename) keyed by corpus hash.
-    async fn write_cache(&self, path: &Path, hash: &str) -> Result<(), CoreError> {
-        if let Some(parent) = path.parent() {
-            tokio::fs::create_dir_all(parent).await?;
-        }
-        let persisted = PersistedIndex {
-            corpus_hash: hash.to_string(),
-            entries: self
-                .entries
-                .iter()
-                .map(|(spec, emb)| PersistedEntry {
-                    spec: spec.clone(),
-                    embedding: emb.clone(),
-                })
-                .collect(),
-        };
-        let raw = serde_json::to_vec(&persisted)?;
-        let tmp = path.with_extension("json.tmp");
-        tokio::fs::write(&tmp, &raw).await?;
-        tokio::fs::rename(&tmp, path).await?;
-        Ok(())
-    }
-
-    /// Build by embedding each control's requirement text.
-    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
-        if specs.is_empty() {
-            return Ok(Self {
-                entries: Vec::new(),
-            });
-        }
-        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
-        let embeddings = llm
-            .embed(texts)
-            .await
-            .map_err(|e| CoreError::Llm(e.to_string()))?;
-        Ok(Self {
-            entries: specs.into_iter().zip(embeddings).collect(),
-        })
-    }
-
-    pub fn len(&self) -> usize {
-        self.entries.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.entries.is_empty()
-    }
-
-    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
-    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
-        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
-            .entries
-            .iter()
-            .map(|(spec, emb)| (cosine(query, emb), spec))
-            .collect();
-        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
-        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
-    }
-}
-
-/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
-fn cosine(a: &[f64], b: &[f64]) -> f64 {
-    if a.len() != b.len() || a.is_empty() {
-        return 0.0;
-    }
-    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
-    let na: f64 = a.iter().map(|x| x * x).sum();
-    let nb: f64 = b.iter().map(|x| x * x).sum();
-    if na == 0.0 || nb == 0.0 {
-        return 0.0;
-    }
-    dot / (na.sqrt() * nb.sqrt())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[test]
-    fn nearest_ranks_by_cosine() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-            (spec("c"), vec![0.7, 0.7]),
-        ]);
-        let hits = index.nearest(&[0.9, 0.1], 2);
-        assert_eq!(hits.len(), 2);
-        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
-    }
-
-    #[test]
-    fn cosine_edges_are_zero() {
-        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
-        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
-        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
-    }
-
-    #[test]
-    fn corpus_hash_is_stable_and_identity_sensitive() {
-        let a = corpus_hash(&[spec("x"), spec("y")]);
-        assert_eq!(a, corpus_hash(&[spec("x"), spec("y")])); // same corpus → same hash
-        assert_ne!(a, corpus_hash(&[spec("y"), spec("x")])); // reorder → different
-        assert_ne!(a, corpus_hash(&[spec("x")])); // fewer controls → different
-    }
-
-    #[tokio::test]
-    #[allow(clippy::unwrap_used)]
-    async fn cache_round_trips_and_misses_on_corpus_change() {
-        let dir = std::env::temp_dir().join(format!("cidx-{}", uuid::Uuid::new_v4()));
-        let path = dir.join("control-index.json");
-        let specs = [spec("a"), spec("b")];
-        let hash = corpus_hash(&specs);
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-        ]);
-        index.write_cache(&path, &hash).await.unwrap();
-
-        // matching corpus hash → hit
-        let loaded = ControlIndex::load_cache(&path, &hash).await.unwrap();
-        assert_eq!(loaded.len(), 2);
-        assert_eq!(loaded.nearest(&[0.9, 0.1], 1)[0].control_id, "a");
-        // corpus changed → miss (forces a rebuild)
-        assert!(ControlIndex::load_cache(&path, "differenthash")
-            .await
-            .is_none());
-        // absent file → miss, not an error
-        assert!(
-            ControlIndex::load_cache(dir.join("nope.json").as_path(), &hash)
-                .await
-                .is_none()
-        );
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}

compliance-agent/src/controls/judge.rs

@@ -1,167 +0,0 @@
-//! The "recognize" stage: judge whether a code region violates a control.
-//!
-//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
-//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
-//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
-//! and everything it returns is then re-checked by the grounding gate
-//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
-//! smart; it is never trusted.
-
-use std::sync::Arc;
-
-use serde::Deserialize;
-
-use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
-
-use crate::llm::LlmClient;
-
-/// Prompt/logic version — part of the verdict cache key, bump on any change here.
-pub const PROMPT_VERSION: &str = "control-judge-v1";
-
-const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
-You are given ONE compliance control (a requirement) and ONE code region. Decide \
-ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
-shown — never assume code that is not present. (2) If and only if it violates, copy \
-the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
-region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
-violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
-Respond with STRICT JSON only, no prose: \
-{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
-
-/// Judges one (control, region). Async-in-trait so a stub can drive tests.
-#[allow(async_fn_in_trait)]
-pub trait ControlJudge: Send + Sync {
-    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
-}
-
-/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
-pub struct LlmControlJudge {
-    llm: Arc<LlmClient>,
-}
-
-impl LlmControlJudge {
-    pub fn new(llm: Arc<LlmClient>) -> Self {
-        Self { llm }
-    }
-}
-
-impl ControlJudge for LlmControlJudge {
-    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
-        let user = build_user_prompt(spec, region);
-        match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
-            Ok(response) => parse_verdict(&response),
-            Err(e) => {
-                // Fail closed: a transient model error yields no finding, never a
-                // fabricated one.
-                tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
-                no_violation()
-            }
-        }
-    }
-}
-
-fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
-    format!(
-        "CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
-        id = spec.control_id,
-        title = spec.title,
-        req = spec.requirement,
-        file = region.file,
-        line = region.start_line,
-        code = region.content,
-    )
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct RawVerdict {
-    #[serde(default)]
-    violates: bool,
-    #[serde(default)]
-    snippet: String,
-    #[serde(default)]
-    cwe: Option<String>,
-    #[serde(default)]
-    confidence: f64,
-}
-
-/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
-/// degrades to a non-violation (never a fabricated finding).
-fn parse_verdict(response: &str) -> LlmVerdict {
-    let cleaned = response
-        .trim()
-        .trim_start_matches("```json")
-        .trim_start_matches("```")
-        .trim_end_matches("```")
-        .trim();
-    match serde_json::from_str::<RawVerdict>(cleaned) {
-        Ok(raw) => LlmVerdict {
-            violates: raw.violates,
-            snippet: raw.snippet,
-            cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
-            confidence: raw.confidence,
-        },
-        Err(e) => {
-            tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
-            no_violation()
-        }
-    }
-}
-
-fn no_violation() -> LlmVerdict {
-    LlmVerdict {
-        violates: false,
-        snippet: String::new(),
-        cwe: None,
-        confidence: 0.0,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "Products must not ship default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    #[test]
-    fn parses_plain_and_fenced_json() {
-        let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
-        let v = parse_verdict(plain);
-        assert!(v.violates);
-        assert_eq!(v.snippet, "PASSWORD = \"x\"");
-        assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
-
-        let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
-        assert!(!parse_verdict(fenced).violates);
-    }
-
-    #[test]
-    fn garbage_and_empty_cwe_are_safe() {
-        assert!(!parse_verdict("not json at all").violates); // fail closed
-        let no_cwe =
-            parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": "  ", "confidence": 0.5}"#);
-        assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
-    }
-
-    #[test]
-    fn user_prompt_carries_control_and_code() {
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 10,
-            content: "PASSWORD = \"admin\"".into(),
-        };
-        let p = build_user_prompt(&spec(), &region);
-        assert!(p.contains("cra-ai-8"));
-        assert!(p.contains("Products must not ship default credentials"));
-        assert!(p.contains("PASSWORD = \"admin\""));
-        assert!(p.contains("src/auth.py"));
-    }
-}

compliance-agent/src/controls/mod.rs

@@ -1,23 +0,0 @@
-//! Controls corpus providers.
-//!
-//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
-//! the control corpus the mapping engine assesses findings against. Currently:
-//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
-//! and snapshots it locally.
-
-mod checker;
-mod index;
-mod judge;
-mod oscal_provider;
-mod scan_triage;
-mod semantic;
-mod surface;
-mod triage;
-
-pub use checker::GroundedControlChecker;
-pub use index::ControlIndex;
-pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
-pub use oscal_provider::OscalControlsProvider;
-pub use scan_triage::{grounded_surface_findings, semantic_stamp_findings, triage_repo_findings};
-pub use semantic::SemanticControlChecker;
-pub use triage::{ControlTriage, TriageOutcome};

compliance-agent/src/controls/oscal_provider.rs

@@ -1,229 +0,0 @@
-//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
-//! catalog export.
-//!
-//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
-//! the exact bytes to disk (so scans are deterministic and keep working offline /
-//! on-prem), and maps the catalog into the corpus controls the mapping engine
-//! consumes. The producer owns the catalog; we own the assessment — this is the
-//! ingest half of the loop.
-
-use std::path::PathBuf;
-
-use secrecy::{ExposeSecret, SecretString};
-
-use compliance_core::error::CoreError;
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::models::oscal::OscalDocument;
-use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
-
-/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
-/// and snapshots it locally for deterministic / offline reuse.
-pub struct OscalControlsProvider {
-    http: reqwest::Client,
-    base_url: String,
-    token: Option<SecretString>,
-    snapshot_dir: PathBuf,
-}
-
-impl OscalControlsProvider {
-    /// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
-    /// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
-    /// snapshots are written so a later scan can reuse them without the network.
-    pub fn new(
-        http: reqwest::Client,
-        base_url: impl Into<String>,
-        token: Option<SecretString>,
-        snapshot_dir: impl Into<PathBuf>,
-    ) -> Self {
-        Self {
-            http,
-            base_url: base_url.into(),
-            token,
-            snapshot_dir: snapshot_dir.into(),
-        }
-    }
-
-    fn catalog_url(&self, framework: &str) -> String {
-        format!(
-            "{}/api/compliance/v1/oscal/catalog?framework={framework}",
-            self.base_url.trim_end_matches('/')
-        )
-    }
-
-    fn snapshot_path(&self, framework: &str) -> PathBuf {
-        self.snapshot_dir
-            .join(format!("oscal-catalog-{framework}.json"))
-    }
-
-    /// Fetch the raw catalog bytes for a framework token over HTTP.
-    async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
-        let mut req = self.http.get(self.catalog_url(framework));
-        if let Some(token) = &self.token {
-            req = req.bearer_auth(token.expose_secret());
-        }
-        let resp = req
-            .send()
-            .await
-            .map_err(|e| CoreError::Http(e.to_string()))?;
-        if !resp.status().is_success() {
-            return Err(CoreError::Http(format!(
-                "catalog fetch for {framework} returned HTTP {}",
-                resp.status()
-            )));
-        }
-        resp.bytes()
-            .await
-            .map(|b| b.to_vec())
-            .map_err(|e| CoreError::Http(e.to_string()))
-    }
-
-    /// Write a catalog snapshot atomically (temp file + rename).
-    async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
-        tokio::fs::create_dir_all(&self.snapshot_dir).await?;
-        let path = self.snapshot_path(framework);
-        let tmp = path.with_extension("json.tmp");
-        tokio::fs::write(&tmp, raw).await?;
-        tokio::fs::rename(&tmp, &path).await?;
-        Ok(())
-    }
-
-    /// Read a previously written snapshot, if one exists.
-    async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
-        match tokio::fs::read(self.snapshot_path(framework)).await {
-            Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// Load the catalog for a framework token: fetch fresh + snapshot the exact
-    /// bytes; on network failure, fall back to the last snapshot so scans run.
-    async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
-        match self.fetch_raw(framework).await {
-            Ok(raw) => {
-                let doc: OscalDocument = serde_json::from_slice(&raw)?;
-                if let Err(e) = self.write_snapshot(framework, &raw).await {
-                    tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
-                }
-                Ok(doc)
-            }
-            Err(fetch_err) => match self.read_snapshot(framework).await? {
-                Some(doc) => {
-                    tracing::warn!(
-                        framework, error = %fetch_err,
-                        "OSCAL catalog fetch failed; falling back to snapshot"
-                    );
-                    Ok(doc)
-                }
-                None => Err(fetch_err),
-            },
-        }
-    }
-
-    /// Load the OSCAL catalog for a compliance framework.
-    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
-        self.load_token(&framework.to_string()).await
-    }
-
-    /// Load the code-checkable master-controls catalog
-    /// (`?framework=master-controls`).
-    pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
-        self.load_token("master-controls").await
-    }
-}
-
-/// Order controls whose title/text mention the query context first (stable), then
-/// truncate to the requested limit. Naive relevance — refined when the assessment
-/// layer lands.
-fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
-    if !context.is_empty() {
-        let needle = context.to_lowercase();
-        controls.sort_by_key(|c| {
-            let hit =
-                c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
-            u8::from(!hit)
-        });
-    }
-    controls.truncate(limit);
-    controls
-}
-
-impl ControlsProvider for OscalControlsProvider {
-    fn name(&self) -> &str {
-        "breakpilot-oscal"
-    }
-
-    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
-        let mut out: Vec<Control> = Vec::new();
-        for &framework in query.frameworks {
-            match self.load(framework).await {
-                Ok(doc) => out.extend(doc.to_controls()),
-                Err(e) => {
-                    tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
-                }
-            }
-        }
-        Ok(rank_and_truncate(out, query.context, query.limit))
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
-      "version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
-      "groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
-      "props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
-
-    fn provider(dir: &std::path::Path) -> OscalControlsProvider {
-        OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
-    }
-
-    #[test]
-    fn builds_catalog_url_and_snapshot_path() {
-        let p = provider(std::path::Path::new("/snap"));
-        assert_eq!(
-            p.catalog_url("cra"),
-            "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
-        );
-        assert_eq!(
-            p.snapshot_path("cra"),
-            std::path::Path::new("/snap/oscal-catalog-cra.json")
-        );
-    }
-
-    #[test]
-    fn ranks_context_hits_first_then_truncates() {
-        let mk = |id: &str, title: &str| Control {
-            id: id.into(),
-            framework: ComplianceFramework::Cra,
-            title: title.into(),
-            text: String::new(),
-            source: None,
-        };
-        let controls = vec![
-            mk("a", "logging policy"),
-            mk("b", "multi-factor auth"),
-            mk("c", "backup"),
-        ];
-        let ranked = rank_and_truncate(controls, "auth", 2);
-        assert_eq!(ranked.len(), 2);
-        assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
-    }
-
-    #[tokio::test]
-    async fn snapshot_round_trip_and_offline_fallback() {
-        let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
-        let p = provider(&dir);
-        assert!(p.read_snapshot("cra").await.unwrap().is_none());
-        p.write_snapshot("cra", MINI_CATALOG.as_bytes())
-            .await
-            .unwrap();
-        let doc = p.read_snapshot("cra").await.unwrap().unwrap();
-        assert_eq!(doc.to_controls().len(), 1);
-        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}

compliance-agent/src/controls/scan_triage.rs

@@ -1,291 +0,0 @@
-//! Scan-pipeline integration for control triage.
-//!
-//! After the deterministic tools have produced findings, this stamps each finding
-//! with the compliance control(s) it's evidence for and marks control-level false
-//! positives — using the ingested OSCAL catalog for control text, the
-//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
-//! confirm. Skipped entirely unless breakpilot is configured.
-
-use std::collections::HashMap;
-use std::path::Path;
-use std::sync::Arc;
-
-use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
-use compliance_core::models::finding::{Finding, FindingStatus, Severity};
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::AgentConfig;
-use control_map::ControlMap;
-
-use super::surface;
-use super::{
-    ControlIndex, ControlTriage, GroundedControlChecker, LlmControlJudge, OscalControlsProvider,
-    SemanticControlChecker, TriageOutcome,
-};
-use crate::llm::LlmClient;
-
-/// Nearest master controls judged per code region in the semantic pass.
-const SEMANTIC_TOP_K: usize = 5;
-
-/// Lines of context to read on each side of a finding's line.
-const REGION_WINDOW: usize = 6;
-
-/// Triage every finding in `findings` against the CRA control map: stamp
-/// `control_refs` on confirmed findings and flag control false positives. Returns
-/// the number of findings tagged with at least one control.
-pub async fn triage_repo_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let specs = build_specs(&provider).await;
-    if specs.is_empty() {
-        return 0;
-    }
-    let map = match ControlMap::cra() {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(error = %e, "control map failed to load; skipping control triage");
-            return 0;
-        }
-    };
-    let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        match triage.triage(finding, &region).await {
-            TriageOutcome::Confirmed(controls) => {
-                finding.control_refs = controls;
-                tagged += 1;
-            }
-            TriageOutcome::FalsePositive => {
-                finding.status = FindingStatus::FalsePositive;
-                finding.triage_action = Some("control_false_positive".to_string());
-            }
-            TriageOutcome::Unmapped => {}
-        }
-    }
-    tagged
-}
-
-/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
-async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
-    let mut specs = HashMap::new();
-    match provider.load(ComplianceFramework::Cra).await {
-        Ok(doc) => {
-            for control in doc.to_controls() {
-                specs.insert(
-                    control.id.clone(),
-                    ControlCheckSpec {
-                        control_id: control.id,
-                        title: control.title,
-                        requirement: control.text,
-                        default_cwe: None,
-                        severity: Severity::Medium,
-                    },
-                );
-            }
-        }
-        Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
-    }
-    specs
-}
-
-/// Absence-based control pass (the grounded half of the hybrid coverage): for each
-/// control with a [`surface`] definition, deterministically retrieve the code
-/// surfaces it governs (login routes, logging setup, update/download code) and have
-/// the grounded judge decide whether the control holds there. Returns net-new
-/// findings, each already tagged with its control and grounded to a real snippet.
-///
-/// Gated: the orchestrator runs this only when `breakpilot.grounded_control_checks`
-/// is set. Absence detection is the least deterministic path (the judge decides
-/// presence/absence, not a syntactic pattern), so it stays off until tuned live.
-pub async fn grounded_surface_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    repo_id: &str,
-) -> Vec<Finding> {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return Vec::new();
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let specs = build_specs(&provider).await;
-    if specs.is_empty() {
-        return Vec::new();
-    }
-    let checker = GroundedControlChecker::new(LlmControlJudge::new(llm));
-
-    let mut out = Vec::new();
-    for surf in surface::SURFACES {
-        let Some(spec) = specs.get(surf.control_id) else {
-            continue; // catalog doesn't carry this control
-        };
-        let regions = surface::retrieve(repo_path, surf.terms);
-        if regions.is_empty() {
-            continue;
-        }
-        out.extend(checker.check(spec, &regions, repo_id).await);
-    }
-    out
-}
-
-/// Read a window of lines around `line` (1-based) from `repo_path/file`.
-fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
-    let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
-    let lines: Vec<&str> = content.lines().collect();
-    if lines.is_empty() {
-        return None;
-    }
-    let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
-    let start = center.saturating_sub(REGION_WINDOW);
-    let end = (center + REGION_WINDOW + 1).min(lines.len());
-    Some(CandidateRegion {
-        file: file.to_string(),
-        start_line: (start as u32) + 1,
-        content: lines[start..end].join("\n"),
-    })
-}
-
-/// Master-controls **semantic** pass: for each finding's code region, retrieve the
-/// top-K nearest master controls by embedding, have the grounded judge confirm,
-/// and stamp the confirmed control ids onto the finding — the scale path for the
-/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
-/// of findings that gained a master-control ref.
-///
-/// Gated: the orchestrator runs this only when `breakpilot.semantic_mapping` is
-/// set (default off, flipped on once the master-controls catalog is live). The
-/// control embedding index is built once and cached to `snapshot_dir` keyed by
-/// corpus hash ([`ControlIndex::load_or_build`]), so only the first scan after a
-/// catalog change pays the embedding cost.
-pub async fn semantic_stamp_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0;
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let doc = match provider.load_master_controls().await {
-        Ok(d) => d,
-        Err(e) => {
-            tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
-            return 0;
-        }
-    };
-    let specs: Vec<ControlCheckSpec> = doc
-        .to_controls()
-        .into_iter()
-        .map(|c| ControlCheckSpec {
-            control_id: c.id,
-            title: c.title,
-            requirement: c.text,
-            default_cwe: None,
-            severity: Severity::Medium,
-        })
-        .collect();
-    let cache_path =
-        Path::new(&config.breakpilot.snapshot_dir).join("control-index-master-controls.json");
-    let index = match ControlIndex::load_or_build(&llm, specs, &cache_path).await {
-        Ok(i) if !i.is_empty() => i,
-        Ok(_) => return 0,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to embed master-controls corpus");
-            return 0;
-        }
-    };
-    let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        if finding.status == FindingStatus::FalsePositive {
-            continue;
-        }
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        let region_emb = match llm.embed(vec![region.content.clone()]).await {
-            Ok(mut embs) => match embs.pop() {
-                Some(v) => v,
-                None => continue,
-            },
-            Err(e) => {
-                tracing::warn!(error = %e, "region embed failed; skipping finding");
-                continue;
-            }
-        };
-        let confirmed = checker
-            .check(
-                &index,
-                &region,
-                &region_emb,
-                SEMANTIC_TOP_K,
-                &finding.repo_id,
-            )
-            .await;
-        let before = finding.control_refs.len();
-        for f in confirmed {
-            for cref in f.control_refs {
-                if !finding.control_refs.contains(&cref) {
-                    finding.control_refs.push(cref);
-                }
-            }
-        }
-        if finding.control_refs.len() > before {
-            tagged += 1;
-        }
-    }
-    tagged
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn fetch_region_windows_around_the_line() {
-        let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let file = "a.py";
-        std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
-        let r = fetch_region(&dir, file, 4).unwrap();
-        assert!(r.content.contains("SECRET=1"));
-        assert_eq!(r.start_line, 1); // window clamps to file start
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn fetch_region_missing_file_is_none() {
-        assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
-    }
-}

compliance-agent/src/controls/semantic.rs

@@ -1,119 +0,0 @@
-//! Semantic control mapping: retrieve the top-K controls nearest a code region,
-//! then confirm each with the grounded judge.
-//!
-//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
-//! what scales to the full master-control corpus: the LLM only ever judges a
-//! handful of retrieved candidates, and every surviving verdict is still anchored
-//! to real code by the grounding gate.
-
-use compliance_core::control_check::{ground, CandidateRegion};
-use compliance_core::models::Finding;
-
-use super::index::ControlIndex;
-use super::judge::ControlJudge;
-
-/// Retrieve → judge → ground, generic over the judge so tests use a stub.
-pub struct SemanticControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> SemanticControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Map a code region to the controls it violates. `region_embedding` is the
-    /// region's embedding (the caller computes it via the LLM); the top-`k`
-    /// nearest controls in `index` are judged and grounded.
-    pub async fn check(
-        &self,
-        index: &ControlIndex,
-        region: &CandidateRegion,
-        region_embedding: &[f64],
-        k: usize,
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let candidates = index.nearest(region_embedding, k);
-        let mut findings = Vec::new();
-        for spec in &candidates {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
-    use compliance_core::models::finding::Severity;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[tokio::test]
-    async fn retrieves_then_grounds_the_nearest_control() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("mc-near"), vec![1.0, 0.0]),
-            (spec("mc-far"), vec![0.0, 1.0]),
-        ]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin\"\n".into(),
-        };
-        // Query embedding nearest to mc-near; k=1 → only mc-near is judged.
-        let findings = checker
-            .check(&index, &region, &[0.95, 0.05], 1, "repo")
-            .await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
-    }
-
-    #[tokio::test]
-    async fn ungrounded_verdict_is_dropped() {
-        let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "not in the region".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "f".into(),
-            start_line: 1,
-            content: "real code\n".into(),
-        };
-        let findings = checker.check(&index, &region, &[1.0, 0.0], 1, "repo").await;
-        assert!(findings.is_empty());
-    }
-}

compliance-agent/src/controls/surface.rs

@@ -1,246 +0,0 @@
-//! Surface retrieval for absence-based controls.
-//!
-//! Some CRA controls are violated by an *absence* — no rate limiting on login, no
-//! security logging, no signature check on an update — so there's no offending
-//! pattern for semgrep to match. Instead we deterministically locate the code
-//! *surface* the control governs (a login route, a logging setup, update/download
-//! code) by identifier/route terms, then hand each surface region to the grounded
-//! judge, which decides whether the control is satisfied there. The resulting
-//! finding grounds to the surface snippet, so nothing fabricated survives.
-//!
-//! Retrieval is intentionally cheap and bounded: keyword match + a fixed window,
-//! capped per control to keep the downstream LLM cost predictable.
-
-use std::path::Path;
-
-use compliance_core::control_check::CandidateRegion;
-
-/// An absence-based control and the case-insensitive terms that mark the code
-/// surface it governs.
-pub struct Surface {
-    pub control_id: &'static str,
-    pub terms: &'static [&'static str],
-}
-
-/// The absence-based CRA controls we retrieve surfaces for — the grounded half of
-/// the hybrid coverage (the pattern-expressible half is custom semgrep rules).
-pub const SURFACES: &[Surface] = &[
-    Surface {
-        control_id: "cra-ai-6", // Integritaetspruefung
-        terms: &[
-            "checksum",
-            "sha256",
-            "signature",
-            "hmac",
-            "integrity",
-            "verify",
-        ],
-    },
-    Surface {
-        control_id: "cra-ai-11", // Brute-Force-Schutz
-        terms: &[
-            "login",
-            "signin",
-            "authenticate",
-            "/auth",
-            "password",
-            "ratelimit",
-        ],
-    },
-    Surface {
-        control_id: "cra-ai-24", // Security-Logging
-        terms: &["login", "authorize", "permission", "role", "admin", "audit"],
-    },
-    Surface {
-        control_id: "cra-ai-27", // Log-Integritaet und -Aufbewahrung
-        terms: &["logging", "logger", "getlogger", "audit_log"],
-    },
-    Surface {
-        control_id: "cra-ai-28", // Sichere Update-Mechanismen
-        terms: &["update", "upgrade", "download", "firmware"],
-    },
-    Surface {
-        control_id: "cra-ai-29", // Update-Authentizitaet
-        terms: &["update", "signature", "verify", "pubkey", "certificate"],
-    },
-    Surface {
-        control_id: "cra-ai-30", // Update-Integritaet
-        terms: &["update", "checksum", "digest", "integrity", "verify"],
-    },
-];
-
-/// Source file extensions worth reading (skip binaries/assets/lockfiles).
-const CODE_EXTS: &[&str] = &[
-    "py", "js", "ts", "tsx", "jsx", "go", "java", "rb", "php", "rs", "cs", "kt",
-];
-/// Directories never worth walking.
-const SKIP_DIRS: &[&str] = &[
-    ".git",
-    "node_modules",
-    "target",
-    "vendor",
-    ".venv",
-    "__pycache__",
-    "dist",
-    "build",
-];
-/// Lines of context on each side of a hit.
-const WINDOW: usize = 6;
-/// Cap on regions per control, to bound downstream LLM calls.
-const MAX_REGIONS_PER_CONTROL: usize = 8;
-/// Skip files larger than this (generated/minified).
-const MAX_FILE_BYTES: u64 = 512 * 1024;
-
-/// Deterministically retrieve up to [`MAX_REGIONS_PER_CONTROL`] code regions in
-/// `repo_path` whose lines mention any of `terms`. Hits close together within a
-/// file are merged into one region; results are capped to bound LLM cost.
-pub fn retrieve(repo_path: &Path, terms: &[&str]) -> Vec<CandidateRegion> {
-    let lowered: Vec<String> = terms.iter().map(|t| t.to_lowercase()).collect();
-    let mut regions = Vec::new();
-    for entry in walk(repo_path) {
-        if regions.len() >= MAX_REGIONS_PER_CONTROL {
-            break;
-        }
-        let path = entry.path();
-        if !has_code_ext(path) {
-            continue;
-        }
-        let Ok(meta) = entry.metadata() else { continue };
-        if !meta.is_file() || meta.len() > MAX_FILE_BYTES {
-            continue;
-        }
-        let Ok(content) = std::fs::read_to_string(path) else {
-            continue;
-        };
-        let rel = path
-            .strip_prefix(repo_path)
-            .unwrap_or(path)
-            .to_string_lossy()
-            .to_string();
-        let lines: Vec<&str> = content.lines().collect();
-        let hits: Vec<usize> = lines
-            .iter()
-            .enumerate()
-            .filter(|(_, line)| {
-                let ll = line.to_lowercase();
-                lowered.iter().any(|t| ll.contains(t.as_str()))
-            })
-            .map(|(i, _)| i)
-            .collect();
-        for center in merge_centers(&hits) {
-            if regions.len() >= MAX_REGIONS_PER_CONTROL {
-                break;
-            }
-            let start = center.saturating_sub(WINDOW);
-            let end = (center + WINDOW + 1).min(lines.len());
-            regions.push(CandidateRegion {
-                file: rel.clone(),
-                start_line: (start as u32) + 1,
-                content: lines[start..end].join("\n"),
-            });
-        }
-    }
-    regions
-}
-
-/// Collapse ascending hit indices that fall within one window into a single
-/// representative center, so overlapping regions aren't judged repeatedly.
-fn merge_centers(hits: &[usize]) -> Vec<usize> {
-    let mut out: Vec<usize> = Vec::new();
-    for &h in hits {
-        match out.last() {
-            Some(&last) if h.saturating_sub(last) <= WINDOW => {}
-            _ => out.push(h),
-        }
-    }
-    out
-}
-
-fn has_code_ext(path: &Path) -> bool {
-    path.extension()
-        .and_then(|e| e.to_str())
-        .is_some_and(|e| CODE_EXTS.contains(&e))
-}
-
-fn walk(root: &Path) -> Vec<walkdir::DirEntry> {
-    walkdir::WalkDir::new(root)
-        .into_iter()
-        .filter_entry(|e| {
-            let name = e.file_name().to_string_lossy();
-            !SKIP_DIRS.contains(&name.as_ref())
-        })
-        .filter_map(|e| e.ok())
-        .collect()
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn write(dir: &Path, rel: &str, body: &str) {
-        let p = dir.join(rel);
-        if let Some(parent) = p.parent() {
-            std::fs::create_dir_all(parent).unwrap();
-        }
-        std::fs::write(p, body).unwrap();
-    }
-
-    fn terms_for(control_id: &str) -> &'static [&'static str] {
-        SURFACES
-            .iter()
-            .find(|s| s.control_id == control_id)
-            .unwrap()
-            .terms
-    }
-
-    #[test]
-    fn surfaces_cover_the_absence_based_controls() {
-        assert_eq!(SURFACES.len(), 7);
-        for id in [
-            "cra-ai-6",
-            "cra-ai-11",
-            "cra-ai-24",
-            "cra-ai-27",
-            "cra-ai-28",
-            "cra-ai-29",
-            "cra-ai-30",
-        ] {
-            assert!(SURFACES.iter().any(|s| s.control_id == id), "{id} missing");
-        }
-    }
-
-    #[test]
-    fn retrieves_matching_region_with_context() {
-        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        write(
-            &dir,
-            "app/auth.py",
-            "import x\n\n\n\n\n\n\ndef login(u, p):\n    return check(u, p)\n",
-        );
-        let regions = retrieve(&dir, terms_for("cra-ai-11"));
-        assert_eq!(regions.len(), 1);
-        assert!(regions[0].content.contains("def login"));
-        assert_eq!(regions[0].file, "app/auth.py");
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn skips_non_code_and_vendored() {
-        let dir = std::env::temp_dir().join(format!("surface-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        write(&dir, "README.md", "login and password and audit\n"); // not code ext
-        write(&dir, "node_modules/pkg/index.js", "function login() {}\n"); // vendored
-        assert!(retrieve(&dir, terms_for("cra-ai-11")).is_empty());
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn merges_adjacent_hits_into_one_region() {
-        // Two hits one line apart collapse to a single center/region.
-        assert_eq!(merge_centers(&[10, 11, 30]), vec![10, 30]);
-        assert_eq!(merge_centers(&[]), Vec::<usize>::new());
-        assert_eq!(merge_centers(&[5]), vec![5]);
-    }
-}

compliance-agent/src/controls/triage.rs

@@ -1,234 +0,0 @@
-//! Triage step: confirm/refute a deterministic tool finding against the controls
-//! it maps to (via the `control-map` LUT), grounding the judgment.
-//!
-//! This is where the LLM finally enters — as a **false-positive filter over tool
-//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
-//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
-//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
-//! judge then confirms or refutes each, and only judgments anchored to real code
-//! survive.
-
-use std::collections::HashMap;
-
-use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
-use compliance_core::models::Finding;
-use control_map::ControlMap;
-
-use super::judge::ControlJudge;
-
-/// What triage decided for one tool finding.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TriageOutcome {
-    /// The finding maps to no control in the LUT — keep it, untagged.
-    Unmapped,
-    /// Maps to controls and the grounded judge confirmed at least one — keep the
-    /// finding and tag it with these control ids.
-    Confirmed(Vec<String>),
-    /// Maps to controls but the judge grounded none — treat as a false positive.
-    FalsePositive,
-}
-
-/// Triages tool findings against the control map, confirming with a grounded judge.
-pub struct ControlTriage<J> {
-    judge: J,
-    map: ControlMap,
-    /// Control requirement specs (by control id), built from the ingested catalog.
-    specs: HashMap<String, ControlCheckSpec>,
-}
-
-impl<J: ControlJudge> ControlTriage<J> {
-    pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
-        Self { judge, map, specs }
-    }
-
-    /// Triage one tool finding. `region` is the code around the finding, used as
-    /// the grounding evidence for the judge.
-    pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
-        // Match by CWE (off-the-shelf findings) and/or rule id (our custom
-        // detectors, which carry no LUT-bound CWE). A finding with neither is
-        // simply unmapped.
-        let mapped = self.map.controls_for_finding(
-            &finding.scanner,
-            finding.cwe.as_deref(),
-            finding.rule_id.as_deref(),
-        );
-        if mapped.is_empty() {
-            return TriageOutcome::Unmapped;
-        }
-
-        let mut confirmed = Vec::new();
-        for entry in mapped {
-            let Some(spec) = self.specs.get(&entry.control) else {
-                continue;
-            };
-            let verdict = self.judge.judge(spec, region).await;
-            // The verdict only counts if it grounds to real code in the region.
-            if ground(spec, region, &verdict, &finding.repo_id).is_some() {
-                confirmed.push(entry.control.clone());
-            }
-        }
-
-        if confirmed.is_empty() {
-            TriageOutcome::FalsePositive
-        } else {
-            TriageOutcome::Confirmed(confirmed)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::LlmVerdict;
-    use compliance_core::models::finding::Severity;
-    use compliance_core::models::scan::ScanType;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn specs() -> HashMap<String, ControlCheckSpec> {
-        let mut m = HashMap::new();
-        m.insert(
-            "cra-ai-8".to_string(),
-            ControlCheckSpec {
-                control_id: "cra-ai-8".into(),
-                title: "No default passwords".into(),
-                requirement: "No default credentials".into(),
-                default_cwe: Some("CWE-798".into()),
-                severity: Severity::High,
-            },
-        );
-        m
-    }
-
-    fn semgrep_finding(cwe: &str) -> Finding {
-        let mut f = Finding::new(
-            "repo".into(),
-            "fp1".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "hardcoded credential".into(),
-            "desc".into(),
-            Severity::High,
-        );
-        f.cwe = Some(cwe.into());
-        f
-    }
-
-    fn region() -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin123\"\n".into(),
-        }
-    }
-
-    #[tokio::test]
-    async fn confirmed_finding_is_tagged_with_control() {
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "PASSWORD = \"admin123\"".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
-        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
-    }
-
-    #[tokio::test]
-    async fn refuted_mapped_finding_is_false_positive() {
-        // Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: false,
-                    snippet: String::new(),
-                    cwe: None,
-                    confidence: 0.1,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
-        assert_eq!(out, TriageOutcome::FalsePositive);
-    }
-
-    #[tokio::test]
-    async fn custom_rule_finding_without_cwe_is_confirmed() {
-        // A custom detector finding carries a rule id but no LUT-bound CWE; it must
-        // still map (by rule id) and confirm.
-        let mut specs = specs();
-        specs.insert(
-            "cra-ai-1".to_string(),
-            ControlCheckSpec {
-                control_id: "cra-ai-1".into(),
-                title: "Secure-by-Default".into(),
-                requirement: "Ship secure defaults".into(),
-                default_cwe: None,
-                severity: Severity::Medium,
-            },
-        );
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "app.run(debug=True)".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs,
-        );
-        let mut f = Finding::new(
-            "repo".into(),
-            "fp".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "flask debug".into(),
-            "desc".into(),
-            Severity::Medium,
-        );
-        f.rule_id = Some("tmp.x.cra-ai-1-flask-debug-enabled".into()); // no cwe
-        let region = CandidateRegion {
-            file: "app.py".into(),
-            start_line: 1,
-            content: "app.run(debug=True)\n".into(),
-        };
-        let out = triage.triage(&f, &region).await;
-        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-1".to_string()]));
-    }
-
-    #[tokio::test]
-    async fn unmapped_cwe_is_left_untagged() {
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "PASSWORD = \"admin123\"".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage
-            .triage(&semgrep_finding("CWE-99999"), &region())
-            .await;
-        assert_eq!(out, TriageOutcome::Unmapped);
-    }
-}

compliance-agent/src/database.rs

@@ -465,34 +465,6 @@ impl Database {
             )
             .await?;
 
-        // werkbank_jobs: unique job id (idempotent enqueue by job id)
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "job.id": 1 })
-                    .options(IndexOptions::builder().unique(true).build())
-                    .build(),
-            )
-            .await?;
-
-        // werkbank_jobs: lease query — oldest queued job for an executor
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // werkbank_jobs: visibility-timeout sweep of expired leases
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "lease_expires_at": 1 })
-                    .build(),
-            )
-            .await?;
-
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -591,12 +563,6 @@ impl Database {
         self.inner.collection("pentest_messages")
     }
 
-    /// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
-    /// control plane enqueues and runners lease.
-    pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
-        self.inner.collection("werkbank_jobs")
-    }
-
     #[allow(dead_code)]
     pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
         self.inner.collection(name)

compliance-agent/src/error.rs

@@ -27,9 +27,6 @@ pub enum AgentError {
     #[error("Configuration error: {0}")]
     Config(String),
 
-    #[error("Dynamic-execution error: {0}")]
-    Exec(#[from] werkbank_exec::ExecError),
-
     #[error("{0}")]
     Other(String),
 }

compliance-agent/src/ingest/blob.rs

@@ -32,30 +32,6 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
     Ok((hex::encode(hasher.finalize()), total))
 }
 
-/// Store raw bytes in the content-addressed blob store under `base`, returning
-/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
-/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
-pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
-    let sha = hex::encode(Sha256::digest(bytes));
-    let dir = base.join("blobs").join(&sha[0..2]);
-    fs::create_dir_all(&dir)?;
-    let dest = dir.join(&sha);
-    if !dest.exists() {
-        fs::write(&dest, bytes)?;
-    }
-    Ok(sha)
-}
-
-/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
-/// so a request can't traverse outside the blob store.
-pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
-    if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
-        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
-    }
-    let path = base.join("blobs").join(&sha[0..2]).join(sha);
-    Ok(fs::read(path)?)
-}
-
 /// Copy `src` into the content-addressed blob store under `base`, returning the
 /// stored path. Idempotent: an already-present blob is not rewritten.
 pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {

compliance-agent/src/ingest/mod.rs

@@ -6,7 +6,7 @@
 //! is also the reconciliation key against sibling products (a firmware sha256
 //! matches tramiton's `Artifact.sha256`).
 
-pub(crate) mod blob;
+mod blob;
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -162,27 +162,14 @@ fn ingest_blob(
         match blob::extract_zip(&stored, &dest) {
             Ok(()) => dest,
             Err(e) => {
-                // Not a zip container — this is a single uploaded file (e.g. a
+                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
-                // `.st`/`.xml` PLC project or a `.tar.gz`). The content-addressed
+                // note it so later stages can decide what to do.
-                // blob has no extension, so materialize it into a working dir
-                // under its original name; extension-based scanners (PLC) can then
-                // discover it and report a readable path.
                 facts.push(DetectedFact::new(
                     "archive_unextracted",
                     e.to_string(),
                     "ingest",
                 ));
-                match materialize_single(&stored, &dest, &blob_file_name(artifact)) {
+                stored.clone()
-                    Ok(dir) => dir,
-                    Err(copy_err) => {
-                        facts.push(DetectedFact::new(
-                            "materialize_failed",
-                            copy_err.to_string(),
-                            "ingest",
-                        ));
-                        stored.clone()
-                    }
-                }
             }
         }
     } else {
@@ -199,27 +186,6 @@ fn ingest_blob(
     })
 }
 
-/// Copy a stored blob into `dest`/`name`, returning `dest`. Used when an
-/// "extractable" artifact turns out to be a single file rather than an archive.
-fn materialize_single(stored: &Path, dest: &Path, name: &str) -> Result<PathBuf, AgentError> {
-    std::fs::create_dir_all(dest)?;
-    std::fs::copy(stored, dest.join(name))?;
-    Ok(dest.to_path_buf())
-}
-
-/// A safe, single-segment file name for an artifact, preserving the original
-/// extension so scanners can identify it. Derives from `source_ref` (the
-/// uploaded/original file name); `file_name` strips any directory components,
-/// so this is traversal-safe. Falls back to the artifact id.
-fn blob_file_name(artifact: &Artifact) -> String {
-    Path::new(&artifact.source_ref)
-        .file_name()
-        .and_then(|n| n.to_str())
-        .map(str::to_string)
-        .filter(|s| !s.is_empty())
-        .unwrap_or_else(|| format!("artifact-{}", artifact.id))
-}
-
 /// An artifact with no on-disk form: record a single fact, no hash/path.
 fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
     IngestedArtifact {
@@ -365,52 +331,4 @@ mod tests {
         assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
         assert!(creds.auth_token.is_none());
     }
-
-    /// A single uploaded PLC file (not an archive) must land in a working dir
-    /// under its original name so the PLC scanner can discover it by extension
-    /// and report a readable path — the demo's upload → scan path.
-    #[test]
-    fn single_uploaded_plc_file_is_materialized_and_scannable() {
-        use compliance_core::models::PlcFormat;
-
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        // Simulate the upload handler: bytes written to an `uploads/` path,
-        // `source_ref` carrying the original (clean) file name.
-        let uploads = scratch.0.join("uploads");
-        std::fs::create_dir_all(&uploads).expect("mkdir uploads");
-        let uploaded = uploads.join("a1b2c3_pump_station.st");
-        std::fs::write(
-            &uploaded,
-            "PROGRAM P\nVAR\n  ApiKey : STRING := 'sk-live-1234';\nEND_VAR\nEND_PROGRAM\n",
-        )
-        .expect("write st");
-
-        let mut artifact = Artifact::plc_project("pump_station.st", PlcFormat::StructuredText);
-        artifact.stored_path = Some(uploaded.to_string_lossy().to_string());
-
-        let ctx = ctx_for(&store, "t-plc");
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-
-        // Working path is a directory (not the extensionless blob) holding the
-        // file under its original name.
-        let wp = out.working_path.expect("working path");
-        assert!(wp.is_dir(), "expected a working dir, got {wp:?}");
-        assert!(wp.join("pump_station.st").is_file());
-
-        // The PLC scanner finds the hardcoded credential and reports a clean path.
-        let findings = crate::pipeline::plc::analyze_tree(&wp, "t-plc");
-        assert!(
-            !findings.is_empty(),
-            "scanner should flag the uploaded file"
-        );
-        assert!(findings
-            .iter()
-            .any(|f| f.rule_id.as_deref() == Some("plc-hardcoded-credential")));
-        assert_eq!(
-            findings[0].file_path.as_deref(),
-            Some("pump_station.st"),
-            "finding should reference the original file name"
-        );
-    }
 }

compliance-agent/src/lib.rs

@@ -4,7 +4,6 @@ pub mod agent;
 pub mod api;
 pub mod classify;
 pub mod config;
-pub mod controls;
 pub mod database;
 pub mod error;
 pub mod ingest;
@@ -17,4 +16,3 @@ pub mod ssh;
 #[allow(dead_code)]
 pub mod trackers;
 pub mod webhooks;
-pub mod werkbank;

compliance-agent/src/pentest/cleanup.rs

@@ -342,9 +342,6 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
-            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-            werkbank_runner_token: None,
-            breakpilot: compliance_core::config::BreakpilotConfig::default(),
         }
     }
 

compliance-agent/src/pipeline/cve.rs

@@ -204,202 +204,6 @@ impl CveScanner {
 
         Ok(results)
     }
-
-    /// Match the CODESYS **runtime** component against NVD by CPE.
-    ///
-    /// CODESYS advisories (the CoDe16 cluster and friends) are indexed in NVD by
-    /// CPE (`cpe:2.3:a:codesys:control*`) keyed off the *runtime* version — not by
-    /// the internal `Cmp*`/`Sys*` library names OSV-by-purl would look up. So we
-    /// find the runtime SBOM entry, pull every `cpe:2.3:a:codesys:*` CVE from NVD,
-    /// and keep the ones whose affected-version range covers our runtime version.
-    /// Best-effort: returns empty without an NVD key, on a network error, or when
-    /// no CODESYS runtime component is present.
-    pub async fn scan_codesys(&self, repo_id: &str, entries: &mut [SbomEntry]) -> Vec<CveAlert> {
-        let Some((name, version)) = codesys_runtime(entries) else {
-            return Vec::new();
-        };
-        let url = "https://services.nvd.nist.gov/rest/json/cves/2.0\
-                   ?virtualMatchString=cpe:2.3:a:codesys";
-        let mut req = self.http.get(url);
-        if let Some(key) = &self.nvd_api_key {
-            req = req.header("apiKey", key.as_str());
-        }
-        let body: serde_json::Value = match req.send().await {
-            Ok(r) if r.status().is_success() => match r.json().await {
-                Ok(b) => b,
-                Err(e) => {
-                    tracing::warn!("CODESYS NVD parse failed: {e}");
-                    return Vec::new();
-                }
-            },
-            Ok(r) => {
-                tracing::warn!("CODESYS NVD returned {}", r.status());
-                return Vec::new();
-            }
-            Err(e) => {
-                tracing::warn!("CODESYS NVD request failed: {e}");
-                return Vec::new();
-            }
-        };
-
-        let matched = parse_codesys_nvd(&body, &version);
-        let mut alerts = Vec::new();
-        for cve in matched {
-            if let Some(e) = entries
-                .iter_mut()
-                .find(|e| e.name == name && e.version == version)
-            {
-                e.known_vulnerabilities.push(VulnRef {
-                    id: cve.id.clone(),
-                    source: "nvd".to_string(),
-                    severity: None,
-                    url: Some(format!("https://nvd.nist.gov/vuln/detail/{}", cve.id)),
-                });
-            }
-            let mut alert = CveAlert::new(
-                cve.id,
-                repo_id.to_string(),
-                name.clone(),
-                version.clone(),
-                CveSource::Nvd,
-            );
-            alert.summary = cve.summary;
-            alert.cvss_score = cve.cvss;
-            alerts.push(alert);
-        }
-        tracing::info!(runtime = %name, version = %version, cves = alerts.len(), "CODESYS CVE match");
-        alerts
-    }
-}
-
-/// The CODESYS runtime component (name + version) from an SBOM, if present. The
-/// runtime carries the version CODESYS advisories key off; the internal library
-/// components do not.
-fn codesys_runtime(entries: &[SbomEntry]) -> Option<(String, String)> {
-    entries
-        .iter()
-        .find(|e| e.package_manager == "codesys" && e.name.starts_with("CODESYS Control"))
-        .map(|e| (e.name.clone(), e.version.clone()))
-}
-
-/// A parsed NVD CVE that affects the CODESYS runtime.
-struct CodesysCve {
-    id: String,
-    summary: Option<String>,
-    cvss: Option<f64>,
-}
-
-/// Version constraints from an NVD `cpeMatch` node.
-#[derive(Default)]
-struct CpeRange {
-    exact: Option<String>,
-    start_incl: Option<String>,
-    start_excl: Option<String>,
-    end_incl: Option<String>,
-    end_excl: Option<String>,
-}
-
-/// Parse an NVD CVE-list response and keep the CVEs whose CODESYS CPE match covers
-/// `runtime_version`.
-fn parse_codesys_nvd(body: &serde_json::Value, runtime_version: &str) -> Vec<CodesysCve> {
-    let mut out = Vec::new();
-    let Some(vulns) = body["vulnerabilities"].as_array() else {
-        return out;
-    };
-    for v in vulns {
-        let cve = &v["cve"];
-        let Some(id) = cve["id"].as_str() else {
-            continue;
-        };
-        let covered = cve["configurations"]
-            .as_array()
-            .into_iter()
-            .flatten()
-            .flat_map(|c| c["nodes"].as_array().into_iter().flatten())
-            .flat_map(|n| n["cpeMatch"].as_array().into_iter().flatten())
-            .any(|cm| {
-                cm["vulnerable"].as_bool() == Some(true)
-                    && cm["criteria"]
-                        .as_str()
-                        .is_some_and(|c| c.contains(":codesys:"))
-                    && version_matches(runtime_version, &cpe_range(cm))
-            });
-        if covered {
-            let summary = cve["descriptions"]
-                .as_array()
-                .and_then(|d| d.iter().find(|x| x["lang"].as_str() == Some("en")))
-                .and_then(|x| x["value"].as_str())
-                .map(String::from);
-            let cvss = cve["metrics"]["cvssMetricV31"]
-                .as_array()
-                .and_then(|m| m.first())
-                .and_then(|m| m["cvssData"]["baseScore"].as_f64());
-            out.push(CodesysCve {
-                id: id.to_string(),
-                summary,
-                cvss,
-            });
-        }
-    }
-    out
-}
-
-/// Build a [`CpeRange`] from an NVD `cpeMatch` object.
-fn cpe_range(cm: &serde_json::Value) -> CpeRange {
-    let exact = cm["criteria"]
-        .as_str()
-        .and_then(cpe_version)
-        .filter(|v| v != "*" && v != "-" && !v.is_empty());
-    CpeRange {
-        exact,
-        start_incl: cm["versionStartIncluding"].as_str().map(String::from),
-        start_excl: cm["versionStartExcluding"].as_str().map(String::from),
-        end_incl: cm["versionEndIncluding"].as_str().map(String::from),
-        end_excl: cm["versionEndExcluding"].as_str().map(String::from),
-    }
-}
-
-/// The version field (6th component) of a CPE 2.3 string.
-fn cpe_version(criteria: &str) -> Option<String> {
-    criteria.split(':').nth(5).map(String::from)
-}
-
-/// Whether `v` satisfies a CPE version range.
-fn version_matches(v: &str, r: &CpeRange) -> bool {
-    use std::cmp::Ordering::{Equal, Greater, Less};
-    if let Some(exact) = &r.exact {
-        return cmp_dotted(v, exact) == Equal;
-    }
-    let mut ok = true;
-    if let Some(s) = &r.start_incl {
-        ok &= cmp_dotted(v, s) != Less;
-    }
-    if let Some(s) = &r.start_excl {
-        ok &= cmp_dotted(v, s) == Greater;
-    }
-    if let Some(e) = &r.end_incl {
-        ok &= cmp_dotted(v, e) != Greater;
-    }
-    if let Some(e) = &r.end_excl {
-        ok &= cmp_dotted(v, e) == Less;
-    }
-    ok
-}
-
-/// Compare two dotted numeric versions (`4.17.0.0` vs `4.9.0.0`); missing
-/// components count as 0, non-numeric components as 0.
-fn cmp_dotted(a: &str, b: &str) -> std::cmp::Ordering {
-    let pa: Vec<u64> = a.split('.').map(|x| x.parse().unwrap_or(0)).collect();
-    let pb: Vec<u64> = b.split('.').map(|x| x.parse().unwrap_or(0)).collect();
-    for i in 0..pa.len().max(pb.len()) {
-        let x = pa.get(i).copied().unwrap_or(0);
-        let y = pb.get(i).copied().unwrap_or(0);
-        match x.cmp(&y) {
-            std::cmp::Ordering::Equal => continue,
-            other => return other,
-        }
-    }
-    std::cmp::Ordering::Equal
 }
 
 #[derive(serde::Deserialize)]
@@ -424,90 +228,3 @@ struct OsvVuln {
     summary: Option<String>,
     severity: Option<String>,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::cmp::Ordering::{Equal, Greater, Less};
-
-    fn entry(name: &str, ver: &str, pm: &str) -> SbomEntry {
-        SbomEntry::new("t".into(), name.into(), ver.into(), pm.into())
-    }
-
-    #[test]
-    fn finds_the_codesys_runtime_component() {
-        let entries = vec![
-            entry("Standard", "3.5.18.0", "codesys"),
-            entry("CODESYS Control for Linux ARM SL", "4.17.0.0", "codesys"),
-        ];
-        assert_eq!(
-            codesys_runtime(&entries),
-            Some(("CODESYS Control for Linux ARM SL".into(), "4.17.0.0".into()))
-        );
-        // Internal library components are not the runtime.
-        assert!(codesys_runtime(&[entry("Util", "3.5.21.0", "codesys")]).is_none());
-    }
-
-    #[test]
-    fn dotted_version_comparison() {
-        assert_eq!(cmp_dotted("4.17.0.0", "4.9.0.0"), Greater);
-        assert_eq!(cmp_dotted("4.9.0.0", "4.17.0.0"), Less);
-        assert_eq!(cmp_dotted("3.5.18.0", "3.5.18.0"), Equal);
-        assert_eq!(cmp_dotted("4.2", "4.2.0.0"), Equal); // missing components = 0
-    }
-
-    #[test]
-    fn version_range_matching() {
-        let end_excl = CpeRange {
-            end_excl: Some("4.9.0.0".into()),
-            ..Default::default()
-        };
-        assert!(!version_matches("4.17.0.0", &end_excl)); // patched
-        assert!(version_matches("4.5.0.0", &end_excl)); // affected
-
-        let exact = CpeRange {
-            exact: Some("3.5.16.0".into()),
-            ..Default::default()
-        };
-        assert!(version_matches("3.5.16.0", &exact));
-        assert!(!version_matches("3.5.17.0", &exact));
-
-        let span = CpeRange {
-            start_incl: Some("3.0.0.0".into()),
-            end_incl: Some("3.5.16.0".into()),
-            ..Default::default()
-        };
-        assert!(version_matches("3.5.16.0", &span));
-        assert!(!version_matches("3.5.17.0", &span));
-    }
-
-    #[test]
-    fn parses_nvd_and_matches_by_runtime_version() {
-        // Two CODESYS CVEs: one affects < 4.9 (our 4.17 is patched), one affects
-        // <= 4.20 (our 4.17 is affected). Only the latter should match.
-        let body = serde_json::json!({
-          "vulnerabilities": [
-            {"cve": {"id":"CVE-2023-0001",
-              "descriptions":[{"lang":"en","value":"old CmpBlkDrvTcp bug"}],
-              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":7.5}}]},
-              "configurations":[{"nodes":[{"cpeMatch":[
-                {"vulnerable":true,
-                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
-                 "versionEndExcluding":"4.9.0.0"}
-              ]}]}]}},
-            {"cve": {"id":"CVE-2024-0002",
-              "descriptions":[{"lang":"en","value":"recent runtime bug"}],
-              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":9.8}}]},
-              "configurations":[{"nodes":[{"cpeMatch":[
-                {"vulnerable":true,
-                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
-                 "versionEndIncluding":"4.20.0.0"}
-              ]}]}]}}
-          ]
-        });
-        let matched = parse_codesys_nvd(&body, "4.17.0.0");
-        let ids: Vec<&str> = matched.iter().map(|c| c.id.as_str()).collect();
-        assert_eq!(ids, vec!["CVE-2024-0002"]);
-        assert_eq!(matched[0].cvss, Some(9.8));
-    }
-}

compliance-agent/src/pipeline/orchestrator.rs

@@ -215,68 +215,6 @@ impl PipelineOrchestrator {
         .await;
         tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
 
-        // Stage 5b: control triage — stamp findings with the compliance control(s)
-        // they're evidence for and flag control false positives (grounded LLM over
-        // deterministic tool output). No-op unless breakpilot is configured.
-        self.update_phase(scan_run_id, "control_triage").await;
-        let tagged = crate::controls::triage_repo_findings(
-            &self.config,
-            self.llm.clone(),
-            &repo_path,
-            &mut all_findings,
-        )
-        .await;
-        if tagged > 0 {
-            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
-        }
-
-        // Stage 5c: semantic control mapping — scale path for the master-controls
-        // corpus (no CWE to LUT on): embed each finding's region, retrieve the
-        // nearest master controls, grounded-judge, and stamp confirmed refs. Gated
-        // (default off) as the corpus embedding + per-finding judging is the heavy
-        // path; enabled once verified live against a deployed master-controls catalog.
-        if self.config.breakpilot.semantic_mapping {
-            self.update_phase(scan_run_id, "semantic_control_mapping")
-                .await;
-            let sem = crate::controls::semantic_stamp_findings(
-                &self.config,
-                self.llm.clone(),
-                &repo_path,
-                &mut all_findings,
-            )
-            .await;
-            if sem > 0 {
-                tracing::info!(
-                    "[{repo_id}] Semantic mapping tagged {sem} findings with master-control refs"
-                );
-            }
-        }
-
-        // Stage 5d: grounded surface checks — the absence-based controls (no
-        // rate limiting, no security logging, no update-signature check) have no
-        // syntactic pattern to match, so we retrieve the code surface each governs
-        // and let the grounded judge decide whether it holds, producing net-new
-        // findings already tagged + grounded. Gated (default off): absence
-        // detection is the least deterministic path, kept off until tuned live.
-        if self.config.breakpilot.grounded_control_checks {
-            self.update_phase(scan_run_id, "grounded_control_checks")
-                .await;
-            let grounded = crate::controls::grounded_surface_findings(
-                &self.config,
-                self.llm.clone(),
-                &repo_path,
-                &repo_id,
-            )
-            .await;
-            if !grounded.is_empty() {
-                tracing::info!(
-                    "[{repo_id}] Grounded surface checks raised {} control findings",
-                    grounded.len()
-                );
-                all_findings.extend(grounded);
-            }
-        }
-
         // Dedup against existing findings and insert new ones
         let mut new_count = 0u32;
         let mut new_findings: Vec<Finding> = Vec::new();
@@ -321,12 +259,67 @@ impl PipelineOrchestrator {
                 .await?;
         }
 
-        // Persist CVE alerts and create notifications (shared with the PLC path).
+        // Persist CVE alerts and create notifications
-        let new_notif_count = self
+        {
-            .persist_cve_alerts(&repo_id, &repo.name, &cve_alerts)
+            use compliance_core::models::notification::{parse_severity, CveNotification};
-            .await?;
+
-        if new_notif_count > 0 {
+            let repo_name = repo.name.clone();
-            tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
+            let mut new_notif_count = 0u32;
+
+            for alert in &cve_alerts {
+                // Upsert the alert
+                let filter = doc! {
+                    "cve_id": &alert.cve_id,
+                    "repo_id": &alert.repo_id,
+                };
+                let update = mongodb::bson::to_document(alert)
+                    .map(|d| doc! { "$set": d })
+                    .unwrap_or_else(|_| doc! {});
+                self.db
+                    .cve_alerts()
+                    .update_one(filter, update)
+                    .upsert(true)
+                    .await?;
+
+                // Create notification (dedup by cve_id + repo + package + version)
+                let notif_filter = doc! {
+                    "cve_id": &alert.cve_id,
+                    "repo_id": &alert.repo_id,
+                    "package_name": &alert.affected_package,
+                    "package_version": &alert.affected_version,
+                };
+                let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
+                let mut notification = CveNotification::new(
+                    alert.cve_id.clone(),
+                    repo_id.clone(),
+                    repo_name.clone(),
+                    alert.affected_package.clone(),
+                    alert.affected_version.clone(),
+                    severity,
+                );
+                notification.cvss_score = alert.cvss_score;
+                notification.summary = alert.summary.clone();
+                notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
+
+                let notif_update = doc! {
+                    "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
+                };
+                if let Ok(result) = self
+                    .db
+                    .cve_notifications()
+                    .update_one(notif_filter, notif_update)
+                    .upsert(true)
+                    .await
+                {
+                    if result.upserted_id.is_some() {
+                        new_notif_count += 1;
+                    }
+                }
+            }
+
+            if new_notif_count > 0 {
+                tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
+            }
         }
 
         // Stage 6: Issue Creation
@@ -456,77 +449,38 @@ impl PipelineOrchestrator {
         // wizard-created targets, not just migrated ones.
         self.ensure_dast_target(target, &plan).await;
 
-        // PLC/SPS targets: the control-logic scan consumes the PLC source (an
+        // PLC control-logic analysis for PLC/SPS targets (a PlcProject artifact).
-        // uploaded PlcProject *or* a git repo / source archive of PLCopen XML / ST
+        if plan.has(ScanType::PlcControlLogic) {
-        // exports), so it takes over the code artifact — we don't also run the
+            return self.run_plc_scan(target, &target_id, scan_run_id).await;
-        // SAST pipeline over it. A PLC device is reachable, so DAST still runs
-        // against a WebVisu / exposed endpoint when one is provisioned.
-        let mut new_count = 0u32;
-        let plc = plan.has(ScanType::PlcControlLogic);
-        let ics = plan.has(ScanType::IcsProbe);
-        if plc {
-            new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
-            // Provision-and-test (#183): with the control logic but no reachable
-            // device, instantiate it on an ephemeral soft-PLC and probe that
-            // instead of the customer's OT network. Opt-in (needs Docker) and only
-            // when there is no live URL to probe directly. Never fails the scan.
-            if self.config.plc_runtime.enabled && target.live_url().is_none() {
-                match self
-                    .run_provisioned_plc_test(target, &target_id, scan_run_id)
-                    .await
-                {
-                    Ok(n) => new_count += n,
-                    Err(e) => {
-                        tracing::warn!(target_id = %target_id, error = %e, "provision-and-test failed")
-                    }
-                }
-            }
-        }
-        if ics {
-            new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
-        }
-        if plc || ics {
-            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint, but
-            // only when DAST is actually planned — a device reachable only over an
-            // industrial protocol (e.g. modbus://) has no web surface to crawl, and
-            // running DAST there just fails at reconnaissance. Gating here (not only
-            // at provisioning) also stops a DAST target left over from an earlier
-            // run from re-triggering. The control-logic scan already consumed the
-            // code artifact, so the SAST pipeline is not re-run.
-            if plan.has(ScanType::Dast) {
-                self.update_phase(scan_run_id, "dast_scanning").await;
-                self.maybe_trigger_dast(&target_id, scan_run_id).await;
-            }
-            return Ok(new_count);
         }
 
         match target.code_artifact() {
             Some(code) if code.kind == ArtifactKind::GitRepo => {
                 let repo = RepoView::from_target(target, code);
-                let n = self.run_pipeline(&repo, scan_run_id).await?;
+                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
-                self.finalize_target(target, &repo, n).await?;
+                self.finalize_target(target, &repo, new_count).await?;
-                new_count += n;
+                Ok(new_count)
             }
             Some(_) => {
                 tracing::warn!(
                     target_id = %target_id,
                     "Unified pipeline: source-archive scanning not yet wired; skipping"
                 );
+                Ok(0)
             }
             None => {
-                // No code to scan (a migrated DAST target). Firmware/mobile static
+                // No code to scan. Firmware/PLC/mobile static scanners land in
-                // scanners land in #128/#129; DAST for a running URL works when a
+                // #128/#129/#130; DAST for a running URL still works when a
-                // DastTarget row exists (provisioned above from a LiveUrl, or from
+                // DastTarget row exists (migrated targets).
-                // a migrated target).
                 tracing::info!(
                     target_id = %target_id,
-                    "Unified pipeline: no code artifact; attempting DAST"
+                    "Unified pipeline: no code artifact; attempting DAST only"
                 );
                 self.update_phase(scan_run_id, "dast_scanning").await;
                 self.maybe_trigger_dast(&target_id, scan_run_id).await;
+                Ok(0)
             }
         }
-        Ok(new_count)
     }
 
     /// Analyze a PLC/SPS project (Structured Text / PLCopen XML) for
@@ -542,195 +496,22 @@ impl PipelineOrchestrator {
 
         let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
         let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
-        // Every PLC-source artifact on the target: dedicated PLC projects plus any
+        let path = target
-        // code artifacts (git repo / source archive) holding PLCopen XML / ST
+            .first_of(ArtifactKind::PlcProject)
-        // exports. A target can carry several (e.g. one POU export per file).
+            .and_then(|a| ingest_set.get(&a.id))
-        let sources: Vec<&Artifact> = target
+            .and_then(|ia| ia.working_path.clone());
-            .artifacts
+        let Some(path) = path else {
-            .iter()
+            tracing::warn!(target_id, "PLC scan: no ingested PLC project path");
-            .filter(|a| {
-                matches!(
-                    a.kind,
-                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-                )
-            })
-            .collect();
-        if sources.is_empty() {
-            tracing::warn!(target_id, "PLC scan: no PLC source artifact");
             return Ok(0);
-        }
+        };
 
-        let mut all_findings = Vec::new();
+        let findings = crate::pipeline::plc::analyze_tree(&path, target_id);
-        let mut all_sbom: Vec<SbomEntry> = Vec::new();
-        let mut sbom_seen = std::collections::BTreeSet::new();
-        for a in &sources {
-            let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
-                continue;
-            };
-            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
-            // Control-application SBOM: CODESYS libraries + runtime from a
-            // `.projectarchive` (uploaded, or committed in the working tree).
-            let archive = a
-                .stored_path
-                .clone()
-                .unwrap_or_else(|| a.source_ref.clone());
-            for e in crate::pipeline::plc::sbom::collect_sbom(
-                std::path::Path::new(&archive),
-                &path,
-                target_id,
-            ) {
-                if sbom_seen.insert((e.name.clone(), e.version.clone())) {
-                    all_sbom.push(e);
-                }
-            }
-        }
         tracing::info!(
             target_id,
-            artifacts = sources.len(),
+            found = findings.len(),
-            found = all_findings.len(),
             "PLC control-logic analysis complete"
         );
 
-        let mut new_count = 0u32;
-        for mut finding in all_findings {
-            finding.scan_run_id = Some(scan_run_id.to_string());
-            if self
-                .db
-                .findings()
-                .find_one(doc! { "fingerprint": &finding.fingerprint })
-                .await?
-                .is_none()
-            {
-                self.db.findings().insert_one(&finding).await?;
-                new_count += 1;
-            }
-        }
-
-        if !all_sbom.is_empty() {
-            if let Err(e) = self
-                .persist_control_app_sbom(target_id, &target.name, all_sbom)
-                .await
-            {
-                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
-            }
-        }
-        Ok(new_count)
-    }
-
-    /// Provision-and-test (#183): instantiate the target's control logic on an
-    /// ephemeral soft-PLC (OpenPLC), start it, probe the provisioned Modbus
-    /// endpoint, and tear the instance down. Used when a PLC/SPS target has the
-    /// control logic but no reachable live device to probe directly. Guarded by
-    /// `plc_runtime.enabled` (needs Docker); persists the same [`ScanType::IcsProbe`]
-    /// findings as a live probe.
-    async fn run_provisioned_plc_test(
-        &self,
-        target: &OnboardedTarget,
-        target_id: &str,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
-        self.update_phase(scan_run_id, "plc_provision").await;
-
-        // Locate a loadable control-logic program among the PLC-source artifacts
-        // (same selection as the static PLC scan: dedicated PLC projects plus code
-        // artifacts holding PLCopen XML / ST exports).
-        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
-        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
-        let program = target
-            .artifacts
-            .iter()
-            .filter(|a| {
-                matches!(
-                    a.kind,
-                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-                )
-            })
-            .find_map(|a| {
-                let path = ingest_set
-                    .get(&a.id)
-                    .and_then(|ia| ia.working_path.clone())?;
-                werkbank_exec::plc::extract_program(&path)
-            });
-        let Some(program) = program else {
-            tracing::info!(
-                target_id,
-                "provision-and-test: no loadable control-logic program"
-            );
-            return Ok(0);
-        };
-
-        let http = werkbank_exec::plc::http_client()?;
-        let provisioner = werkbank_exec::plc::DockerSoftPlc::new(self.config.plc_runtime.clone());
-        let outcome = werkbank_exec::plc::provision_and_test(
-            &provisioner,
-            &http,
-            &self.config.plc_runtime,
-            &program,
-            target_id,
-        )
-        .await?;
-        tracing::info!(
-            target_id,
-            found = outcome.findings.len(),
-            dast = outcome.dast.is_some(),
-            "provision-and-test complete"
-        );
-
-        let mut new_count = 0u32;
-        for mut finding in outcome.findings {
-            finding.scan_run_id = Some(scan_run_id.to_string());
-            if self
-                .db
-                .findings()
-                .find_one(doc! { "fingerprint": &finding.fingerprint })
-                .await?
-                .is_none()
-            {
-                self.db.findings().insert_one(&finding).await?;
-                new_count += 1;
-            }
-        }
-
-        // Persist the DAST scan of the provisioned web endpoint, linked to this
-        // scan run (mirrors `maybe_trigger_dast`).
-        if let Some(dast) = outcome.dast {
-            let mut scan_run = dast.scan_run;
-            scan_run.sast_scan_run_id = Some(scan_run_id.to_string());
-            if let Err(e) = self.db.dast_scan_runs().insert_one(&scan_run).await {
-                tracing::warn!(target_id, error = %e, "failed to store provisioned DAST scan run");
-            }
-            for finding in &dast.findings {
-                if let Err(e) = self.db.dast_findings().insert_one(finding).await {
-                    tracing::warn!(target_id, error = %e, "failed to store provisioned DAST finding");
-                }
-            }
-        }
-        Ok(new_count)
-    }
-
-    /// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
-    /// and persist findings for exposed / unauthenticated control access. The
-    /// probe is read-only; it targets the Modbus port of the target's live URL.
-    async fn run_ics_probe(
-        &self,
-        target: &OnboardedTarget,
-        target_id: &str,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
-        self.update_phase(scan_run_id, "ics_probe").await;
-        let Some(endpoint) = target.live_url().map(|a| a.source_ref.clone()) else {
-            tracing::warn!(target_id, "ICS probe: no live URL");
-            return Ok(0);
-        };
-        // Short per-request budget so an unreachable device doesn't stall the scan.
-        let budget = std::time::Duration::from_secs(5);
-        let findings = werkbank_exec::ics::probe_target(&endpoint, target_id, budget).await;
-        tracing::info!(
-            target_id,
-            endpoint = %endpoint,
-            found = findings.len(),
-            "ICS probe complete"
-        );
         let mut new_count = 0u32;
         for mut finding in findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
@@ -748,150 +529,6 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
-    /// Store a control-application SBOM (CODESYS libraries + runtime) for a target
-    /// and match it against known CVEs. Scoped to `package_manager = "codesys"` so
-    /// it refreshes on re-scan and coexists with any firmware/source SBOM. The
-    /// runtime `Cmp*` / `3SLicense` components carry real CODESYS advisories, so
-    /// this is where PLC-device CVE coverage comes from.
-    async fn persist_control_app_sbom(
-        &self,
-        target_id: &str,
-        target_name: &str,
-        mut entries: Vec<SbomEntry>,
-    ) -> Result<(), AgentError> {
-        if entries.is_empty() {
-            return Ok(());
-        }
-        self.db
-            .sbom_entries()
-            .delete_many(doc! { "repo_id": target_id, "package_manager": "codesys" })
-            .await?;
-
-        let cve_scanner = CveScanner::new(
-            self.http.clone(),
-            self.config.searxng_url.clone(),
-            self.config.nvd_api_key.as_ref().map(|k| {
-                use secrecy::ExposeSecret;
-                k.expose_secret().to_string()
-            }),
-        );
-        let mut alerts = match tokio::time::timeout(
-            std::time::Duration::from_secs(600),
-            cve_scanner.scan_dependencies(target_id, &mut entries),
-        )
-        .await
-        {
-            Ok(Ok(a)) => a,
-            Ok(Err(e)) => {
-                tracing::warn!(target_id, error = %e, "control-app CVE scan failed");
-                Vec::new()
-            }
-            Err(_) => {
-                tracing::warn!(target_id, "control-app CVE scan timed out");
-                Vec::new()
-            }
-        };
-        // OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
-        // live in NVD keyed by CPE + runtime version. Add those (best-effort).
-        if let Ok(codesys) = tokio::time::timeout(
-            std::time::Duration::from_secs(120),
-            cve_scanner.scan_codesys(target_id, &mut entries),
-        )
-        .await
-        {
-            alerts.extend(codesys);
-        } else {
-            tracing::warn!(target_id, "CODESYS CVE match timed out");
-        }
-
-        for entry in &entries {
-            let filter = doc! {
-                "repo_id": &entry.repo_id,
-                "name": &entry.name,
-                "version": &entry.version,
-            };
-            if let Ok(d) = mongodb::bson::to_document(entry) {
-                self.db
-                    .sbom_entries()
-                    .update_one(filter, doc! { "$set": d })
-                    .upsert(true)
-                    .await?;
-            }
-        }
-        let new_notifs = self
-            .persist_cve_alerts(target_id, target_name, &alerts)
-            .await?;
-        tracing::info!(
-            target_id,
-            components = entries.len(),
-            alerts = alerts.len(),
-            notifications = new_notifs,
-            "control-app SBOM stored"
-        );
-        Ok(())
-    }
-
-    /// Upsert CVE alerts for a target and create dedup'd CVE notifications;
-    /// returns the number of newly-created notifications. Shared by the SAST
-    /// pipeline and the PLC control-app SBOM path, so every SBOM source (source,
-    /// firmware, CODESYS libraries/runtime) raises the same notifications.
-    async fn persist_cve_alerts(
-        &self,
-        repo_id: &str,
-        repo_name: &str,
-        alerts: &[CveAlert],
-    ) -> Result<u32, AgentError> {
-        use compliance_core::models::notification::{parse_severity, CveNotification};
-
-        let mut new_notif = 0u32;
-        for alert in alerts {
-            let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
-            let update = mongodb::bson::to_document(alert)
-                .map(|d| doc! { "$set": d })
-                .unwrap_or_else(|_| doc! {});
-            self.db
-                .cve_alerts()
-                .update_one(filter, update)
-                .upsert(true)
-                .await?;
-
-            // Dedup notifications by cve + repo + package + version.
-            let notif_filter = doc! {
-                "cve_id": &alert.cve_id,
-                "repo_id": &alert.repo_id,
-                "package_name": &alert.affected_package,
-                "package_version": &alert.affected_version,
-            };
-            let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
-            let mut notification = CveNotification::new(
-                alert.cve_id.clone(),
-                repo_id.to_string(),
-                repo_name.to_string(),
-                alert.affected_package.clone(),
-                alert.affected_version.clone(),
-                severity,
-            );
-            notification.cvss_score = alert.cvss_score;
-            notification.summary = alert.summary.clone();
-            notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
-            let notif_update = doc! {
-                "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
-            };
-            if let Ok(result) = self
-                .db
-                .cve_notifications()
-                .update_one(notif_filter, notif_update)
-                .upsert(true)
-                .await
-            {
-                if result.upserted_id.is_some() {
-                    new_notif += 1;
-                }
-            }
-        }
-        Ok(new_notif)
-    }
-
     /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
     /// heuristics otherwise), and store the detected classification on the target.
     /// Best-effort — never fails the scan.

compliance-agent/src/pipeline/plan.rs

@@ -75,16 +75,10 @@ pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
 }
 
 /// Resolve the artifact a scan consumes. A "code" requirement (represented by
-/// `GitRepo`) is satisfied by a git repo *or* a source archive. The PLC
+/// `GitRepo`) is satisfied by a git repo *or* a source archive.
-/// control-logic requirement (represented by `PlcProject`) prefers an uploaded
-/// PLC project but also accepts a code artifact — a git repo / source archive
-/// holding PLCopen XML / ST exports.
 fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
     match required {
         Some(ArtifactKind::GitRepo) => target.code_artifact(),
-        Some(ArtifactKind::PlcProject) => target
-            .first_of(ArtifactKind::PlcProject)
-            .or_else(|| target.code_artifact()),
         Some(kind) => target.first_of(kind),
         None => target.code_artifact().or_else(|| target.artifacts.first()),
     }
@@ -106,7 +100,6 @@ fn phase_for(scan: ScanType) -> ScanPhase {
         ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
         ScanType::MobileStatic => ScanPhase::MobileStatic,
         ScanType::ContainerScan => ScanPhase::ContainerScan,
-        ScanType::IcsProbe => ScanPhase::IcsProbe,
     }
 }
 
@@ -181,18 +174,6 @@ mod tests {
         assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
     }
 
-    #[test]
-    fn plc_control_logic_binds_to_a_git_repo() {
-        // A CODESYS project in git (PLCopen XML / ST exports) with no uploaded
-        // PlcProject: control-logic still plans, bound to the git artifact.
-        let git = Artifact::git_repo("https://git/plc", "main");
-        let git_id = git.id.clone();
-        let t = target(TargetType::PlcSps, vec![git]);
-        let plan = build_scan_plan(&t);
-        let step = step_for(&plan, ScanType::PlcControlLogic).expect("control-logic planned");
-        assert_eq!(step.artifact_id, git_id, "PLC scan binds to the git repo");
-    }
-
     #[test]
     fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
         let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);

compliance-agent/src/pipeline/plc/mod.rs

@@ -9,7 +9,6 @@ pub mod lexer;
 pub mod parser;
 pub mod plcopen;
 pub mod rules;
-pub mod sbom;
 
 use std::path::Path;
 
@@ -198,37 +197,4 @@ mod tests {
             "the CASE state machine uses no JMP"
         );
     }
-
-    /// Graphical logic must be analysed too: an FBD POU (blocks + in/out
-    /// variables) is translated to synthetic ST, so the same rules fire on the
-    /// cleartext Modbus block, the hardcoded HMI password and the safety write.
-    #[test]
-    fn fbd_graphical_body_is_analysed() {
-        let all = analyze_tree(&demo_dir(), "demo-target");
-        let fbd: Vec<_> = all
-            .iter()
-            .filter(|f| {
-                f.file_path
-                    .as_deref()
-                    .is_some_and(|p| p.ends_with("pump_fbd.xml"))
-            })
-            .collect();
-        assert!(
-            !fbd.is_empty(),
-            "pump_fbd.xml (FBD) should produce findings"
-        );
-
-        let rules: HashSet<&str> = fbd.iter().filter_map(|f| f.rule_id.as_deref()).collect();
-        for r in [
-            "plc-insecure-comm",          // Modbus_TCP_Master(AUTH := FALSE)
-            "plc-insecure-protocol-port", // PORT := 502
-            "plc-hardcoded-credential",   // HmiPassword := 'admin123'
-            "plc-safety-bypass",          // Safety_Enable := FALSE
-        ] {
-            assert!(
-                rules.contains(r),
-                "expected rule {r} from FBD; got {rules:?}"
-            );
-        }
-    }
 }

compliance-agent/src/pipeline/plc/plcopen.rs

@@ -1,30 +1,17 @@
 //! PLCopen XML → Structured Text POUs.
 //!
 //! A PLCopen project stores each POU as `<pou name=".." pouType="..">` with an
-//! `<interface>` (typed variable sections) and a `<body>` in one of the IEC
+//! `<interface>` (typed variable sections) and a `<body>`. We handle the
-//! 61131-3 languages. We reconstruct an equivalent Structured-Text source for
+//! Structured-Text body form (`<ST>…</ST>`); FBD/LD/SFC bodies are skipped.
-//! each POU (a `VAR` block from the interface + statements from the body) and run
-//! it through the ST parser, so raw `.st` files and PLCopen projects — textual or
-//! graphical — flow through one analysis path.
 //!
-//! Body languages:
+//! For each ST POU we reconstruct an equivalent ST source (a `VAR` block built
-//! - **ST** — taken verbatim.
+//! from the interface + the ST body) and run it through the ST parser, so both
-//! - **FBD / LD** — the graphical network is translated to synthetic ST: blocks
+//! raw `.st` files and PLCopen projects flow through one analysis path.
-//!   become calls (`TypeName(pin := arg, …)`), out-variables / coils become
-//!   assignments, with input pins resolved by tracing connections. This lets the
-//!   semantic rules see comm calls, hardcoded arguments and safety writes that
-//!   live in graphical logic, not just in text.
-//! - **SFC** — the step/transition graph itself is skipped; the ST/FBD/LD bodies
-//!   embedded in its actions and transitions are still translated.
-
-use std::collections::HashMap;
-
-use roxmltree::Node;
 
 use super::ast::Pou;
 use super::parser;
 
-/// Parse every POU out of a PLCopen XML document (ST, FBD or LD bodies).
+/// Parse every Structured-Text POU out of a PLCopen XML document.
 pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
     let doc = match roxmltree::Document::parse(xml) {
         Ok(d) => d,
@@ -35,9 +22,14 @@ pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
         let name = pou.attribute("name").unwrap_or("pou").to_string();
         let pou_type = pou.attribute("pouType").unwrap_or("program");
 
-        let Some(body) = reconstruct_body(pou) else {
+        // ST body text (skip non-ST bodies).
+        let Some(st_node) = pou
+            .descendants()
+            .find(|n| n.has_tag_name("ST") && n.ancestors().any(|a| a.has_tag_name("body")))
+        else {
             continue;
         };
+        let body = collect_text(st_node);
         if body.trim().is_empty() {
             continue;
         }
@@ -54,195 +46,17 @@ pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
     pous
 }
 
-/// Case-insensitive tag match (PLCopen uses `FBD`/`LD`/`ST`, CODESYS may vary).
+/// Concatenate all descendant text of a node (ST bodies are often wrapped in
-fn tag_is(n: &Node, name: &str) -> bool {
+/// `<xhtml>` and may contain multiple text runs).
-    n.tag_name().name().eq_ignore_ascii_case(name)
+fn collect_text(node: roxmltree::Node) -> String {
-}
-
-/// Reconstruct a POU's body as Structured Text, whatever language it is written
-/// in. Concatenates every language body found under `<body>` (SFC actions and
-/// transitions carry their own ST/FBD/LD sub-bodies).
-fn reconstruct_body(pou: Node) -> Option<String> {
-    let mut out = String::new();
-    for body in pou.descendants().filter(|n| tag_is(n, "body")) {
-        for lang in body.children().filter(|n| n.is_element()) {
-            let piece = match lang.tag_name().name().to_ascii_uppercase().as_str() {
-                "ST" | "IL" => collect_text(lang),
-                "FBD" | "LD" => translate_network(lang),
-                _ => continue,
-            };
-            if !piece.trim().is_empty() {
-                out.push_str(&piece);
-                if !piece.ends_with('\n') {
-                    out.push('\n');
-                }
-            }
-        }
-    }
-    if out.trim().is_empty() {
-        None
-    } else {
-        Some(out)
-    }
-}
-
-// ── graphical (FBD / LD) → synthetic ST ────────────────────────────────
-
-/// Translate one FBD/LD network into ST statements: blocks → calls,
-/// out-variables and coils → assignments.
-fn translate_network(net: Node) -> String {
-    let by_id = index_local_ids(net);
-    let mut out = String::new();
-    for el in net.children().filter(|n| n.is_element()) {
-        let stmt = match el.tag_name().name().to_ascii_lowercase().as_str() {
-            "block" => block_call(el, &by_id).map(|c| format!("{c};")),
-            "outvariable" => out_assignment(el, &by_id),
-            "coil" => coil_assignment(el, &by_id),
-            _ => None,
-        };
-        if let Some(s) = stmt {
-            out.push_str(&s);
-            out.push('\n');
-        }
-    }
-    out
-}
-
-/// Index every element in a network by its `localId` so connections resolve.
-fn index_local_ids<'a, 'input>(net: Node<'a, 'input>) -> HashMap<String, Node<'a, 'input>> {
-    net.descendants()
-        .filter(|n| n.is_element())
-        .filter_map(|n| n.attribute("localId").map(|id| (id.to_string(), n)))
-        .collect()
-}
-
-/// Build a call expression for a block: `TypeName(pin := arg, …)`.
-fn block_call(block: Node, by_id: &HashMap<String, Node>) -> Option<String> {
-    let ty = block.attribute("typeName")?;
-    let mut args = Vec::new();
-    if let Some(inputs) = block.children().find(|n| tag_is(n, "inputVariables")) {
-        for v in inputs.children().filter(|n| tag_is(n, "variable")) {
-            let Some(expr) = input_expr(v, by_id, 0) else {
-                continue;
-            };
-            match v.attribute("formalParameter") {
-                Some(pin) if !pin.is_empty() => args.push(format!("{pin} := {expr}")),
-                _ => args.push(expr),
-            }
-        }
-    }
-    Some(format!("{ty}({})", args.join(", ")))
-}
-
-/// `target := <traced expression>;` for an FBD out-variable.
-fn out_assignment(outvar: Node, by_id: &HashMap<String, Node>) -> Option<String> {
-    let target = expression_text(outvar)?;
-    let value = input_expr(outvar, by_id, 0).unwrap_or_else(|| "0".to_string());
-    Some(format!("{target} := {value};"))
-}
-
-/// `coil := <traced rung expression>;` for an LD coil (negated → `NOT (…)`).
-fn coil_assignment(coil: Node, by_id: &HashMap<String, Node>) -> Option<String> {
-    let target = child_text(coil, "variable")?;
-    let rung = input_expr(coil, by_id, 0).unwrap_or_else(|| "TRUE".to_string());
-    let negated = matches!(coil.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
-    let rhs = if negated {
-        format!("NOT ({rung})")
-    } else {
-        rung
-    };
-    Some(format!("{target} := {rhs};"))
-}
-
-/// Resolve the expression feeding `node`'s single input connection.
-fn input_expr(node: Node, by_id: &HashMap<String, Node>, depth: u8) -> Option<String> {
-    let refid = ref_local_id(node)?;
-    Some(expr_for(&refid, by_id, depth))
-}
-
-/// Build the ST expression produced by the element with this `localId`.
-fn expr_for(local_id: &str, by_id: &HashMap<String, Node>, depth: u8) -> String {
-    if depth > 24 {
-        return "0".to_string();
-    }
-    let Some(node) = by_id.get(local_id) else {
-        return format!("__net{local_id}");
-    };
-    match node.tag_name().name().to_ascii_lowercase().as_str() {
-        "invariable" | "inoutvariable" => {
-            expression_text(*node).unwrap_or_else(|| format!("__net{local_id}"))
-        }
-        // A block feeding another element: reference it by a synthetic result
-        // name; the block is emitted as its own call statement, so we neither
-        // duplicate the call nor lose it.
-        "block" => format!("__blk{local_id}"),
-        "contact" => {
-            let var = child_text(*node, "variable").unwrap_or_else(|| "TRUE".to_string());
-            let negated =
-                matches!(node.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
-            let term = if negated { format!("NOT {var}") } else { var };
-            match ref_local_id(*node) {
-                Some(up) => {
-                    let upstream = expr_for(&up, by_id, depth + 1);
-                    if upstream == "TRUE" {
-                        term
-                    } else {
-                        format!("({upstream} AND {term})")
-                    }
-                }
-                None => term,
-            }
-        }
-        "leftpowerrail" => "TRUE".to_string(),
-        _ => format!("__net{local_id}"),
-    }
-}
-
-/// The `refLocalId` of `node`'s first input connection, if any.
-fn ref_local_id(node: Node) -> Option<String> {
     node.descendants()
-        .find(|n| tag_is(n, "connectionPointIn"))
-        .and_then(|cpi| cpi.descendants().find(|n| tag_is(n, "connection")))
-        .and_then(|c| c.attribute("refLocalId"))
-        .map(|s| s.to_string())
-}
-
-/// Text of a node's `<expression>` child (variable name or literal).
-fn expression_text(node: Node) -> Option<String> {
-    let e = node.children().find(|n| tag_is(n, "expression"))?;
-    let t = collect_text(e).trim().to_string();
-    if t.is_empty() {
-        None
-    } else {
-        Some(t)
-    }
-}
-
-/// Text of a named child element (e.g. `<variable>` of a contact/coil).
-fn child_text(node: Node, name: &str) -> Option<String> {
-    let c = node.children().find(|n| tag_is(n, name))?;
-    let t = collect_text(c).trim().to_string();
-    if t.is_empty() {
-        None
-    } else {
-        Some(t)
-    }
-}
-
-/// Concatenate the text of a node's descendant text nodes (bodies are often
-/// wrapped in `<xhtml>` and may contain multiple text runs). Only text nodes are
-/// gathered: an element's `.text()` would re-yield its first child's text, which
-/// (with the text node itself) would duplicate every value.
-fn collect_text(node: Node) -> String {
-    node.descendants()
-        .filter(|n| n.is_text())
         .filter_map(|n| n.text())
         .collect::<String>()
 }
 
 /// Build an ST `VAR … END_VAR` block from a POU's `<interface>` variable
 /// sections, so declarations (types, initial values) reach the rules.
-fn build_var_block(pou: Node) -> String {
+fn build_var_block(pou: roxmltree::Node) -> String {
     let Some(interface) = pou.children().find(|n| n.has_tag_name("interface")) else {
         return String::new();
     };
@@ -282,7 +96,7 @@ fn build_var_block(pou: Node) -> String {
 }
 
 /// Render a PLCopen `<type>` element as an ST type string.
-fn type_name(type_node: Node) -> String {
+fn type_name(type_node: roxmltree::Node) -> String {
     let Some(inner) = type_node.children().find(|n| n.is_element()) else {
         return "BOOL".to_string();
     };
@@ -313,7 +127,7 @@ fn type_name(type_node: Node) -> String {
 }
 
 /// Extract an initial value as an ST literal (quoting strings).
-fn initial_value(iv: Node) -> Option<String> {
+fn initial_value(iv: roxmltree::Node) -> Option<String> {
     let simple = iv.descendants().find(|n| n.has_tag_name("simpleValue"))?;
     let raw = simple.attribute("value")?.trim().to_string();
     if raw.is_empty() {
@@ -333,86 +147,3 @@ fn initial_value(iv: Node) -> Option<String> {
         Some(format!("'{}'", raw.replace('\'', "''")))
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::parse_plcopen;
-    use crate::pipeline::plc::rules;
-    use std::collections::HashSet;
-
-    fn rule_ids(xml: &str) -> HashSet<&'static str> {
-        parse_plcopen(xml)
-            .iter()
-            .flat_map(rules::analyze)
-            .map(|h| h.rule_id)
-            .collect()
-    }
-
-    /// A Ladder Diagram network: a rung (power rail → contact → coil) plus an
-    /// insecure comm block. Coils/contacts translate to assignments; the block
-    /// translates to a call so the port rule fires.
-    #[test]
-    fn ld_coil_and_block_translate_and_are_analysed() {
-        let xml = r#"<?xml version="1.0"?>
-<project xmlns="http://www.plcopen.org/xml/tc6_0201">
- <types><pous>
-  <pou name="Rung" pouType="program">
-   <interface><localVars>
-     <variable name="Motor"><type><BOOL/></type></variable>
-   </localVars></interface>
-   <body><LD>
-     <leftPowerRail localId="0"/>
-     <contact localId="1"><variable>Start</variable>
-       <connectionPointIn><connection refLocalId="0"/></connectionPointIn></contact>
-     <coil localId="2"><variable>Motor</variable>
-       <connectionPointIn><connection refLocalId="1"/></connectionPointIn></coil>
-     <inVariable localId="3"><expression>21</expression></inVariable>
-     <inVariable localId="4"><expression>FALSE</expression></inVariable>
-     <block localId="10" typeName="Ftp_Send">
-       <inputVariables>
-         <variable formalParameter="PORT">
-           <connectionPointIn><connection refLocalId="3"/></connectionPointIn></variable>
-         <variable formalParameter="ENCRYPT">
-           <connectionPointIn><connection refLocalId="4"/></connectionPointIn></variable>
-       </inputVariables>
-     </block>
-   </LD></body>
-  </pou>
- </pous></types>
-</project>"#;
-        let ids = rule_ids(xml);
-        // Ftp_Send(PORT := 21, ENCRYPT := FALSE) — port 21 is an insecure protocol.
-        assert!(
-            ids.contains("plc-insecure-protocol-port"),
-            "LD block should flag port 21; got {ids:?}"
-        );
-    }
-
-    /// Doubled-text regression: a graphical expression must be extracted once,
-    /// so literals like `502` and `FALSE` stay intact (not `502502`/`FALSEFALSE`).
-    #[test]
-    fn graphical_expression_text_is_not_duplicated() {
-        let xml = r#"<?xml version="1.0"?>
-<project xmlns="http://www.plcopen.org/xml/tc6_0201">
- <types><pous>
-  <pou name="Comm" pouType="program">
-   <body><FBD>
-     <inVariable localId="1"><expression>502</expression></inVariable>
-     <inVariable localId="2"><expression>FALSE</expression></inVariable>
-     <block localId="10" typeName="Modbus_TCP_Master">
-       <inputVariables>
-         <variable formalParameter="PORT">
-           <connectionPointIn><connection refLocalId="1"/></connectionPointIn></variable>
-         <variable formalParameter="AUTH">
-           <connectionPointIn><connection refLocalId="2"/></connectionPointIn></variable>
-       </inputVariables>
-     </block>
-   </FBD></body>
-  </pou>
- </pous></types>
-</project>"#;
-        let ids = rule_ids(xml);
-        assert!(ids.contains("plc-insecure-protocol-port")); // PORT := 502 (not 502502)
-        assert!(ids.contains("plc-insecure-comm")); // AUTH := FALSE (not FALSEFALSE)
-    }
-}

compliance-agent/src/pipeline/plc/sbom.rs

@@ -1,253 +0,0 @@
-//! Control-application dependency SBOM from a CODESYS `.projectarchive`.
-//!
-//! A `.projectarchive` is a ZIP that bundles the project plus its referenced
-//! libraries and the target runtime. Each referenced library is an entry whose
-//! path segment follows the CODESYS convention
-//! `Name, Major.Minor.Patch.Build (Company)` (e.g. `Standard, 3.5.18.0 (System)`,
-//! `CSV Utility SL, 1.9.0.0 (CODESYS)`); the runtime appears as a device-descriptor
-//! entry `CODESYS Control … <version> …`. We enumerate those entries — no binary
-//! parsing — and emit SBOM components tagged `pkg:codesys/…`, so the CVE pipeline
-//! can match them (the runtime `Cmp*` / `3SLicense` components carry real CODESYS
-//! CVEs).
-
-use std::collections::BTreeSet;
-use std::path::{Path, PathBuf};
-
-use compliance_core::models::SbomEntry;
-
-/// Collect the control-application SBOM from every `.projectarchive` reachable for
-/// a target: the ingested artifact file itself (an uploaded archive), plus any
-/// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
-/// extracted source archive that ships the archive alongside its PLCopen XML / ST
-/// exports. Deduplicated by (name, version).
-pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let mut archives: Vec<PathBuf> = Vec::new();
-    if artifact_file.is_file() {
-        archives.push(artifact_file.to_path_buf());
-    }
-    for entry in walkdir::WalkDir::new(working_path)
-        .max_depth(8)
-        .into_iter()
-        .filter_map(|e| e.ok())
-    {
-        let p = entry.path();
-        if entry.file_type().is_file()
-            && p.extension()
-                .and_then(|x| x.to_str())
-                .is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
-        {
-            archives.push(p.to_path_buf());
-        }
-    }
-    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
-    let mut out = Vec::new();
-    for a in archives {
-        for e in projectarchive_sbom(&a, repo_id) {
-            if seen.insert((e.name.clone(), e.version.clone())) {
-                out.push(e);
-            }
-        }
-    }
-    out
-}
-
-/// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
-/// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
-/// `.st`/`.xml` project, which carries no library manifest).
-pub fn projectarchive_sbom(archive: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let Ok(file) = std::fs::File::open(archive) else {
-        return Vec::new();
-    };
-    let Ok(mut zip) = zip::ZipArchive::new(file) else {
-        return Vec::new();
-    };
-    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
-    let mut entries = Vec::new();
-    for i in 0..zip.len() {
-        let Ok(entry) = zip.by_index(i) else {
-            continue;
-        };
-        // Entry paths use `\` (Windows-authored) and/or `/` separators; the
-        // component id is one path segment.
-        for seg in entry.name().split(['/', '\\']) {
-            if let Some((name, version)) = parse_library(seg).or_else(|| parse_runtime(seg)) {
-                if seen.insert((name.clone(), version.clone())) {
-                    let mut e = SbomEntry::new(
-                        repo_id.to_string(),
-                        name.clone(),
-                        version.clone(),
-                        "codesys".to_string(),
-                    );
-                    e.purl = Some(format!(
-                        "pkg:codesys/{}@{version}",
-                        name.replace(' ', "%20")
-                    ));
-                    entries.push(e);
-                }
-            }
-        }
-    }
-    entries
-}
-
-/// `Name, X.Y.Z.W (Company)` → (name, version).
-fn parse_library(seg: &str) -> Option<(String, String)> {
-    let seg = seg.trim();
-    // Company is the trailing "(…)".
-    let open = seg.rfind(" (")?;
-    let rest = &seg[open + 2..];
-    let close = rest.find(')')?;
-    if rest[..close].trim().is_empty() {
-        return None;
-    }
-    let head = seg[..open].trim(); // "Name, X.Y.Z.W"
-    let comma = head.rfind(", ")?;
-    let name = head[..comma].trim().to_string();
-    let version = head[comma + 2..].trim().to_string();
-    if name.is_empty() || !is_dotted_version(&version) {
-        return None;
-    }
-    Some((name, version))
-}
-
-/// Device-descriptor entry `CODESYS Control … X.Y.Z.W …` → (runtime name, version).
-fn parse_runtime(seg: &str) -> Option<(String, String)> {
-    let seg = seg.trim();
-    if !seg.starts_with("CODESYS Control") {
-        return None;
-    }
-    let version = seg
-        .split_whitespace()
-        .find(|t| is_dotted_version(t))?
-        .to_string();
-    // The runtime name is the first field, before the run of padding spaces that
-    // precede the descriptor's numeric columns.
-    let name = seg.split("  ").next().unwrap_or(seg).trim().to_string();
-    if name.is_empty() {
-        return None;
-    }
-    Some((name, version))
-}
-
-/// A dotted numeric version with at least 3 components (`3.5.18.0`, `4.17.0.0`).
-fn is_dotted_version(s: &str) -> bool {
-    let parts: Vec<&str> = s.split('.').collect();
-    parts.len() >= 3
-        && parts
-            .iter()
-            .all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashMap;
-    use std::io::Write;
-
-    /// Build a synthetic `.projectarchive` (zip) mirroring the real CODESYS entry
-    /// naming (verified against Proemion/codesys-examples): a native `.project`,
-    /// referenced libraries as `Name, Version (Company)` segments, and a runtime
-    /// device descriptor.
-    fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
-        let path = dir.join("App.projectarchive");
-        write_synthetic_archive(&path);
-        path
-    }
-
-    fn write_synthetic_archive(path: &Path) {
-        let file = std::fs::File::create(path).expect("create");
-        let mut zip = zip::ZipWriter::new(file);
-        let opts: zip::write::SimpleFileOptions = Default::default();
-        let names = [
-            "App.project",
-            r"{b0b5}\App.Device.Plc.compileinfo",
-            r"{e179}\Standard, 3.5.18.0 (System)   standard.compiled-library-v3",
-            r"{e179}\Util, 3.5.21.0 (System)   util.compiled-library-v3",
-            r"{e179}\CSV Utility SL, 1.9.0.0 (CODESYS)   csv utility sl.compiled-library-v3",
-            r"{e179}\3SLicense, 3.5.20.0 (CODESYS)   3slicense.compiled-library-v3",
-            r"{0c63}\CODESYS Control for Linux ARM SL     0000 0006     4.17.0.0     4096     .zip",
-        ];
-        for n in names {
-            zip.start_file(n, opts).expect("start");
-            zip.write_all(b"x").expect("write");
-        }
-        zip.finish().expect("finish");
-    }
-
-    #[test]
-    fn extracts_libraries_and_runtime_from_projectarchive() {
-        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&tmp).expect("mkdir");
-        let archive = synthetic_archive(&tmp);
-
-        let entries = projectarchive_sbom(&archive, "plc-target");
-        let by_name: HashMap<&str, &SbomEntry> =
-            entries.iter().map(|e| (e.name.as_str(), e)).collect();
-
-        // Libraries with their versions.
-        assert_eq!(
-            by_name.get("Standard").map(|e| e.version.as_str()),
-            Some("3.5.18.0")
-        );
-        assert_eq!(
-            by_name.get("Util").map(|e| e.version.as_str()),
-            Some("3.5.21.0")
-        );
-        assert_eq!(
-            by_name.get("CSV Utility SL").map(|e| e.version.as_str()),
-            Some("1.9.0.0"),
-            "multi-word library names must parse"
-        );
-        assert!(by_name.contains_key("3SLicense"));
-
-        // The runtime, from the device descriptor.
-        assert_eq!(
-            by_name
-                .get("CODESYS Control for Linux ARM SL")
-                .map(|e| e.version.as_str()),
-            Some("4.17.0.0")
-        );
-
-        // Every component is CODESYS-tagged with a purl the CVE pipeline can match,
-        // and the native `.project` / compileinfo are not mistaken for components.
-        for e in &entries {
-            assert_eq!(e.package_manager, "codesys");
-            assert!(e.purl.as_deref().unwrap_or("").starts_with("pkg:codesys/"));
-        }
-        assert!(!by_name.contains_key("App"));
-
-        let _ = std::fs::remove_dir_all(&tmp);
-    }
-
-    #[test]
-    fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
-        let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
-        let src = tmp.join("clone/src");
-        std::fs::create_dir_all(&src).expect("mkdir");
-        // Simulate a git clone that commits the archive alongside its exports.
-        write_synthetic_archive(&src.join("PumpStation.projectarchive"));
-
-        // The artifact "file" is a git URL (not a real file), so the SBOM must
-        // come from walking the cloned tree.
-        let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
-        let names: std::collections::HashSet<&str> =
-            entries.iter().map(|e| e.name.as_str()).collect();
-        assert!(
-            names.contains("Standard"),
-            "found libs in the committed archive"
-        );
-        assert!(names.contains("CODESYS Control for Linux ARM SL"));
-
-        let _ = std::fs::remove_dir_all(&tmp);
-    }
-
-    #[test]
-    fn non_zip_file_yields_no_sbom() {
-        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&tmp).expect("mkdir");
-        let st = tmp.join("prog.st");
-        std::fs::write(&st, "PROGRAM P\nVAR x : INT; END_VAR\nEND_PROGRAM\n").expect("write");
-        assert!(projectarchive_sbom(&st, "t").is_empty());
-        let _ = std::fs::remove_dir_all(&tmp);
-    }
-}

compliance-agent/src/pipeline/semgrep.rs

@@ -1,4 +1,4 @@
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use compliance_core::models::{Finding, ScanType, Severity};
 use compliance_core::traits::{ScanOutput, Scanner};
@@ -6,30 +6,6 @@ use compliance_core::CoreError;
 
 use crate::pipeline::dedup;
 
-/// Custom CRA-control detectors bundled into the binary and staged to a temp file
-/// at scan time so semgrep can `--config` them alongside the auto ruleset. These
-/// cover controls no off-the-shelf rule digs out (secure defaults, weak password
-/// hashing, insecure session cookies, weak data-at-rest ciphers); each rule id is
-/// keyed back to its control by the `control-map` LUT.
-const CRA_RULES: &str = include_str!("../../rules/cra_semgrep.yaml");
-
-/// Write the bundled CRA rules to a stable temp path (atomic: unique tmp +
-/// rename). Returns `None` on failure — the scan then runs with auto rules only.
-async fn stage_cra_rules() -> Option<PathBuf> {
-    let dir = std::env::temp_dir();
-    let path = dir.join("compliance-cra-semgrep.yaml");
-    let tmp = dir.join(format!("compliance-cra-semgrep.{}.tmp", std::process::id()));
-    if let Err(e) = tokio::fs::write(&tmp, CRA_RULES).await {
-        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
-        return None;
-    }
-    if let Err(e) = tokio::fs::rename(&tmp, &path).await {
-        tracing::warn!(error = %e, "failed to stage custom CRA semgrep rules; using auto rules only");
-        return None;
-    }
-    Some(path)
-}
-
 pub struct SemgrepScanner;
 
 impl Scanner for SemgrepScanner {
@@ -43,26 +19,30 @@ impl Scanner for SemgrepScanner {
 
     #[tracing::instrument(skip_all)]
     async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let cra_rules = stage_cra_rules().await;
+        let output = tokio::time::timeout(
-        let mut command = tokio::process::Command::new("semgrep");
+            std::time::Duration::from_secs(600),
-        command.arg("--config=auto");
+            tokio::process::Command::new("semgrep")
-        if let Some(path) = &cra_rules {
+                .args([
-            command.arg(format!("--config={}", path.display()));
+                    "--config=auto",
-        }
+                    "--json",
-        command
+                    "--quiet",
-            .args(["--json", "--quiet", "--max-memory", "500", "--jobs", "1"])
+                    "--max-memory",
-            .arg(repo_path);
+                    "500",
-
+                    "--jobs",
-        let output = tokio::time::timeout(std::time::Duration::from_secs(600), command.output())
+                    "1",
-            .await
+                ])
-            .map_err(|_| CoreError::Scanner {
+                .arg(repo_path)
-                scanner: "semgrep".to_string(),
+                .output(),
-                source: "timed out after 10 minutes".into(),
+        )
-            })?
+        .await
-            .map_err(|e| CoreError::Scanner {
+        .map_err(|_| CoreError::Scanner {
-                scanner: "semgrep".to_string(),
+            scanner: "semgrep".to_string(),
-                source: Box::new(e),
+            source: "timed out after 10 minutes".into(),
-            })?;
+        })?
+        .map_err(|e| CoreError::Scanner {
+            scanner: "semgrep".to_string(),
+            source: Box::new(e),
+        })?;
 
         if !output.status.success() && output.stdout.is_empty() {
             let stderr = String::from_utf8_lossy(&output.stderr);
@@ -102,7 +82,10 @@ impl Scanner for SemgrepScanner {
                 finding.file_path = Some(r.path);
                 finding.line_number = Some(r.start.line);
                 finding.code_snippet = Some(r.extra.lines);
-                finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
+                finding.cwe = r
+                    .extra
+                    .metadata
+                    .and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
                 finding
             })
             .collect();
@@ -141,34 +124,10 @@ struct SemgrepExtra {
     metadata: Option<serde_json::Value>,
 }
 
-/// semgrep emits `metadata.cwe` as a list of strings like
-/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
-/// the first entry and normalise it to just the `CWE-NNN` id.
-fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
-    let raw = metadata.get("cwe")?;
-    let text = match raw {
-        serde_json::Value::Array(items) => items.first()?.as_str()?,
-        serde_json::Value::String(s) => s.as_str(),
-        _ => return None,
-    };
-    let id = text.split(':').next().unwrap_or(text).trim();
-    (!id.is_empty()).then(|| id.to_string())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn extract_cwe_handles_list_and_normalises() {
-        let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
-        assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
-        let bare = serde_json::json!({"cwe": "CWE-89"});
-        assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
-        let none = serde_json::json!({"severity": "ERROR"});
-        assert_eq!(extract_cwe(&none), None);
-    }
-
     #[test]
     fn deserialize_semgrep_output() {
         let json = r#"{

compliance-agent/src/werkbank/mod.rs

@@ -1,10 +0,0 @@
-//! Werkbank control-plane: the dynamic-execution job queue.
-//!
-//! The control plane enqueues declarative [`Job`](compliance_core::models::werkbank::Job)s
-//! and Werkbank runners lease, run, and complete them. [`queue::JobQueue`] is the
-//! Mongo-backed queue behind that flow (WB-02); the runner-facing HTTP transport
-//! and the runner itself land in later stories.
-
-pub mod queue;
-
-pub use queue::{JobQueue, SweepOutcome};

compliance-agent/src/werkbank/queue.rs

@@ -1,309 +0,0 @@
-//! The Mongo-backed Werkbank job queue (WB-02).
-//!
-//! A pull queue: the control plane [`enqueue`](JobQueue::enqueue)s jobs; a runner
-//! [`lease`](JobQueue::lease)s the oldest queued job it can run (matched by
-//! executor + labels), [`heartbeat`](JobQueue::heartbeat)s while it works, and
-//! [`complete`](JobQueue::complete)s it. Leases carry a visibility timeout: if a
-//! runner dies mid-job its heartbeats stop, the lease expires, and
-//! [`sweep_expired`](JobQueue::sweep_expired) returns the job to `queued` (or
-//! `expired` once it has been retried too many times).
-//!
-//! All state transitions are single atomic Mongo updates guarded by the lease
-//! token, so two runners can never both own a job. Every operation takes an
-//! explicit `now` so the queue's time-dependent behaviour is deterministically
-//! testable.
-
-use std::time::Duration;
-
-use chrono::{DateTime, Utc};
-use mongodb::bson::{doc, Bson, DateTime as BsonDateTime};
-use mongodb::error::{ErrorKind, WriteFailure};
-use mongodb::options::ReturnDocument;
-use mongodb::Collection;
-
-use compliance_core::models::werkbank::{
-    Executor, HeartbeatAck, Job, JobRecord, JobResult, JobStatus, LeasedJob,
-};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// The non-terminal states a job can be swept or cancelled from.
-const ACTIVE_STATES: [&str; 2] = ["leased", "running"];
-/// Every terminal state (no further transitions).
-const TERMINAL_STATES: [&str; 4] = ["succeeded", "failed", "expired", "cancelled"];
-
-/// What a visibility-timeout sweep did.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub struct SweepOutcome {
-    /// Expired-lease jobs returned to `queued` for another runner.
-    pub requeued: u64,
-    /// Jobs that had exhausted their attempts and were marked `expired`.
-    pub expired: u64,
-}
-
-/// The Mongo-backed job queue.
-pub struct JobQueue {
-    coll: Collection<JobRecord>,
-}
-
-impl JobQueue {
-    /// Build a queue over a tenant database's `werkbank_jobs` collection.
-    pub fn new(db: &Database) -> Self {
-        Self {
-            coll: db.werkbank_jobs(),
-        }
-    }
-
-    /// Enqueue a job. Idempotent by job id: a job that is already present is a
-    /// no-op. Returns `true` if this call inserted it, `false` if it existed.
-    pub async fn enqueue(&self, job: Job, now: DateTime<Utc>) -> Result<bool, AgentError> {
-        let record = JobRecord::queued(job, now);
-        match self.coll.insert_one(&record).await {
-            Ok(_) => Ok(true),
-            Err(e) if is_duplicate_key(&e) => Ok(false),
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// Atomically lease the oldest `queued` job this runner can run — matched by
-    /// executor and by labels (every label the job requires must be one the
-    /// runner advertises). Returns the job plus a lease token, or `None` if
-    /// nothing is runnable.
-    pub async fn lease(
-        &self,
-        runner_id: &str,
-        executor: Executor,
-        runner_labels: &[String],
-        lease_ttl: Duration,
-        now: DateTime<Utc>,
-    ) -> Result<Option<LeasedJob>, AgentError> {
-        let token = uuid::Uuid::new_v4().to_string();
-        let expires = bson_dt(now + ttl(lease_ttl));
-        let executor_bson = mongodb::bson::to_bson(&executor).unwrap_or(Bson::Null);
-
-        let filter = doc! {
-            "status": "queued",
-            "cancel_requested": { "$ne": true },
-            "job.executor": executor_bson,
-            // Every label the job requires must be in the runner's set — i.e. the
-            // job has no label that is not offered by the runner. Absent/empty
-            // job labels match any runner.
-            "job.labels": { "$not": { "$elemMatch": { "$nin": runner_labels.to_vec() } } },
-        };
-        let update = doc! {
-            "$set": {
-                "status": "leased",
-                "lease_token": &token,
-                "leased_by": runner_id,
-                "lease_expires_at": expires,
-                "heartbeat_at": bson_dt(now),
-                "updated_at": bson_dt(now),
-            },
-            "$inc": { "attempts": 1 },
-        };
-
-        let record = self
-            .coll
-            .find_one_and_update(filter, update)
-            .sort(doc! { "created_at": 1 }) // FIFO
-            .return_document(ReturnDocument::After)
-            .await?;
-        Ok(record.map(|r| LeasedJob {
-            job: r.job,
-            lease_token: token,
-        }))
-    }
-
-    /// Extend a lease and report whether the job has been asked to cancel.
-    /// Transitions the job to `running` on the first heartbeat. Returns `None`
-    /// when the lease is no longer valid (token mismatch, or the job is already
-    /// terminal) — the runner should then abandon the work.
-    pub async fn heartbeat(
-        &self,
-        job_id: &str,
-        lease_token: &str,
-        lease_ttl: Duration,
-        now: DateTime<Utc>,
-    ) -> Result<Option<HeartbeatAck>, AgentError> {
-        let filter = doc! {
-            "job.id": job_id,
-            "lease_token": lease_token,
-            "status": { "$in": ACTIVE_STATES.to_vec() },
-        };
-        let update = doc! {
-            "$set": {
-                "status": "running",
-                "lease_expires_at": bson_dt(now + ttl(lease_ttl)),
-                "heartbeat_at": bson_dt(now),
-                "updated_at": bson_dt(now),
-            },
-        };
-        let record = self
-            .coll
-            .find_one_and_update(filter, update)
-            .return_document(ReturnDocument::After)
-            .await?;
-        Ok(record.map(|r| HeartbeatAck {
-            cancelled: r.cancel_requested,
-        }))
-    }
-
-    /// Record a job's terminal result. Guarded by the lease token and only from
-    /// an active (`leased`/`running`) state, so it is idempotent — a duplicate or
-    /// late submission after the job already finished matches nothing. Returns
-    /// `true` if this call recorded the result.
-    pub async fn complete(
-        &self,
-        job_id: &str,
-        lease_token: &str,
-        result: &JobResult,
-        now: DateTime<Utc>,
-    ) -> Result<bool, AgentError> {
-        let status = result.status.unwrap_or(JobStatus::Failed);
-        let status_bson = mongodb::bson::to_bson(&status).unwrap_or(Bson::String("failed".into()));
-        let result_bson =
-            mongodb::bson::to_bson(result).map_err(|e| AgentError::Other(e.to_string()))?;
-
-        let filter = doc! {
-            "job.id": job_id,
-            "lease_token": lease_token,
-            "status": { "$in": ACTIVE_STATES.to_vec() },
-        };
-        let update = doc! {
-            "$set": {
-                "status": status_bson,
-                "result": result_bson,
-                "lease_token": Bson::Null,
-                "lease_expires_at": Bson::Null,
-                "updated_at": bson_dt(now),
-            },
-        };
-        let res = self.coll.update_one(filter, update).await?;
-        Ok(res.modified_count == 1)
-    }
-
-    /// Request cancellation of a job. A still-`queued` job is cancelled outright;
-    /// an in-flight one is flagged so the runner sees it on its next heartbeat and
-    /// tears down. Returns `true` if a non-terminal job matched.
-    pub async fn cancel(&self, job_id: &str, now: DateTime<Utc>) -> Result<bool, AgentError> {
-        let filter = doc! {
-            "job.id": job_id,
-            "status": { "$nin": TERMINAL_STATES.to_vec() },
-        };
-        // Pipeline update: flag cancellation, and if still queued flip straight to
-        // cancelled (nothing is running it).
-        let pipeline = vec![doc! {
-            "$set": {
-                "cancel_requested": true,
-                "status": {
-                    "$cond": [ { "$eq": ["$status", "queued"] }, "cancelled", "$status" ]
-                },
-                "updated_at": bson_dt(now),
-            }
-        }];
-        let res = self.coll.update_one(filter, pipeline).await?;
-        Ok(res.matched_count == 1)
-    }
-
-    /// Sweep leases whose visibility timeout has elapsed: return them to `queued`
-    /// for another runner, or mark them `expired` once they have been leased
-    /// `max_attempts` times. This is what makes a crashed runner's job recover.
-    pub async fn sweep_expired(
-        &self,
-        now: DateTime<Utc>,
-        max_attempts: u32,
-        // (kept explicit rather than a const so callers can tune retry policy)
-    ) -> Result<SweepOutcome, AgentError> {
-        let now_bson = bson_dt(now);
-        let max = i64::from(max_attempts);
-
-        let requeue = self
-            .coll
-            .update_many(
-                doc! {
-                    "status": { "$in": ACTIVE_STATES.to_vec() },
-                    "lease_expires_at": { "$lt": &now_bson },
-                    "attempts": { "$lt": max },
-                },
-                doc! { "$set": {
-                    "status": "queued",
-                    "lease_token": Bson::Null,
-                    "leased_by": Bson::Null,
-                    "lease_expires_at": Bson::Null,
-                    "updated_at": &now_bson,
-                } },
-            )
-            .await?;
-
-        let expire = self
-            .coll
-            .update_many(
-                doc! {
-                    "status": { "$in": ACTIVE_STATES.to_vec() },
-                    "lease_expires_at": { "$lt": &now_bson },
-                    "attempts": { "$gte": max },
-                },
-                doc! { "$set": {
-                    "status": "expired",
-                    "lease_token": Bson::Null,
-                    "lease_expires_at": Bson::Null,
-                    "updated_at": &now_bson,
-                } },
-            )
-            .await?;
-
-        Ok(SweepOutcome {
-            requeued: requeue.modified_count,
-            expired: expire.modified_count,
-        })
-    }
-
-    /// Fetch a job record by job id (inspection / control-plane reads).
-    pub async fn get(&self, job_id: &str) -> Result<Option<JobRecord>, AgentError> {
-        Ok(self.coll.find_one(doc! { "job.id": job_id }).await?)
-    }
-}
-
-/// A `chrono::Duration` for a lease TTL, saturating rather than panicking on an
-/// absurd input (`chrono::Duration::seconds` panics past its internal bound).
-fn ttl(d: Duration) -> chrono::Duration {
-    let secs = i64::try_from(d.as_secs()).unwrap_or(i64::MAX);
-    chrono::Duration::try_seconds(secs).unwrap_or(chrono::Duration::MAX)
-}
-
-/// A chrono instant as a BSON date (so Mongo stores/compares it as a real date).
-fn bson_dt(dt: DateTime<Utc>) -> BsonDateTime {
-    BsonDateTime::from_chrono(dt)
-}
-
-/// Whether a Mongo error is a duplicate-key (E11000) violation — a job with this
-/// id is already enqueued.
-fn is_duplicate_key(e: &mongodb::error::Error) -> bool {
-    match &*e.kind {
-        ErrorKind::Write(WriteFailure::WriteError(we)) => we.code == 11000,
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ttl_saturates_and_converts() {
-        assert_eq!(ttl(Duration::from_secs(30)), chrono::Duration::seconds(30));
-        // An absurd TTL saturates instead of panicking.
-        assert_eq!(ttl(Duration::from_secs(u64::MAX)), chrono::Duration::MAX);
-    }
-
-    #[test]
-    fn state_constants_are_disjoint() {
-        for s in ACTIVE_STATES {
-            assert!(
-                !TERMINAL_STATES.contains(&s),
-                "{s} cannot be both active and terminal"
-            );
-        }
-    }
-}

compliance-agent/tests/common/mod.rs

@@ -2,10 +2,6 @@
 //
 // Spins up the agent API server on a random port with an isolated test
 // database. Each test gets a fresh database that is dropped on cleanup.
-//
-// Included via `mod common;` in several test binaries; not every binary uses
-// every helper, so allow dead code here.
-#![allow(dead_code)]
 
 use std::sync::Arc;
 
@@ -15,55 +11,6 @@ use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
-/// The runner bearer token wired into the test config.
-pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
-
-/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
-/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
-pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
-    AgentConfig {
-        mongodb_uri,
-        mongodb_database: db_name,
-        litellm_url: std::env::var("TEST_LITELLM_URL")
-            .unwrap_or_else(|_| "http://localhost:4000".into()),
-        litellm_api_key: SecretString::from(String::new()),
-        litellm_model: "gpt-4o".into(),
-        litellm_embed_model: "text-embedding-3-small".into(),
-        agent_port: 0, // not used — we bind ourselves
-        scan_schedule: String::new(),
-        cve_monitor_schedule: String::new(),
-        git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-        artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
-        ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
-        github_token: None,
-        github_webhook_secret: None,
-        gitlab_url: None,
-        gitlab_token: None,
-        gitlab_webhook_secret: None,
-        jira_url: None,
-        jira_email: None,
-        jira_api_token: None,
-        jira_project_key: None,
-        searxng_url: None,
-        nvd_api_key: None,
-        keycloak_url: None,
-        keycloak_realm: None,
-        keycloak_admin_username: None,
-        keycloak_admin_password: None,
-        pentest_verification_email: None,
-        pentest_imap_host: None,
-        pentest_imap_port: None,
-        pentest_imap_tls: false,
-        pentest_imap_username: None,
-        pentest_imap_password: None,
-        admin_api_token: None,
-        tenant_registry_url: None,
-        plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-        werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
-        breakpilot: compliance_core::config::BreakpilotConfig::default(),
-    }
-}
-
 /// A running test server with a unique database.
 pub struct TestServer {
     pub base_url: String,
@@ -86,7 +33,44 @@ impl TestServer {
             .await
             .expect("Failed to build DatabasePool");
 
-        let config = dev_config(mongodb_uri.clone(), db_name.clone());
+        let config = AgentConfig {
+            mongodb_uri: mongodb_uri.clone(),
+            mongodb_database: db_name.clone(),
+            litellm_url: std::env::var("TEST_LITELLM_URL")
+                .unwrap_or_else(|_| "http://localhost:4000".into()),
+            litellm_api_key: SecretString::from(String::new()),
+            litellm_model: "gpt-4o".into(),
+            litellm_embed_model: "text-embedding-3-small".into(),
+            agent_port: 0, // not used — we bind ourselves
+            scan_schedule: String::new(),
+            cve_monitor_schedule: String::new(),
+            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
+            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
+            github_token: None,
+            github_webhook_secret: None,
+            gitlab_url: None,
+            gitlab_token: None,
+            gitlab_webhook_secret: None,
+            jira_url: None,
+            jira_email: None,
+            jira_api_token: None,
+            jira_project_key: None,
+            searxng_url: None,
+            nvd_api_key: None,
+            keycloak_url: None,
+            keycloak_realm: None,
+            keycloak_admin_username: None,
+            keycloak_admin_password: None,
+            pentest_verification_email: None,
+            pentest_imap_host: None,
+            pentest_imap_port: None,
+            pentest_imap_tls: false,
+            pentest_imap_username: None,
+            pentest_imap_password: None,
+            admin_api_token: None,
+            tenant_registry_url: None,
+        };
 
         let agent = ComplianceAgent::new(config, db_pool);
 

compliance-agent/tests/werkbank_api.rs

@@ -1,291 +0,0 @@
-//! Integration tests for the Werkbank runner endpoints (WB-05).
-//!
-//! Drives the real HTTP handlers (lease/heartbeat/complete) against a live Mongo:
-//! a runner leases a seeded job, completes it, and the result's findings are
-//! persisted against the job's target. Also checks the bearer-token gate. Skips
-//! cleanly when no Mongo is reachable.
-
-#![allow(clippy::expect_used, clippy::unwrap_used)]
-
-mod common;
-
-use std::sync::Arc;
-
-use axum::routing::{get, post};
-use axum::{middleware, Extension, Router};
-
-use compliance_agent::agent::ComplianceAgent;
-use compliance_agent::api::handlers::werkbank_jobs;
-use compliance_agent::database::DatabasePool;
-use compliance_agent::werkbank::JobQueue;
-use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
-use compliance_core::models::{
-    Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
-};
-
-use common::{dev_config, TEST_RUNNER_TOKEN};
-
-const TENANT: &str = "dev";
-
-/// A running werkbank API on a random port, or `None` if no Mongo.
-struct Harness {
-    base_url: String,
-    client: reqwest::Client,
-    pool: DatabasePool,
-    db_name: String,
-}
-
-async fn start() -> Option<Harness> {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    let db_name = format!("wba_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
-    let pool = match DatabasePool::connect(&uri, &db_name).await {
-        Ok(p) => p,
-        Err(_) => {
-            eprintln!("SKIP werkbank_api: no MongoDB reachable at {uri}");
-            return None;
-        }
-    };
-    // Touch the tenant DB so indexes are ensured before the queue is used.
-    pool.for_tenant_id(TENANT).await.expect("tenant db");
-
-    let agent = ComplianceAgent::new(dev_config(uri, db_name.clone()), pool.clone());
-    let app = Router::new()
-        .route("/api/v1/werkbank/jobs/lease", post(werkbank_jobs::lease))
-        .route(
-            "/api/v1/werkbank/jobs/heartbeat",
-            post(werkbank_jobs::heartbeat),
-        )
-        .route(
-            "/api/v1/werkbank/jobs/complete",
-            post(werkbank_jobs::complete),
-        )
-        .route(
-            "/api/v1/werkbank/jobs/enqueue",
-            post(werkbank_jobs::enqueue),
-        )
-        .route(
-            "/api/v1/werkbank/artifacts/{hash}",
-            get(werkbank_jobs::serve_artifact),
-        )
-        .layer(middleware::from_fn(werkbank_jobs::require_runner_token))
-        .layer(Extension(Arc::new(agent)));
-
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-    let port = listener.local_addr().unwrap().port();
-    tokio::spawn(async move {
-        axum::serve(listener, app).await.ok();
-    });
-
-    Some(Harness {
-        base_url: format!("http://127.0.0.1:{port}"),
-        client: reqwest::Client::new(),
-        pool,
-        db_name,
-    })
-}
-
-impl Harness {
-    fn post(
-        &self,
-        path: &str,
-        token: Option<&str>,
-        body: serde_json::Value,
-    ) -> reqwest::RequestBuilder {
-        let mut r = self
-            .client
-            .post(format!("{}{path}", self.base_url))
-            .json(&body);
-        if let Some(t) = token {
-            r = r.bearer_auth(t);
-        }
-        r
-    }
-    async fn cleanup(&self) {
-        let _ = self
-            .pool
-            .client()
-            .database(&format!("{}_{TENANT}", self.db_name))
-            .drop()
-            .await;
-    }
-}
-
-fn finding_for(target: &str, fp: &str) -> Finding {
-    let mut f = Finding::new(
-        target.to_string(),
-        fp.to_string(),
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "Modbus exposed".to_string(),
-        "unauthenticated".to_string(),
-        Severity::Critical,
-    );
-    f.rule_id = Some("ics-modbus-exposed".to_string());
-    f
-}
-
-#[tokio::test]
-async fn lease_complete_persists_findings_against_the_target() {
-    let Some(h) = start().await else { return };
-    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
-    let queue = JobQueue::new(&db);
-
-    // Seed a queued job.
-    let job = Job::plc_provision("job-1", TENANT, "target-1", InputRef::blob("sha256:x"), 180);
-    assert!(queue.enqueue(job, chrono::Utc::now()).await.unwrap());
-
-    // Lease it over HTTP.
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/lease",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-                "labels": [], "lease_ttl_secs": 60
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200, "lease should return a job");
-    let leased: LeasedJob = resp.json().await.unwrap();
-    assert_eq!(leased.job.id, "job-1");
-
-    // Complete it with a finding.
-    let mut result = JobResult::succeeded("job-1");
-    result.findings = vec![finding_for("target-1", "fp-abc")];
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/complete",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "job_id": "job-1",
-                "lease_token": leased.lease_token, "result": result
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200);
-    assert!(resp.json::<serde_json::Value>().await.unwrap()["recorded"]
-        .as_bool()
-        .unwrap());
-
-    // The job is now succeeded, and the finding was persisted to the target.
-    assert_eq!(
-        queue.get("job-1").await.unwrap().unwrap().status,
-        JobStatus::Succeeded
-    );
-    let stored = db
-        .findings()
-        .find_one(mongodb::bson::doc! { "fingerprint": "fp-abc" })
-        .await
-        .unwrap();
-    assert!(stored.is_some(), "finding should be persisted");
-
-    h.cleanup().await;
-}
-
-#[tokio::test]
-async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
-    let Some(h) = start().await else { return };
-    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
-
-    // A PlcSps target with a single complete ST program uploaded.
-    let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let st = dir.join("main.st");
-    std::fs::write(
-        &st,
-        "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n  RESOURCE R\nEND_CONFIGURATION\n",
-    )
-    .unwrap();
-    let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
-    let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
-    art.stored_path = Some(st.to_string_lossy().to_string());
-    target.artifacts.push(art);
-    let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
-    let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
-
-    // Enqueue → a plc-provision job whose program is a content-addressed blob.
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/enqueue",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200, "enqueue should succeed");
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let job_id = body["job_id"].as_str().unwrap().to_string();
-
-    let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
-    let hash = rec
-        .job
-        .inputs
-        .get("program")
-        .and_then(|i| i.blob.clone())
-        .expect("program blob");
-
-    // Serve the blob back and confirm it's the program source (what the runner
-    // would fetch).
-    let served = h
-        .client
-        .get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
-        .bearer_auth(TEST_RUNNER_TOKEN)
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(served.status(), 200);
-    assert!(served.text().await.unwrap().contains("CONFIGURATION"));
-
-    h.cleanup().await;
-    let _ = std::fs::remove_dir_all(&dir);
-}
-
-#[tokio::test]
-async fn empty_queue_leases_nothing() {
-    let Some(h) = start().await else { return };
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/lease",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-                "labels": [], "lease_ttl_secs": 60
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 204, "no job → 204");
-    h.cleanup().await;
-}
-
-#[tokio::test]
-async fn runner_endpoints_require_the_bearer_token() {
-    let Some(h) = start().await else { return };
-    let body = serde_json::json!({
-        "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-        "labels": [], "lease_ttl_secs": 60
-    });
-
-    let no_token = h
-        .post("/api/v1/werkbank/jobs/lease", None, body.clone())
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(no_token.status(), 401, "missing token → 401");
-
-    let bad_token = h
-        .post("/api/v1/werkbank/jobs/lease", Some("wrong"), body)
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(bad_token.status(), 401, "wrong token → 401");
-
-    h.cleanup().await;
-}

compliance-agent/tests/werkbank_queue.rs

@@ -1,258 +0,0 @@
-//! Integration tests for the Werkbank job queue (WB-02).
-//!
-//! Exercises the atomic lease/heartbeat/complete/sweep flow against a real
-//! MongoDB — the guarantees (idempotent enqueue, single-owner lease, visibility
-//! timeout) are Mongo-semantics-dependent and can't be unit-tested in isolation.
-//! Skips cleanly when no Mongo is reachable (set `TEST_MONGODB_URI` to point at
-//! one; defaults to the local dev cluster).
-
-#![allow(clippy::expect_used, clippy::unwrap_used)]
-
-use std::time::Duration;
-
-use chrono::{DateTime, TimeZone, Utc};
-
-use compliance_agent::database::Database;
-use compliance_agent::werkbank::JobQueue;
-use compliance_core::models::werkbank::{Executor, InputRef, Job, JobResult};
-
-/// Connect + ensure indexes on a throwaway database, or `None` if no Mongo.
-async fn setup() -> Option<(JobQueue, mongodb::Database)> {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    let db_name = format!("wbq_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
-    let db = match Database::connect(&uri, &db_name).await {
-        Ok(d) => d,
-        Err(_) => {
-            eprintln!("SKIP werkbank_queue: no MongoDB reachable at {uri}");
-            return None;
-        }
-    };
-    db.ensure_indexes().await.expect("ensure indexes");
-    let queue = JobQueue::new(&db);
-    Some((queue, db.inner().clone()))
-}
-
-fn base_time() -> DateTime<Utc> {
-    Utc.timestamp_opt(1_700_000_000, 0).unwrap()
-}
-
-fn job(id: &str) -> Job {
-    Job::plc_provision(id, "acme", "target-1", InputRef::blob("sha256:abc"), 180)
-}
-
-fn job_with_labels(id: &str, labels: &[&str]) -> Job {
-    let mut j = job(id);
-    j.labels = labels.iter().map(|s| s.to_string()).collect();
-    j
-}
-
-macro_rules! skip_if_no_mongo {
-    () => {
-        match setup().await {
-            Some(v) => v,
-            None => return,
-        }
-    };
-}
-
-#[tokio::test]
-async fn enqueue_is_idempotent() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    assert!(q.enqueue(job("j1"), now).await.expect("enqueue"));
-    // Same id again — no duplicate row, reports "already present".
-    assert!(!q.enqueue(job("j1"), now).await.expect("enqueue2"));
-
-    let rec = q.get("j1").await.expect("get").expect("exists");
-    assert_eq!(
-        rec.status,
-        compliance_core::models::werkbank::JobStatus::Queued
-    );
-    assert_eq!(rec.attempts, 0);
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn lease_matches_executor_and_labels_and_is_fifo() {
-    let (q, db) = skip_if_no_mongo!();
-    let t0 = base_time();
-
-    // Two docker jobs (j_old older than j_new) + one requiring a kvm label.
-    q.enqueue(job("j_old"), t0).await.unwrap();
-    q.enqueue(job("j_new"), t0 + chrono::Duration::seconds(5))
-        .await
-        .unwrap();
-    q.enqueue(job_with_labels("j_kvm", &["kvm=true"]), t0)
-        .await
-        .unwrap();
-
-    // Wrong executor: a shell runner leases nothing.
-    assert!(q
-        .lease("r-shell", Executor::Shell, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .is_none());
-
-    // A docker runner without the kvm label gets the oldest label-free job (FIFO).
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .expect("leased");
-    assert_eq!(leased.job.id, "j_old", "oldest matching job first");
-    assert!(!leased.lease_token.is_empty());
-
-    // The kvm job stays unleased for that runner (missing label)...
-    let none = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .expect("next");
-    assert_eq!(none.job.id, "j_new", "label-free job, not the kvm one");
-
-    // ...but a runner advertising kvm can take it.
-    let kvm = q
-        .lease(
-            "r2",
-            Executor::Docker,
-            &["kvm=true".to_string(), "arch=amd64".to_string()],
-            Duration::from_secs(30),
-            t0,
-        )
-        .await
-        .unwrap()
-        .expect("kvm leased");
-    assert_eq!(kvm.job.id, "j_kvm");
-
-    // A leased job increments attempts and is no longer queued.
-    let rec = q.get("j_old").await.unwrap().unwrap();
-    assert_eq!(rec.attempts, 1);
-    assert_eq!(rec.leased_by.as_deref(), Some("r1"));
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn heartbeat_extends_lease_and_surfaces_cancel() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    q.enqueue(job("j1"), now).await.unwrap();
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // A valid heartbeat moves it to running and reports not-cancelled.
-    let ack = q
-        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .expect("valid lease");
-    assert!(!ack.cancelled);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Running
-    );
-
-    // A wrong token is a lost lease.
-    assert!(q
-        .heartbeat("j1", "wrong-token", Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .is_none());
-
-    // Cancelling an in-flight job flags it; the next heartbeat reports cancelled.
-    assert!(q.cancel("j1", now).await.unwrap());
-    let ack = q
-        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .expect("still leased");
-    assert!(ack.cancelled);
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn complete_is_idempotent_and_token_guarded() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    q.enqueue(job("j1"), now).await.unwrap();
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // Wrong token cannot complete.
-    let mut result = JobResult::succeeded("j1");
-    result.findings = Vec::new();
-    assert!(!q.complete("j1", "nope", &result, now).await.unwrap());
-
-    // The lease holder completes it once...
-    assert!(q
-        .complete("j1", &leased.lease_token, &result, now)
-        .await
-        .unwrap());
-    let rec = q.get("j1").await.unwrap().unwrap();
-    assert_eq!(
-        rec.status,
-        compliance_core::models::werkbank::JobStatus::Succeeded
-    );
-    assert!(rec.result.is_some());
-    assert!(rec.lease_token.is_none(), "lease cleared on completion");
-
-    // ...and a second (duplicate) completion is a no-op.
-    assert!(!q
-        .complete("j1", &leased.lease_token, &result, now)
-        .await
-        .unwrap());
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn sweep_requeues_expired_then_expires_after_max_attempts() {
-    let (q, db) = skip_if_no_mongo!();
-    let t0 = base_time();
-
-    q.enqueue(job("j1"), t0).await.unwrap();
-
-    // Lease #1 with a 10s TTL; then time jumps past expiry.
-    q.lease("r1", Executor::Docker, &[], Duration::from_secs(10), t0)
-        .await
-        .unwrap()
-        .unwrap();
-    let past = t0 + chrono::Duration::seconds(60);
-
-    // attempts=1 < max=2 → requeued.
-    let swept = q.sweep_expired(past, 2).await.unwrap();
-    assert_eq!(swept.requeued, 1);
-    assert_eq!(swept.expired, 0);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Queued
-    );
-
-    // Lease #2 (attempts=2), let it expire again → now expired (>= max).
-    q.lease("r2", Executor::Docker, &[], Duration::from_secs(10), past)
-        .await
-        .unwrap()
-        .unwrap();
-    let later = past + chrono::Duration::seconds(60);
-    let swept = q.sweep_expired(later, 2).await.unwrap();
-    assert_eq!(swept.requeued, 0);
-    assert_eq!(swept.expired, 1);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Expired
-    );
-
-    db.drop().await.ok();
-}

compliance-core/Cargo.toml

@@ -50,7 +50,3 @@ axum = { version = "0.8", optional = true }
 jsonwebtoken = { version = "9", optional = true }
 reqwest = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
-
-[dev-dependencies]
-# Parse the declarative TOML job specs in the Werkbank contract tests.
-toml = "0.8"

compliance-core/src/auth.rs

@@ -64,11 +64,11 @@ struct Claims {
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 
 /// Path prefixes that bypass JWT validation. The admin sub-router
-/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
+/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
-/// have their own static-bearer middleware and must not be routed through the
+/// not be routed through the customer-JWT path — a Keycloak token
-/// customer-JWT path — a Keycloak token always carries a single tenant_id and
+/// always carries a single tenant_id and would semantically conflict
-/// would semantically conflict with these cross-tenant / machine operations.
+/// with cross-tenant admin operations.
-const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
+const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
 
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.

compliance-core/src/config.rs

@@ -49,101 +49,6 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
-    /// Ephemeral soft-PLC provisioning for dynamic PLC testing (#183). Off by
-    /// default: it needs Docker access in the agent's runtime, which is a
-    /// deployment opt-in.
-    pub plc_runtime: PlcRuntimeConfig,
-    /// Static bearer for the Werkbank runner endpoints
-    /// (`/api/v1/werkbank/jobs/*`). Machine auth for runners leasing/completing
-    /// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
-    /// `None`, those endpoints are not mounted at all.
-    pub werkbank_runner_token: Option<SecretString>,
-    /// Source for the OSCAL control catalog pulled from breakpilot-compliance
-    /// (drives the [`crate::traits::ControlsProvider`]). Disabled when
-    /// `base_url` is `None`.
-    pub breakpilot: BreakpilotConfig,
-}
-
-/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
-/// to snapshot it for deterministic / offline reuse.
-#[derive(Debug, Clone)]
-pub struct BreakpilotConfig {
-    /// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
-    /// the OSCAL controls provider.
-    pub base_url: Option<String>,
-    /// Optional bearer token for the catalog endpoint.
-    pub token: Option<SecretString>,
-    /// Directory for catalog snapshots.
-    pub snapshot_dir: String,
-    /// Enable the master-controls **semantic** mapping pass (embed regions,
-    /// retrieve nearest controls, grounded-judge). Off by default: it is the
-    /// scale path and stays gated until verified live against a deployed
-    /// master-controls catalog.
-    pub semantic_mapping: bool,
-    /// Enable the **grounded surface** pass for absence-based controls (retrieve
-    /// the code surface a control governs, judge whether it holds). Off by
-    /// default: absence detection is the least deterministic path and stays gated
-    /// until tuned against live scans.
-    pub grounded_control_checks: bool,
-}
-
-impl Default for BreakpilotConfig {
-    fn default() -> Self {
-        Self {
-            base_url: None,
-            token: None,
-            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
-            semantic_mapping: false,
-            grounded_control_checks: false,
-        }
-    }
-}
-
-/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
-///
-/// When a PLC/SPS target ships control logic but no reachable live device, the
-/// agent can instantiate that logic itself: spin up a throwaway soft-PLC
-/// (OpenPLC) container in-cluster, load the program, start the runtime, probe it
-/// over industrial protocols, then tear it down. This struct carries the knobs
-/// for that container's lifecycle and the OpenPLC web-UI credentials used to
-/// upload the program.
-#[derive(Clone, Debug)]
-pub struct PlcRuntimeConfig {
-    /// Master switch. Provision-and-test does nothing unless this is set — it
-    /// shells out to `docker`, which requires the agent container to have Docker
-    /// access (socket mount), an explicit deployment decision.
-    pub enabled: bool,
-    /// Container image for the ephemeral soft-PLC (OpenPLC).
-    pub image: String,
-    /// Docker network the instance joins. Must be the agent's own network so it
-    /// is reachable in-cluster by container name and never published to the host.
-    pub network: String,
-    /// Memory cap passed to `docker run --memory` (e.g. `512m`).
-    pub memory: String,
-    /// CPU cap passed to `docker run --cpus` (e.g. `0.5`).
-    pub cpus: String,
-    /// Hard ceiling on a provisioned instance's lifetime. Teardown is guaranteed
-    /// no later than this even if a load/probe step hangs.
-    pub max_lifetime_secs: u64,
-    /// OpenPLC web-UI username for the program upload (image default `openplc`).
-    pub openplc_user: String,
-    /// OpenPLC web-UI password (image default `openplc`).
-    pub openplc_password: SecretString,
-}
-
-impl Default for PlcRuntimeConfig {
-    fn default() -> Self {
-        Self {
-            enabled: false,
-            image: "registry.meghsakha.com/openplc:latest".to_string(),
-            network: "certifai".to_string(),
-            memory: "512m".to_string(),
-            cpus: "0.5".to_string(),
-            max_lifetime_secs: 180,
-            openplc_user: "openplc".to_string(),
-            openplc_password: SecretString::from("openplc".to_string()),
-        }
-    }
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/control_check.rs

@@ -1,205 +0,0 @@
-//! Grounded control-driven checking.
-//!
-//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
-//! whose output is grounded to real code — so a hallucinated finding cannot
-//! survive. Determinism is structural, not a prompt plea:
-//!
-//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
-//!    code it never saw;
-//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
-//!    in the region, and the line is recomputed from that match — the model's own
-//!    line number is never trusted ([`ground`]);
-//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
-//!
-//! The LLM supplies cross-language / cross-stack pattern recognition; this module
-//! supplies the determinism.
-
-use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
-
-use crate::models::finding::{Finding, Severity};
-use crate::models::scan::ScanType;
-
-/// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlCheckSpec {
-    /// Stable control id, e.g. `"cra-ai-8"`.
-    pub control_id: String,
-    /// Short control title (used in the finding title).
-    pub title: String,
-    /// The requirement text the LLM judges against (control objective/statement).
-    pub requirement: String,
-    /// CWE to fall back to when the model doesn't supply one.
-    pub default_cwe: Option<String>,
-    /// Severity for findings raised from this control.
-    pub severity: Severity,
-}
-
-/// A retrieved code region the LLM judges — never the whole repo.
-#[derive(Debug, Clone)]
-pub struct CandidateRegion {
-    /// Repo-relative path.
-    pub file: String,
-    /// 1-based line number of the region's first line in `file`.
-    pub start_line: u32,
-    /// The region's source text.
-    pub content: String,
-}
-
-/// The LLM's structured verdict for one (control, region). `snippet` is the
-/// verbatim code the model claims proves the violation — it is the anchor the
-/// grounding gate checks.
-#[derive(Debug, Clone)]
-pub struct LlmVerdict {
-    pub violates: bool,
-    pub snippet: String,
-    pub cwe: Option<String>,
-    pub confidence: f64,
-}
-
-/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
-/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
-/// finding's line is computed from the match, so a fabricated or mis-located
-/// snippet is dropped. Pure — no LLM, no I/O.
-pub fn ground(
-    spec: &ControlCheckSpec,
-    region: &CandidateRegion,
-    verdict: &LlmVerdict,
-    repo_id: &str,
-) -> Option<Finding> {
-    if !verdict.violates {
-        return None;
-    }
-    let snippet = verdict.snippet.trim();
-    if snippet.is_empty() {
-        return None;
-    }
-    // Grounding: the quoted snippet must literally exist in the retrieved region.
-    let pos = region.content.find(snippet)?;
-    // Recompute the real line from the match — never trust the model's number.
-    let newlines_before = region.content[..pos].matches('\n').count();
-    let line = region.start_line + newlines_before as u32;
-
-    let mut finding = Finding::new(
-        repo_id.to_string(),
-        control_finding_fingerprint(&spec.control_id, &region.file, snippet),
-        "control-check".to_string(),
-        ScanType::CodeReview,
-        format!("{}: {}", spec.control_id, spec.title),
-        format!(
-            "Control {} appears violated ({}) at {}:{line}",
-            spec.control_id, spec.requirement, region.file
-        ),
-        spec.severity.clone(),
-    );
-    finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
-    finding.file_path = Some(region.file.clone());
-    finding.line_number = Some(line);
-    finding.code_snippet = Some(snippet.to_string());
-    finding.confidence = Some(verdict.confidence);
-    // Carry the control reference on the finding.
-    finding.control_refs = vec![spec.control_id.clone()];
-    Some(finding)
-}
-
-/// Deterministic cache key for a (control, region, model, prompt-version) verdict
-/// so identical inputs reproduce the same verdict without another LLM call.
-pub fn cache_key(
-    control_id: &str,
-    region_content: &str,
-    model: &str,
-    prompt_version: &str,
-) -> String {
-    hash_parts(&[control_id, region_content, model, prompt_version])
-}
-
-fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
-    hash_parts(&[control_id, file, snippet])
-}
-
-fn hash_parts(parts: &[&str]) -> String {
-    let mut hasher = Sha256::new();
-    for part in parts {
-        hasher.update(part.as_bytes());
-        hasher.update([0u8]); // domain separator between parts
-    }
-    hex::encode(hasher.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "Products must not ship default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    fn region() -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 10,
-            content: "def login():\n    PASSWORD = \"admin123\"\n    return PASSWORD\n".into(),
-        }
-    }
-
-    #[test]
-    fn grounds_real_snippet_with_recomputed_line() {
-        let v = LlmVerdict {
-            violates: true,
-            snippet: "PASSWORD = \"admin123\"".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        let f = ground(&spec(), &region(), &v, "repo").expect("should ground");
-        assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
-        assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
-        assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
-        assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
-        assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
-    }
-
-    #[test]
-    fn drops_fabricated_snippet_not_in_region() {
-        let v = LlmVerdict {
-            violates: true,
-            snippet: "SECRET = \"totally-made-up\"".into(),
-            cwe: None,
-            confidence: 0.99,
-        };
-        assert!(ground(&spec(), &region(), &v, "repo").is_none());
-    }
-
-    #[test]
-    fn drops_non_violation_and_empty_snippet() {
-        let no = LlmVerdict {
-            violates: false,
-            snippet: "PASSWORD = \"admin123\"".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        assert!(ground(&spec(), &region(), &no, "repo").is_none());
-        let empty = LlmVerdict {
-            violates: true,
-            snippet: "   ".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        assert!(ground(&spec(), &region(), &empty, "repo").is_none());
-    }
-
-    #[test]
-    fn cache_key_and_fingerprint_are_deterministic() {
-        assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
-        assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
-        assert_eq!(
-            control_finding_fingerprint("c", "f", "s"),
-            control_finding_fingerprint("c", "f", "s")
-        );
-    }
-}

compliance-core/src/lib.rs

@@ -1,5 +1,4 @@
 pub mod config;
-pub mod control_check;
 pub mod db;
 pub mod error;
 pub mod models;
@@ -14,6 +13,6 @@ pub mod auth;
 #[cfg(feature = "axum")]
 pub mod tenant_ctx;
 
-pub use config::{AgentConfig, DashboardConfig, PlcRuntimeConfig};
+pub use config::{AgentConfig, DashboardConfig};
 pub use error::CoreError;
 pub use tenant::{OrgRole, TenantContext, TenantStatus};

compliance-core/src/models/finding.rs

@@ -76,10 +76,6 @@ pub struct Finding {
     pub triage_rationale: Option<String>,
     /// Developer feedback on finding quality
     pub developer_feedback: Option<String>,
-    /// Compliance control ids this finding is evidence for (stamped by control
-    /// triage against the `control-map` LUT). Empty when unmapped.
-    #[serde(default)]
-    pub control_refs: Vec<String>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
@@ -122,7 +118,6 @@ impl Finding {
             triage_action: None,
             triage_rationale: None,
             developer_feedback: None,
-            control_refs: Vec::new(),
             created_at: now,
             updated_at: now,
         }

compliance-core/src/models/mod.rs

@@ -10,14 +10,11 @@ pub mod mcp;
 pub mod mcp_token;
 pub mod notification;
 pub mod onboarding;
-pub mod oscal;
-pub mod oscal_assessment;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
 pub mod scan;
 pub(crate) mod serde_helpers;
-pub mod werkbank;
 
 pub use auth::AuthInfo;
 pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
@@ -41,8 +38,6 @@ pub use onboarding::{
     GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
     TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
-pub use oscal::OscalDocument;
-pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
     PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
@@ -52,8 +47,3 @@ pub use pentest::{
 pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
-pub use werkbank::{
-    CompleteRequest, CompleteResponse, DastCollect, Executor, HeartbeatAck, HeartbeatRequest,
-    InputRef, Job, JobCollect, JobRecord, JobResult, JobRuntime, JobStatus, JobType, LeaseRequest,
-    LeasedJob,
-};

compliance-core/src/models/onboarding.rs

@@ -202,9 +202,6 @@ pub enum PlcFormat {
     PlcopenXml,
     /// IEC 61131-3 Structured Text source.
     StructuredText,
-    /// A CODESYS project archive (`.projectarchive` — a zip bundling the project
-    /// plus its referenced libraries and runtime; the source of the control-app SBOM).
-    ProjectArchive,
 }
 
 /// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.

compliance-core/src/models/oscal.rs

@@ -1,250 +0,0 @@
-//! OSCAL 1.1 catalog types + mapping into the controls corpus.
-//!
-//! Deserialises the OSCAL catalog served by breakpilot-compliance
-//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
-//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
-//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
-//! producer can add detail without breaking us.
-//!
-//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
-//! and scanner routing live in our assessment layer, not here — see
-//! [`crate::traits::ControlsProvider`].
-
-use serde::Deserialize;
-
-use crate::models::onboarding::ComplianceFramework;
-use crate::traits::Control as CorpusControl;
-
-/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
-#[derive(Debug, Clone, Deserialize)]
-pub struct OscalDocument {
-    pub catalog: Catalog,
-}
-
-/// An OSCAL catalog: metadata + a tree of control groups.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Catalog {
-    pub uuid: String,
-    pub metadata: Metadata,
-    #[serde(default)]
-    pub groups: Vec<Group>,
-    #[serde(rename = "back-matter", default)]
-    pub back_matter: Option<BackMatter>,
-}
-
-/// Catalog metadata (title/version + provenance props).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Metadata {
-    pub title: String,
-    pub version: String,
-    #[serde(rename = "oscal-version")]
-    pub oscal_version: String,
-    #[serde(default)]
-    pub props: Vec<Prop>,
-}
-
-/// A name/value property, optionally namespaced.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Prop {
-    pub name: String,
-    pub value: String,
-    #[serde(default)]
-    pub ns: Option<String>,
-}
-
-/// A control group (may nest sub-groups and controls).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Group {
-    #[serde(default)]
-    pub id: String,
-    #[serde(default)]
-    pub title: String,
-    #[serde(default)]
-    pub controls: Vec<Control>,
-    #[serde(default)]
-    pub groups: Vec<Group>,
-}
-
-/// An OSCAL control (may nest enhancement controls).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Control {
-    pub id: String,
-    #[serde(default)]
-    pub title: String,
-    #[serde(default)]
-    pub props: Vec<Prop>,
-    #[serde(default)]
-    pub parts: Vec<Part>,
-    #[serde(default)]
-    pub links: Vec<Link>,
-    #[serde(default)]
-    pub controls: Vec<Control>,
-}
-
-/// A control part (e.g. the `statement`), may nest sub-parts.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Part {
-    #[serde(default)]
-    pub name: String,
-    #[serde(default)]
-    pub prose: Option<String>,
-    #[serde(default)]
-    pub parts: Vec<Part>,
-}
-
-/// A link, e.g. a `reference` to a back-matter resource.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Link {
-    pub href: String,
-    #[serde(default)]
-    pub rel: Option<String>,
-}
-
-/// Back-matter holding referenced resources (e.g. the CRA measures).
-#[derive(Debug, Clone, Deserialize)]
-pub struct BackMatter {
-    #[serde(default)]
-    pub resources: Vec<Resource>,
-}
-
-/// A back-matter resource referenced by control links.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Resource {
-    pub uuid: String,
-    #[serde(default)]
-    pub title: Option<String>,
-    #[serde(default)]
-    pub description: Option<String>,
-}
-
-impl Metadata {
-    /// First prop value with the given name.
-    pub fn prop(&self, name: &str) -> Option<&str> {
-        self.props
-            .iter()
-            .find(|p| p.name == name)
-            .map(|p| p.value.as_str())
-    }
-}
-
-impl Control {
-    /// First prop value with the given name.
-    pub fn prop(&self, name: &str) -> Option<&str> {
-        self.props
-            .iter()
-            .find(|p| p.name == name)
-            .map(|p| p.value.as_str())
-    }
-
-    /// The control's `statement` prose, if present.
-    pub fn statement(&self) -> Option<&str> {
-        self.parts
-            .iter()
-            .find(|p| p.name == "statement")
-            .and_then(|p| p.prose.as_deref())
-    }
-}
-
-impl OscalDocument {
-    /// The framework this catalog declares (`metadata.props[name="framework"]`).
-    pub fn framework(&self) -> Option<ComplianceFramework> {
-        framework_from_str(self.catalog.metadata.prop("framework")?)
-    }
-
-    /// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
-    pub fn content_hash(&self) -> Option<&str> {
-        self.catalog.metadata.prop("content-hash")
-    }
-
-    /// Flatten the catalog into the corpus controls the mapping engine consumes.
-    pub fn to_controls(&self) -> Vec<CorpusControl> {
-        let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
-        let source_label = self.catalog.metadata.title.as_str();
-        let mut out = Vec::new();
-        for group in &self.catalog.groups {
-            collect_group(group, framework, source_label, &mut out);
-        }
-        out
-    }
-}
-
-/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
-/// serde snake_case representation.
-fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
-    serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
-}
-
-fn collect_group(
-    group: &Group,
-    framework: ComplianceFramework,
-    source_label: &str,
-    out: &mut Vec<CorpusControl>,
-) {
-    for control in &group.controls {
-        collect_control(control, framework, source_label, out);
-    }
-    for sub in &group.groups {
-        collect_group(sub, framework, source_label, out);
-    }
-}
-
-fn collect_control(
-    control: &Control,
-    framework: ComplianceFramework,
-    source_label: &str,
-    out: &mut Vec<CorpusControl>,
-) {
-    let source = match control.prop("annex-anchor") {
-        Some(anchor) => Some(format!("{source_label} · {anchor}")),
-        None => Some(source_label.to_string()),
-    };
-    out.push(CorpusControl {
-        id: control.id.clone(),
-        framework,
-        title: control.title.clone(),
-        text: control.statement().unwrap_or_default().to_string(),
-        source,
-    });
-    for enhancement in &control.controls {
-        collect_control(enhancement, framework, source_label, out);
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
-
-    fn parse() -> OscalDocument {
-        serde_json::from_str(CATALOG).unwrap()
-    }
-
-    #[test]
-    fn parses_full_catalog() {
-        let doc = parse();
-        assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
-        assert!(!doc.catalog.groups.is_empty());
-        assert!(doc.catalog.back_matter.is_some());
-    }
-
-    #[test]
-    fn maps_all_controls_to_corpus() {
-        let doc = parse();
-        let controls = doc.to_controls();
-        assert_eq!(controls.len(), 40);
-        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
-
-        let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
-        assert_eq!(c8.framework, ComplianceFramework::Cra);
-        assert!(!c8.title.is_empty());
-        assert!(!c8.text.is_empty(), "statement prose should map into text");
-        assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
-    }
-
-    #[test]
-    fn exposes_content_hash_for_snapshotting() {
-        assert_eq!(parse().content_hash().map(str::len), Some(64));
-    }
-}

compliance-core/src/models/oscal_assessment.rs

@@ -1,424 +0,0 @@
-//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
-//!
-//! The catalog (domain content) comes from the producer; the **assessment** is
-//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
-//! standard OSCAL assessment-results document: an observation per linked finding,
-//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
-//! records the full catalog set we considered.
-//!
-//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
-//! timestamp. Pure — no DB, no network.
-
-use std::collections::HashMap;
-
-use chrono::{DateTime, Utc};
-use serde::Serialize;
-use uuid::Uuid;
-
-use crate::models::finding::{Finding, FindingStatus};
-
-const OSCAL_VERSION: &str = "1.1.2";
-/// Same namespace as the catalog exporter, so ids are stable and correlatable.
-const NAMESPACE: Uuid = Uuid::from_bytes([
-    0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
-]);
-
-fn det_uuid(name: &str) -> String {
-    Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
-}
-
-/// Links findings to the catalog control-ids they provide evidence for.
-pub struct ControlLinker {
-    cwe_to_controls: HashMap<u32, Vec<String>>,
-}
-
-impl ControlLinker {
-    /// Build a linker from an explicit CWE → control-id map.
-    pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
-        Self { cwe_to_controls }
-    }
-
-    /// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
-    /// `_CWE_TO_REQ`; extend as scanner coverage grows).
-    pub fn cra_seed() -> Self {
-        let pairs: &[(u32, &str)] = &[
-            (798, "cra-ai-8"),
-            (259, "cra-ai-8"),
-            (1392, "cra-ai-8"),
-            (327, "cra-ai-13"),
-            (326, "cra-ai-13"),
-            (319, "cra-ai-15"),
-            (311, "cra-ai-15"),
-            (89, "cra-ai-20"),
-            (79, "cra-ai-20"),
-            (78, "cra-ai-20"),
-            (22, "cra-ai-20"),
-        ];
-        let mut map: HashMap<u32, Vec<String>> = HashMap::new();
-        for (cwe, id) in pairs {
-            map.entry(*cwe).or_default().push((*id).to_string());
-        }
-        Self::new(map)
-    }
-
-    /// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
-    fn parse_cwe(raw: &str) -> Option<u32> {
-        raw.trim_start_matches(|c: char| !c.is_ascii_digit())
-            .split(|c: char| !c.is_ascii_digit())
-            .next()
-            .filter(|s| !s.is_empty())
-            .and_then(|s| s.parse().ok())
-    }
-
-    /// The control-ids a finding provides evidence for (via its CWE).
-    pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
-        finding
-            .cwe
-            .as_deref()
-            .and_then(Self::parse_cwe)
-            .and_then(|cwe| self.cwe_to_controls.get(&cwe))
-            .cloned()
-            .unwrap_or_default()
-    }
-}
-
-/// Build a standard OSCAL assessment-results document from `findings`, using each
-/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
-/// finding is emitted as an observation — mapped findings additionally produce a
-/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
-/// (an observation carrying their CWE/tool/severity, with no control target) so
-/// nothing is lost. `at` is the assessment timestamp.
-pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
-    let ts = at.to_rfc3339();
-
-    let mut observations = Vec::new();
-    let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
-    let mut mapped = 0usize;
-    let mut unmapped = 0usize;
-
-    for finding in findings {
-        if finding.status == FindingStatus::FalsePositive {
-            continue; // flagged tool false positive — excluded from the report
-        }
-        let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
-        let location = match (&finding.file_path, finding.line_number) {
-            (Some(f), Some(l)) => Some(format!("{f}:{l}")),
-            (Some(f), None) => Some(f.clone()),
-            _ => None,
-        };
-        let is_mapped = !finding.control_refs.is_empty();
-        if is_mapped {
-            mapped += 1;
-        } else {
-            unmapped += 1;
-        }
-        let mut props = vec![
-            ObsProp::new("tool", &finding.scanner),
-            ObsProp::new("severity", &finding.severity.to_string()),
-            ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
-        ];
-        if let Some(cwe) = &finding.cwe {
-            props.push(ObsProp::new("cwe", cwe));
-        }
-        observations.push(Observation {
-            uuid: obs_uuid.clone(),
-            title: finding.title.clone(),
-            description: finding.description.clone(),
-            methods: vec!["TEST".to_string()],
-            collected: ts.clone(),
-            props,
-            relevant_evidence: vec![RelevantEvidence {
-                href: location.map(|l| format!("file://{l}")),
-                description: format!("[{}] {}", finding.scanner, finding.title),
-            }],
-        });
-        for control_id in &finding.control_refs {
-            obs_by_control
-                .entry(control_id.clone())
-                .or_default()
-                .push(obs_uuid.clone());
-        }
-    }
-
-    let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
-    hit_controls.sort();
-    let ar_findings: Vec<ArFinding> = hit_controls
-        .iter()
-        .map(|control_id| ArFinding {
-            uuid: det_uuid(&format!("finding:{control_id}")),
-            title: format!("Findings affect {control_id}"),
-            target: FindingTarget {
-                target_type: "statement-id".to_string(),
-                target_id: format!("{control_id}_smt"),
-                status: TargetStatus {
-                    state: "not-satisfied".to_string(),
-                },
-            },
-            related_observations: obs_by_control[*control_id]
-                .iter()
-                .map(|u| RelatedObservation {
-                    observation_uuid: u.clone(),
-                })
-                .collect(),
-        })
-        .collect();
-
-    let include_controls: Vec<SelectControlById> = hit_controls
-        .iter()
-        .map(|c| SelectControlById {
-            control_id: (*c).clone(),
-        })
-        .collect();
-
-    let result = ArResult {
-        uuid: det_uuid("result:cra"),
-        title: "Automated code-compliance assessment".to_string(),
-        description: format!(
-            "{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
-            observations.len(),
-            include_controls.len()
-        ),
-        start: ts.clone(),
-        reviewed_controls: ReviewedControls {
-            control_selections: vec![ControlSelection { include_controls }],
-        },
-        observations,
-        findings: ar_findings,
-    };
-
-    AssessmentResultsDoc {
-        assessment_results: AssessmentResults {
-            uuid: det_uuid("assessment-results:cra"),
-            metadata: ArMetadata {
-                title: "Compliance scanner — OSCAL assessment results".to_string(),
-                last_modified: ts,
-                version: "1.0.0".to_string(),
-                oscal_version: OSCAL_VERSION.to_string(),
-            },
-            import_ap: ImportAp {
-                href: "#cra-annex-i".to_string(),
-            },
-            results: vec![result],
-        },
-    }
-}
-
-// ── OSCAL assessment-results document (serialise) ────────────────────────────
-
-/// The root OSCAL assessment-results document.
-#[derive(Debug, Clone, Serialize)]
-pub struct AssessmentResultsDoc {
-    #[serde(rename = "assessment-results")]
-    pub assessment_results: AssessmentResults,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct AssessmentResults {
-    pub uuid: String,
-    pub metadata: ArMetadata,
-    #[serde(rename = "import-ap")]
-    pub import_ap: ImportAp,
-    pub results: Vec<ArResult>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArMetadata {
-    pub title: String,
-    #[serde(rename = "last-modified")]
-    pub last_modified: String,
-    pub version: String,
-    #[serde(rename = "oscal-version")]
-    pub oscal_version: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ImportAp {
-    pub href: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArResult {
-    pub uuid: String,
-    pub title: String,
-    pub description: String,
-    pub start: String,
-    #[serde(rename = "reviewed-controls")]
-    pub reviewed_controls: ReviewedControls,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub observations: Vec<Observation>,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub findings: Vec<ArFinding>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ReviewedControls {
-    #[serde(rename = "control-selections")]
-    pub control_selections: Vec<ControlSelection>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ControlSelection {
-    #[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
-    pub include_controls: Vec<SelectControlById>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct SelectControlById {
-    #[serde(rename = "control-id")]
-    pub control_id: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct Observation {
-    pub uuid: String,
-    pub title: String,
-    pub description: String,
-    pub methods: Vec<String>,
-    pub collected: String,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub props: Vec<ObsProp>,
-    #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
-    pub relevant_evidence: Vec<RelevantEvidence>,
-}
-
-/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
-/// unmapped finding be reported fully as-is.
-#[derive(Debug, Clone, Serialize)]
-pub struct ObsProp {
-    pub name: String,
-    pub value: String,
-}
-
-impl ObsProp {
-    fn new(name: &str, value: &str) -> Self {
-        Self {
-            name: name.to_string(),
-            value: value.to_string(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct RelevantEvidence {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub href: Option<String>,
-    pub description: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArFinding {
-    pub uuid: String,
-    pub title: String,
-    pub target: FindingTarget,
-    #[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
-    pub related_observations: Vec<RelatedObservation>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct FindingTarget {
-    #[serde(rename = "type")]
-    pub target_type: String,
-    #[serde(rename = "target-id")]
-    pub target_id: String,
-    pub status: TargetStatus,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct TargetStatus {
-    pub state: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct RelatedObservation {
-    #[serde(rename = "observation-uuid")]
-    pub observation_uuid: String,
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use crate::models::finding::Severity;
-    use crate::models::scan::ScanType;
-
-    fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
-        let mut f = Finding::new(
-            "repo".into(),
-            fp.into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "hardcoded credential".into(),
-            "desc".into(),
-            Severity::High,
-        );
-        f.cwe = cwe.map(Into::into);
-        f.file_path = Some("src/auth.rs".into());
-        f.line_number = Some(42);
-        f.control_refs = refs.iter().map(|s| s.to_string()).collect();
-        f
-    }
-
-    fn at() -> DateTime<Utc> {
-        DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
-            .unwrap()
-            .with_timezone(&Utc)
-    }
-
-    #[test]
-    fn mapped_finding_becomes_control_finding() {
-        let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
-        let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1);
-        assert_eq!(r.findings.len(), 1);
-        assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
-        assert_eq!(r.findings[0].target.status.state, "not-satisfied");
-        assert_eq!(
-            r.reviewed_controls.control_selections[0]
-                .include_controls
-                .len(),
-            1
-        );
-    }
-
-    #[test]
-    fn unmapped_finding_is_reported_as_is() {
-        let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
-        let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1); // still emitted...
-        assert!(r.findings.is_empty()); // ...but no control finding
-        assert!(r.reviewed_controls.control_selections[0]
-            .include_controls
-            .is_empty());
-        let props: Vec<(&str, &str)> = r.observations[0]
-            .props
-            .iter()
-            .map(|p| (p.name.as_str(), p.value.as_str()))
-            .collect();
-        assert!(props.contains(&("mapping", "unmapped")));
-        assert!(props.contains(&("cwe", "CWE-319")));
-    }
-
-    #[test]
-    fn false_positive_is_excluded() {
-        let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
-        f.status = FindingStatus::FalsePositive;
-        let doc = assess(&[f], at());
-        assert!(doc.assessment_results.results[0].observations.is_empty());
-    }
-
-    #[test]
-    fn deterministic_and_valid_oscal() {
-        let mk = || {
-            vec![
-                finding("f1", Some("CWE-798"), &["cra-ai-8"]),
-                finding("f2", Some("CWE-319"), &[]),
-            ]
-        };
-        let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
-        let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
-        assert_eq!(a, b);
-        assert!(a.contains("\"oscal-version\":\"1.1.2\""));
-        assert!(a.contains("\"not-satisfied\""));
-        assert!(a.contains("\"mapping\""));
-    }
-}

compliance-core/src/models/scan.rs

@@ -24,9 +24,6 @@ pub enum ScanType {
     MobileStatic,
     /// Static analysis of a container image.
     ContainerScan,
-    /// Dynamic probing of a running PLC/SPS device over industrial protocols
-    /// (Modbus/TCP, OPC UA, …) for exposed/unauthenticated control access.
-    IcsProbe,
 }
 
 impl std::fmt::Display for ScanType {
@@ -46,7 +43,6 @@ impl std::fmt::Display for ScanType {
             Self::PlcControlLogic => write!(f, "plc_control_logic"),
             Self::MobileStatic => write!(f, "mobile_static"),
             Self::ContainerScan => write!(f, "container_scan"),
-            Self::IcsProbe => write!(f, "ics_probe"),
         }
     }
 }
@@ -80,7 +76,6 @@ pub enum ScanPhase {
     LlmTriage,
     IssueCreation,
     DastScanning,
-    IcsProbe,
     Completed,
 }
 

compliance-core/src/models/werkbank.rs

@@ -1,514 +0,0 @@
-//! The Werkbank job/result contract (WB-01).
-//!
-//! The shared, dependency-free vocabulary the control plane and the Werkbank
-//! execution runner agree on: what a [`Job`] is, which [`Executor`] runs it, how
-//! it moves through the queue ([`JobStatus`]), and what a [`JobResult`] carries
-//! back. Jobs are declarative — TOML on disk, JSON on the wire — and results
-//! reuse the existing scanner result types ([`Finding`], [`DastFinding`],
-//! [`SbomEntry`]) so the runner produces exactly what the control plane persists.
-//!
-//! This module is intentionally free of the `mongodb`/`axum` features so the
-//! runner can depend on `compliance-core` without pulling the server stack.
-
-use std::collections::BTreeMap;
-
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
-
-use super::dast::DastFinding;
-use super::finding::Finding;
-use super::sbom::SbomEntry;
-
-/// The kind of dynamic-execution job.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "kebab-case")]
-pub enum JobType {
-    /// Instantiate control logic on an ephemeral soft-PLC and probe it.
-    PlcProvision,
-    /// Boot a firmware image under QEMU and run dynamic checks.
-    QemuBoot,
-    /// Crawl and dynamically test a running web endpoint.
-    Dast,
-    /// Run an active penetration test against a running target.
-    Pentest,
-}
-
-/// How a runner executes a job — the CI-runner-style classification. A runner
-/// advertises exactly one; a job requires one.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum Executor {
-    /// A subprocess on the runner host (dev / trusted single-node).
-    Shell,
-    /// One or more containers on the runner's Docker (default; QEMU runs here).
-    Docker,
-    /// A Pod/Job in a Kubernetes cluster (scale-out / multi-tenant).
-    K8s,
-}
-
-/// Lifecycle state of a job in the queue.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum JobStatus {
-    /// Waiting to be leased.
-    Queued,
-    /// Leased by a runner but not yet started.
-    Leased,
-    /// Executing on a runner.
-    Running,
-    /// Completed successfully.
-    Succeeded,
-    /// Completed with an error.
-    Failed,
-    /// The lease/lifetime deadline elapsed before completion.
-    Expired,
-    /// Cancelled by the control plane.
-    Cancelled,
-}
-
-impl JobStatus {
-    /// Whether the job has reached a terminal state (no further transitions).
-    pub fn is_terminal(self) -> bool {
-        matches!(
-            self,
-            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Expired | JobStatus::Cancelled
-        )
-    }
-}
-
-/// A reference to an input artifact. Resolved by the runner from a source it can
-/// reach; the blob itself never flows through the control plane (so an on-prem
-/// runner keeps customer data local). Exactly one of `blob`/`url` should be set.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct InputRef {
-    /// Content-addressed blob (e.g. `sha256:…`) the runner fetches from its store.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub blob: Option<String>,
-    /// A URL the runner can reach (git repo, internal artifact store, …).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub url: Option<String>,
-}
-
-impl InputRef {
-    /// A content-addressed blob reference.
-    pub fn blob(id: impl Into<String>) -> Self {
-        Self {
-            blob: Some(id.into()),
-            url: None,
-        }
-    }
-}
-
-/// Sandbox runtime knobs. Fields are executor/job-type specific and all optional;
-/// `extra` carries anything not modelled explicitly.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobRuntime {
-    /// Container image (Docker executor).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub image: Option<String>,
-    /// Memory cap (e.g. `512m`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub memory: Option<String>,
-    /// CPU cap (e.g. `0.5`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub cpus: Option<String>,
-    /// Network to join (e.g. `isolated`).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub network: Option<String>,
-    /// QEMU machine type (qemu-boot).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub machine: Option<String>,
-    /// QEMU target architecture (qemu-boot).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub arch: Option<String>,
-    /// Executor-specific extras not modelled above.
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub extra: BTreeMap<String, String>,
-}
-
-/// DAST collection settings for jobs that scan a web endpoint.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DastCollect {
-    /// Maximum crawl depth (kept shallow for ephemeral instances).
-    pub max_crawl_depth: u32,
-}
-
-/// What to collect from a run.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct JobCollect {
-    /// Run the industrial-protocol probe (Modbus/OPC-UA/EtherNet-IP).
-    #[serde(default)]
-    pub ics_probe: bool,
-    /// Run DAST against the provisioned/booted web endpoint.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub dast: Option<DastCollect>,
-    /// Run an active pentest.
-    #[serde(default)]
-    pub pentest: bool,
-    /// Collect an SBOM.
-    #[serde(default)]
-    pub sbom: bool,
-}
-
-/// A declarative dynamic-execution job the control plane enqueues and a Werkbank
-/// runner leases and executes.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct Job {
-    /// Unique job id (assigned by the control plane on enqueue).
-    pub id: String,
-    /// What kind of job this is.
-    #[serde(rename = "type")]
-    pub job_type: JobType,
-    /// Owning tenant.
-    pub tenant: String,
-    /// The onboarded target this job tests.
-    pub target_id: String,
-    /// The executor a runner must provide to run this job.
-    pub executor: Executor,
-    /// Runner capabilities this job requires (e.g. `arch=amd64`, `kvm=true`).
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub labels: Vec<String>,
-    /// Hard lifetime deadline for the whole job.
-    pub timeout_secs: u64,
-    /// Named input artifacts (e.g. `program`, `firmware`), by reference.
-    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
-    pub inputs: BTreeMap<String, InputRef>,
-    /// Sandbox runtime knobs.
-    #[serde(default)]
-    pub runtime: JobRuntime,
-    /// What to collect from the run.
-    #[serde(default)]
-    pub collect: JobCollect,
-}
-
-impl Job {
-    /// A `plc-provision` job: instantiate the control logic named `program` on an
-    /// ephemeral soft-PLC (Docker executor) and collect the ICS probe + DAST.
-    pub fn plc_provision(
-        id: impl Into<String>,
-        tenant: impl Into<String>,
-        target_id: impl Into<String>,
-        program: InputRef,
-        timeout_secs: u64,
-    ) -> Self {
-        let mut inputs = BTreeMap::new();
-        inputs.insert("program".to_string(), program);
-        Self {
-            id: id.into(),
-            job_type: JobType::PlcProvision,
-            tenant: tenant.into(),
-            target_id: target_id.into(),
-            executor: Executor::Docker,
-            labels: Vec::new(),
-            timeout_secs,
-            inputs,
-            runtime: JobRuntime::default(),
-            collect: JobCollect {
-                ics_probe: true,
-                dast: Some(DastCollect { max_crawl_depth: 2 }),
-                pentest: false,
-                sbom: false,
-            },
-        }
-    }
-}
-
-/// The outcome of running a job, posted back to the control plane. Findings and
-/// SBOM reuse the shared scanner types, so the control plane persists them
-/// unchanged. Submission is idempotent — keyed by [`JobResult::job_id`].
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct JobResult {
-    /// The job this result is for.
-    pub job_id: String,
-    /// Terminal status of the job.
-    pub status: Option<JobStatus>,
-    /// General scanner findings (e.g. ICS-probe findings).
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub findings: Vec<Finding>,
-    /// DAST findings from a web-endpoint scan.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub dast_findings: Vec<DastFinding>,
-    /// SBOM components collected from the run.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub sbom: Vec<SbomEntry>,
-    /// Error message when the job failed.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub error: Option<String>,
-    /// Captured execution log (truncated by the runner).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub logs: Option<String>,
-    /// When execution started on the runner.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub started_at: Option<DateTime<Utc>>,
-    /// When execution finished.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub finished_at: Option<DateTime<Utc>>,
-}
-
-impl JobResult {
-    /// A successful result for a job.
-    pub fn succeeded(job_id: impl Into<String>) -> Self {
-        Self {
-            job_id: job_id.into(),
-            status: Some(JobStatus::Succeeded),
-            ..Default::default()
-        }
-    }
-
-    /// A failed result carrying an error message.
-    pub fn failed(job_id: impl Into<String>, error: impl Into<String>) -> Self {
-        Self {
-            job_id: job_id.into(),
-            status: Some(JobStatus::Failed),
-            error: Some(error.into()),
-            ..Default::default()
-        }
-    }
-}
-
-/// A queued job as persisted by the control plane (WB-02): the [`Job`] contract
-/// plus the queue bookkeeping — status, lease ownership, attempt count, and the
-/// eventual result. The runner never sees this record; on lease it receives a
-/// [`LeasedJob`] (the job plus a token it presents to heartbeat/complete).
-///
-/// Timestamps persist as native BSON dates so the queue's range queries (lease
-/// FIFO by `created_at`, visibility-timeout sweep by `lease_expires_at`) compare
-/// correctly.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct JobRecord {
-    /// The job to run.
-    pub job: Job,
-    /// Current queue state.
-    pub status: JobStatus,
-    /// The lease token held by the current runner (proves lease ownership).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub lease_token: Option<String>,
-    /// Id of the runner holding the lease.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub leased_by: Option<String>,
-    /// When the current lease expires — the visibility timeout after which a
-    /// crashed runner's job is swept back to `queued`.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub lease_expires_at: Option<DateTime<Utc>>,
-    /// Last heartbeat from the runner.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub heartbeat_at: Option<DateTime<Utc>>,
-    /// How many times the job has been leased (incremented on each lease).
-    #[serde(default)]
-    pub attempts: u32,
-    /// Set when the control plane requests cancellation; the runner sees it on
-    /// its next heartbeat and aborts.
-    #[serde(default)]
-    pub cancel_requested: bool,
-    /// The result, once the job reaches a terminal state.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub result: Option<JobResult>,
-    /// When the job was enqueued.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub created_at: DateTime<Utc>,
-    /// Last modification.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub updated_at: DateTime<Utc>,
-}
-
-impl JobRecord {
-    /// A freshly-enqueued (`queued`) record for a job.
-    pub fn queued(job: Job, now: DateTime<Utc>) -> Self {
-        Self {
-            job,
-            status: JobStatus::Queued,
-            lease_token: None,
-            leased_by: None,
-            lease_expires_at: None,
-            heartbeat_at: None,
-            attempts: 0,
-            cancel_requested: false,
-            result: None,
-            created_at: now,
-            updated_at: now,
-        }
-    }
-}
-
-/// A job handed to a runner on lease: what to run plus the token the runner must
-/// present to heartbeat and complete it.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LeasedJob {
-    /// The job to execute.
-    pub job: Job,
-    /// The lease token proving ownership (opaque to the runner).
-    pub lease_token: String,
-}
-
-/// The runner's view of a heartbeat: whether the control plane has asked the job
-/// to stop. `None` from the queue means the lease was lost (token mismatch or the
-/// job already terminal) and the runner should abandon the work.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct HeartbeatAck {
-    /// The control plane requested cancellation — the runner should tear down.
-    pub cancelled: bool,
-}
-
-// --- Runner ↔ control-plane transport (the pull API wire types) ---------------
-// Shared so the runner (client) and the control plane (server) agree on shapes.
-
-/// Runner → control plane: lease the oldest runnable job for this runner.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct LeaseRequest {
-    /// The tenant queue to lease from.
-    pub tenant: String,
-    /// The runner id (advertised for attribution).
-    pub runner_id: String,
-    /// The executor this runner provides.
-    pub executor: Executor,
-    /// The capability labels this runner advertises.
-    #[serde(default)]
-    pub labels: Vec<String>,
-    /// Requested lease lifetime (the visibility timeout), in seconds.
-    pub lease_ttl_secs: u64,
-}
-
-/// Runner → control plane: prove lease ownership and extend it.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct HeartbeatRequest {
-    /// The tenant queue.
-    pub tenant: String,
-    /// The job being worked.
-    pub job_id: String,
-    /// The lease token from the [`LeasedJob`].
-    pub lease_token: String,
-    /// Lease lifetime to extend to, in seconds.
-    pub lease_ttl_secs: u64,
-}
-
-/// Runner → control plane: record a job's terminal result.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CompleteRequest {
-    /// The tenant queue.
-    pub tenant: String,
-    /// The job being completed.
-    pub job_id: String,
-    /// The lease token proving ownership.
-    pub lease_token: String,
-    /// The result to record.
-    pub result: JobResult,
-}
-
-/// Control plane → runner: whether the completion was recorded (false if the
-/// lease was already lost — token mismatch or the job had become terminal).
-#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
-pub struct CompleteResponse {
-    /// Whether the result was recorded.
-    pub recorded: bool,
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn job_round_trips_through_json() {
-        let job = Job::plc_provision("job_1", "acme", "64f0aa", InputRef::blob("sha256:abc"), 180);
-        let json = serde_json::to_string(&job).expect("serialize");
-        let back: Job = serde_json::from_str(&json).expect("deserialize");
-        assert_eq!(job, back);
-        // Enum wire forms are the kebab/lowercase the contract documents.
-        assert!(json.contains("\"type\":\"plc-provision\""));
-        assert!(json.contains("\"executor\":\"docker\""));
-    }
-
-    #[test]
-    fn parses_the_design_doc_plc_provision_toml() {
-        // The exact shape from docs/DESIGN.md §5 (wrapped in a [job] table).
-        #[derive(Deserialize)]
-        struct JobFile {
-            job: Job,
-        }
-        let src = r#"
-            [job]
-            id = "job_01H"
-            type = "plc-provision"
-            tenant = "acme"
-            target_id = "64f0"
-            executor = "docker"
-            labels = ["arch=amd64"]
-            timeout_secs = 180
-
-            [job.inputs]
-            program = { blob = "sha256:deadbeef" }
-
-            [job.runtime]
-            image = "openplc:latest"
-            memory = "512m"
-            cpus = "0.5"
-            network = "isolated"
-
-            [job.collect]
-            ics_probe = true
-            dast = { max_crawl_depth = 2 }
-        "#;
-        let file: JobFile = toml::from_str(src).expect("parse job toml");
-        let job = file.job;
-        assert_eq!(job.job_type, JobType::PlcProvision);
-        assert_eq!(job.executor, Executor::Docker);
-        assert_eq!(job.labels, vec!["arch=amd64".to_string()]);
-        assert_eq!(
-            job.inputs.get("program").and_then(|i| i.blob.as_deref()),
-            Some("sha256:deadbeef")
-        );
-        assert_eq!(job.runtime.image.as_deref(), Some("openplc:latest"));
-        assert!(job.collect.ics_probe);
-        assert_eq!(job.collect.dast.map(|d| d.max_crawl_depth), Some(2));
-    }
-
-    #[test]
-    fn qemu_boot_runtime_fields_parse() {
-        #[derive(Deserialize)]
-        struct JobFile {
-            job: Job,
-        }
-        let src = r#"
-            [job]
-            id = "j2"
-            type = "qemu-boot"
-            tenant = "acme"
-            target_id = "t"
-            executor = "docker"
-            labels = ["kvm=true"]
-            timeout_secs = 600
-            [job.inputs]
-            firmware = { blob = "sha256:cafe" }
-            [job.runtime]
-            machine = "virt"
-            arch = "arm"
-            memory = "1g"
-        "#;
-        let file: JobFile = toml::from_str(src).expect("parse");
-        assert_eq!(file.job.job_type, JobType::QemuBoot);
-        assert_eq!(file.job.runtime.arch.as_deref(), Some("arm"));
-        assert_eq!(
-            file.job
-                .inputs
-                .get("firmware")
-                .and_then(|i| i.blob.as_deref()),
-            Some("sha256:cafe")
-        );
-    }
-
-    #[test]
-    fn status_terminality() {
-        assert!(JobStatus::Succeeded.is_terminal());
-        assert!(JobStatus::Expired.is_terminal());
-        assert!(!JobStatus::Queued.is_terminal());
-        assert!(!JobStatus::Running.is_terminal());
-    }
-
-    #[test]
-    fn result_constructors() {
-        assert_eq!(JobResult::succeeded("j").status, Some(JobStatus::Succeeded));
-        let f = JobResult::failed("j", "boom");
-        assert_eq!(f.status, Some(JobStatus::Failed));
-        assert_eq!(f.error.as_deref(), Some("boom"));
-    }
-}

compliance-core/src/scan_matrix.rs

@@ -14,12 +14,8 @@ use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
 pub enum ArtifactRequirement {
     /// Source code — a git repo or a source archive.
     Code,
-    /// A reachable running instance (any live URL / endpoint, scheme-agnostic —
+    /// A reachable running instance (live URL / endpoint).
-    /// e.g. the ICS probe works off the host:port of a modbus:// or http:// ref).
     RunningUrl,
-    /// A reachable **web** endpoint — a live URL with an http(s) scheme. DAST is
-    /// an HTTP crawler, so a modbus:// / opc.tcp:// endpoint does not satisfy it.
-    HttpUrl,
     /// A firmware image / binary blob.
     Firmware,
     /// A PLC project (PLCopen XML or Structured Text).
@@ -138,7 +134,7 @@ fn sast_umbrella() -> Vec<ScanRule> {
 /// The rule set for a target type. Scans that are never applicable to a type are
 /// simply absent (e.g. DAST is not listed for a PLC target).
 pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
-    use ArtifactRequirement::{Firmware, HttpUrl, Mobile, Plc, RunningUrl};
+    use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
     match target_type {
         TargetType::WebApp | TargetType::BackendService => {
             let mut r = sast_umbrella();
@@ -146,7 +142,7 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
                 ScanType::Dast,
                 true,
                 "Dynamic scan of the running endpoint",
-                HttpUrl,
+                RunningUrl,
             ));
             r
         }
@@ -207,62 +203,16 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
                 ScanType::Dast,
                 false,
                 "Dynamic scan of exposed network services (if any)",
-                HttpUrl,
+                RunningUrl,
             ));
             r
         }
-        TargetType::PlcSps => {
+        TargetType::PlcSps => vec![ScanRule::new(
-            // A PLC/SPS device is a composite: the control application *and* the
+            ScanType::PlcControlLogic,
-            // device it runs on (firmware/OS + reachable runtime services). The
+            true,
-            // control-logic scan runs on the PLC project; the firmware and DAST
+            "Control-logic security rules over the PLC program",
-            // scans light up only when a firmware image / running endpoint is
+            Plc,
-            // attached (e.g. a CODESYS runtime on a Yocto image with WebVisu).
+        )],
-            // Firmware-image SBOM/CVE *execution* is shared with the firmware
-            // families and tracked in #151/#128; DAST over a WebVisu/OPC-UA
-            // endpoint uses the existing DAST path.
-            vec![
-                ScanRule::new(
-                    ScanType::PlcControlLogic,
-                    true,
-                    "Control-logic security rules over the PLC program",
-                    Plc,
-                ),
-                // Device-level scans are offered but opt-in (default-off): they
-                // apply only when a firmware image is attached, and firmware-image
-                // SBOM/CVE *execution* is shared with the firmware families and
-                // still landing (#151/#128), so they must not silently auto-run.
-                ScanRule::new(
-                    ScanType::FirmwareStatic,
-                    false,
-                    "Static analysis of the device firmware image (OS + runtime)",
-                    Firmware,
-                ),
-                ScanRule::new(
-                    ScanType::Sbom,
-                    false,
-                    "SBOM from the device firmware image (OS packages + CODESYS runtime)",
-                    Firmware,
-                ),
-                ScanRule::new(
-                    ScanType::Cve,
-                    false,
-                    "Match device firmware components against known CVEs",
-                    Firmware,
-                ),
-                ScanRule::new(
-                    ScanType::Dast,
-                    false,
-                    "Dynamic scan of the running device (WebVisu / exposed services)",
-                    HttpUrl,
-                ),
-                ScanRule::new(
-                    ScanType::IcsProbe,
-                    false,
-                    "Probe the running device over industrial protocols (Modbus/TCP, …)",
-                    RunningUrl,
-                ),
-            ]
-        }
     }
 }
 
@@ -279,9 +229,6 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
             | TargetType::AndroidApp
             | TargetType::IosApp
             | TargetType::EmbeddedLinuxYocto
-            // A PLC/SPS device exposes reachable runtime services (WebVisu, OPC UA,
-            // the CODESYS programming protocol), so an active pentest applies.
-            | TargetType::PlcSps
     )
 }
 
@@ -289,9 +236,7 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
 fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
     match req {
         ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
-        ArtifactRequirement::RunningUrl | ArtifactRequirement::HttpUrl => {
+        ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
-            Some(ArtifactKind::LiveUrl)
-        }
         ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
         ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
         ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
@@ -300,29 +245,13 @@ fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
     }
 }
 
-/// Whether a live-URL reference is an http(s) web endpoint (vs. an industrial
-/// endpoint like `modbus://` / `opc.tcp://`, which DAST cannot crawl).
-fn is_http_url(source_ref: &str) -> bool {
-    let s = source_ref.trim();
-    s.starts_with("http://") || s.starts_with("https://")
-}
-
 /// Whether the target carries an artifact that satisfies the requirement.
 fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
     match req {
         ArtifactRequirement::Code => target.code_artifact().is_some(),
         ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
-        ArtifactRequirement::HttpUrl => target
-            .artifacts
-            .iter()
-            .any(|a| a.kind == ArtifactKind::LiveUrl && is_http_url(&a.source_ref)),
         ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
-        // A PLC project artifact, or a code artifact (git repo / source archive)
+        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
-        // holding the control logic as PLCopen XML / ST exports — the common way
-        // CODESYS projects are version-controlled.
-        ArtifactRequirement::Plc => {
-            target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
-        }
         ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
         ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
         ArtifactRequirement::Any => true,
@@ -339,10 +268,6 @@ pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
             let required_artifact = representative_kind(rule.requires);
             let blocked_reason = if satisfied {
                 None
-            } else if rule.requires == ArtifactRequirement::HttpUrl {
-                // A live URL may be present but non-HTTP (e.g. modbus://): be
-                // specific so the user knows DAST needs a web endpoint.
-                Some("no http(s) live URL — DAST needs a web endpoint".to_string())
             } else {
                 Some(match required_artifact {
                     Some(kind) => format!("no {kind} artifact provided"),
@@ -415,124 +340,22 @@ mod tests {
     }
 
     #[test]
-    fn plc_control_logic_is_default_on_and_device_scans_block_without_artifacts() {
+    fn plc_offers_only_control_logic() {
-        // A PLC project alone: control-logic runs; the device-level scans are
-        // offered but blocked until a firmware image / running endpoint is added.
         let t = target_with(
             TargetType::PlcSps,
             vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
         );
         let opts = applicable_scans(&t);
-        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert_eq!(opts.len(), 1);
-        assert!(plc.default_on && plc.blocked_reason.is_none());
+        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
-        for scan in [ScanType::FirmwareStatic, ScanType::Sbom, ScanType::Cve] {
+        assert!(opts[0].default_on);
-            let o = option(&opts, scan).expect("device scan offered");
-            assert!(
-                !o.default_on,
-                "{scan} must not pre-select without a firmware image"
-            );
-            assert!(o.blocked_reason.is_some());
-        }
-        let dast = option(&opts, ScanType::Dast).expect("dast offered");
-        assert!(!dast.default_on);
-        assert!(dast.blocked_reason.is_some());
-    }
-
-    #[test]
-    fn plc_control_logic_is_satisfied_by_a_git_repo() {
-        // A CODESYS project version-controlled in git (PLCopen XML / ST exports),
-        // no uploaded PlcProject artifact.
-        let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
-        let opts = applicable_scans(&t);
-        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
-        assert!(
-            plc.default_on && plc.blocked_reason.is_none(),
-            "a git repo should satisfy PLC control-logic"
-        );
-    }
-
-    #[test]
-    fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
-        // A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.
-        let t = target_with(
-            TargetType::PlcSps,
-            vec![
-                Artifact::plc_project("p.xml", PlcFormat::PlcopenXml),
-                Artifact::firmware_image("device.img"),
-                Artifact::live_url("http://plc.local/webvisu"),
-            ],
-        );
-        let opts = applicable_scans(&t);
-        for scan in [
-            ScanType::PlcControlLogic,
-            ScanType::FirmwareStatic,
-            ScanType::Sbom,
-            ScanType::Cve,
-        ] {
-            let o = option(&opts, scan).expect("scan offered");
-            assert!(o.blocked_reason.is_none(), "{scan} should be unblocked");
-        }
-        // Control-logic auto-runs; the device-level scans are unblocked but opt-in
-        // (default-off) until firmware-image execution lands (#151/#128).
-        assert!(option(&opts, ScanType::PlcControlLogic).unwrap().default_on);
-        assert!(!option(&opts, ScanType::Sbom).unwrap().default_on);
-        assert!(!option(&opts, ScanType::Dast).unwrap().default_on);
-        assert!(option(&opts, ScanType::Dast)
-            .unwrap()
-            .blocked_reason
-            .is_none());
-    }
-
-    #[test]
-    fn plc_with_modbus_url_offers_ics_probe_but_blocks_dast() {
-        // A soft-PLC reachable only over Modbus/TCP (no WebVisu). The ICS probe
-        // is applicable (it works off host:port), but DAST — an HTTP crawler —
-        // must be blocked so it isn't offered/run against a non-web endpoint.
-        let t = target_with(
-            TargetType::PlcSps,
-            vec![Artifact::live_url("modbus://plc-sim:502")],
-        );
-        let opts = applicable_scans(&t);
-        let ics = option(&opts, ScanType::IcsProbe).expect("ics probe offered");
-        assert!(
-            ics.blocked_reason.is_none(),
-            "ICS probe should be unblocked for a modbus:// endpoint"
-        );
-        assert!(!ics.default_on, "ICS probe stays opt-in (default-off)");
-        let dast = option(&opts, ScanType::Dast).expect("dast listed");
-        assert!(
-            dast.blocked_reason.is_some(),
-            "DAST must be blocked without an http(s) endpoint"
-        );
-        assert!(!dast.default_on);
-    }
-
-    #[test]
-    fn plc_with_http_webvisu_offers_both_dast_and_ics_probe() {
-        // A PLC exposing a WebVisu over HTTP: both DAST (web) and the ICS probe
-        // (OT ports on the same host) are applicable.
-        let t = target_with(
-            TargetType::PlcSps,
-            vec![Artifact::live_url("http://plc.local/webvisu")],
-        );
-        let opts = applicable_scans(&t);
-        assert!(option(&opts, ScanType::Dast)
-            .expect("dast offered")
-            .blocked_reason
-            .is_none());
-        assert!(option(&opts, ScanType::IcsProbe)
-            .expect("ics probe offered")
-            .blocked_reason
-            .is_none());
     }
 
     #[test]
     fn pentest_support_matches_reachable_families() {
         assert!(supports_pentest(TargetType::WebApp));
         assert!(supports_pentest(TargetType::BackendService));
-        assert!(supports_pentest(TargetType::EmbeddedLinuxYocto));
+        assert!(!supports_pentest(TargetType::PlcSps));
-        // A PLC/SPS device is network-reachable (WebVisu / OPC UA / 11740).
-        assert!(supports_pentest(TargetType::PlcSps));
         assert!(!supports_pentest(TargetType::FirmwareBareMetal));
         assert!(!supports_pentest(TargetType::DesktopApp));
     }

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -78,16 +78,8 @@ pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
                 .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
         }
         "live_url" => {
-            // http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
+            let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
-            // devices probed by the ICS probe (e.g. modbus://plc:502).
+            (!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
-            let ok = (s.starts_with("https://")
-                || s.starts_with("http://")
-                || s.starts_with("modbus://")
-                || s.starts_with("opc.tcp://"))
-                && no_space;
-            (!ok).then(|| {
-                "Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
-            })
         }
         "container_image" => {
             (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
@@ -138,37 +130,6 @@ pub async fn create_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
-/// Upload a file artifact (PLC project, firmware image, source archive, mobile
-/// package) to a target — proxied to the agent as multipart.
-#[server]
-pub async fn upload_target_artifact(
-    id: String,
-    kind: String,
-    plc_format: Option<String>,
-    filename: String,
-    bytes: Vec<u8>,
-) -> Result<TargetResponse, ServerFnError> {
-    let mut form = reqwest::multipart::Form::new().text("kind", kind).part(
-        "file",
-        reqwest::multipart::Part::bytes(bytes).file_name(filename),
-    );
-    if let Some(pf) = plc_format {
-        form = form.text("plc_format", pf);
-    }
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/artifacts/upload"),
-    )
-    .await?
-    .multipart(form)
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
 /// Update a target's name / type / artifacts (dashboard editor).
 #[server]
 pub async fn update_target(
@@ -204,28 +165,6 @@ pub async fn update_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
-/// Enable specific opt-in scans on a target by setting `scan_config.enabled_scans`.
-/// `scans` are serde scan-type names (lowercase, no underscores — e.g. `icsprobe`).
-#[server]
-pub async fn enable_target_scans(
-    id: String,
-    scans: Vec<String>,
-) -> Result<TargetResponse, ServerFnError> {
-    let body = serde_json::json!({ "scan_config": { "enabled_scans": scans } });
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::PATCH,
-        &format!("/api/v1/targets/{id}"),
-    )
-    .await?
-    .json(&body)
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
 /// Run kind-based classification on a target.
 #[server]
 pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {

compliance-dashboard/src/infrastructure/server.rs

@@ -1,4 +1,3 @@
-use axum::extract::DefaultBodyLimit;
 use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
@@ -67,9 +66,6 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 // Webhook proxy: forward to agent (no auth required)
                 .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                 .serve_dioxus_application(ServeConfig::new(), app)
-                // Allow large artifact uploads through the upload server function
-                // (PLC .projectarchive, firmware, mobile) — default is 2 MiB.
-                .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
                 .layer(Extension(PendingOAuthStore::default()))
                 .layer(middleware::from_fn(require_auth))
                 .layer(Extension(server_state))

compliance-dashboard/src/pages/onboarding.rs

@@ -2,8 +2,8 @@ use dioxus::prelude::*;
 
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::onboarding::{
-    create_target, detect_target, enable_target_scans, fetch_applicable_scans, trigger_target_scan,
+    create_target, detect_target, fetch_applicable_scans, trigger_target_scan,
-    upload_target_artifact, validate_artifact_ref, validate_target_name, ArtifactInputDto,
+    validate_artifact_ref, validate_target_name, ArtifactInputDto,
 };
 
 /// (value, label, one-line description) for the 9 target families.
@@ -41,23 +41,6 @@ const ARTIFACT_KINDS: &[(&str, &str)] = &[
 
 const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
 
-/// Artifact kinds provided as an uploaded file (rather than a URL/text ref).
-fn is_file_kind(kind: &str) -> bool {
-    matches!(
-        kind,
-        "plc_project" | "firmware_image" | "source_archive" | "mobile_package"
-    )
-}
-
-/// A file artifact staged in the wizard, uploaded after the target is created.
-#[derive(Clone, PartialEq)]
-struct PendingFile {
-    kind: String,
-    plc_format: Option<String>,
-    filename: String,
-    bytes: Vec<u8>,
-}
-
 /// One row in the applicable-scans list on the success step.
 #[component]
 fn ScanRow(scan: serde_json::Value) -> Element {
@@ -125,10 +108,6 @@ pub fn OnboardingPage() -> Element {
     let mut new_kind = use_signal(|| "git_repo".to_string());
     let mut new_source = use_signal(String::new);
     let mut new_branch = use_signal(|| "main".to_string());
-    // File-upload artifacts (PLC project, firmware image, ...).
-    let mut new_plc_format = use_signal(|| "plcopen_xml".to_string());
-    let mut new_file = use_signal(|| Option::<(String, Vec<u8>)>::None);
-    let mut pending_files = use_signal(Vec::<PendingFile>::new);
 
     // Create + result state.
     let mut creating = use_signal(|| false);
@@ -137,35 +116,11 @@ pub fn OnboardingPage() -> Element {
     let mut suggested = use_signal(|| Option::<String>::None);
     let mut created_id = use_signal(|| Option::<String>::None);
     let mut scan_msg = use_signal(|| Option::<String>::None);
-    // Opt-in scans (default-off but unblocked) the user ticks to enable before
-    // running — stored as serde scan-type names (lowercase, no underscores).
-    let mut enabled_extra = use_signal(Vec::<String>::new);
 
     let step_now = step();
     let name_error = validate_target_name(&name());
     let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
-    let has_artifacts = !artifacts().is_empty() || !pending_files().is_empty();
+    let has_artifacts = !artifacts().is_empty();
-    // Opt-in scans: applicable + unblocked, but default-off (e.g. the ICS probe).
-    // The user ticks these to enable them before the first run. Each entry is
-    // (display name for the label, serde scan-type name for the enable call —
-    // lowercase, no underscores, matching ScanType's rename_all = "lowercase").
-    let optin_scans: Vec<(String, String)> = scans()
-        .iter()
-        .filter_map(|s| {
-            let unblocked = s.get("blocked_reason").and_then(|v| v.as_str()).is_none();
-            let default_on = s
-                .get("default_on")
-                .and_then(|v| v.as_bool())
-                .unwrap_or(false);
-            if unblocked && !default_on {
-                let display = s.get("scan").and_then(|v| v.as_str())?.to_string();
-                let serde_name = display.replace('_', "");
-                Some((display, serde_name))
-            } else {
-                None
-            }
-        })
-        .collect();
     // Live validation of the artifact reference being typed (empty = no error yet).
     let new_source_error = if new_source().is_empty() {
         None
@@ -238,36 +193,6 @@ pub fn OnboardingPage() -> Element {
             // ---- Step 1: artifacts ----
             if step_now == 1 {
                 div { class: "card-header", "Attach artifacts" }
-                if target_type() == "plc_sps" {
-                    div {
-                        style: "margin: 12px 16px 0; padding: 12px 14px; border-left: 3px solid var(--accent, #3b82f6); background: var(--surface-2, rgba(59,130,246,0.08)); font-size: 0.88em; line-height: 1.55;",
-                        div { style: "font-weight: 600; margin-bottom: 4px;", "CODESYS / PLC projects" }
-                        "Attach a "
-                        b { "PLC project" }
-                        " (PLCopen XML / ST, or a .projectarchive), or a "
-                        b { "Git repository" }
-                        " of exported source — every scan is then just a pull."
-                        ul { style: "margin: 6px 0 0; padding-left: 18px;",
-                            li {
-                                b { "Control-logic SAST" }
-                                " — commit "
-                                b { "PLCopen XML exports" }
-                                " (Project → Export PLCopenXML) or raw .st; ST and graphical FBD/LD are both analyzed."
-                            }
-                            li {
-                                b { "Library + runtime SBOM" }
-                                " — include the "
-                                b { ".projectarchive" }
-                                "; PLCopen XML alone carries no libraries."
-                            }
-                            li {
-                                "Avoid committing only the binary "
-                                code { ".project" }
-                                " — it can't be parsed and doesn't diff."
-                            }
-                        }
-                    }
-                }
                 div { style: "padding: 16px;",
                     div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
                         div { class: "form-group", style: "margin: 0;",
@@ -280,143 +205,49 @@ pub fn OnboardingPage() -> Element {
                                 }
                             }
                         }
-                        if is_file_kind(&new_kind()) {
+                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                            label { "Reference (URL / path / text)" }
-                                label { "File" }
+                            input {
-                                input {
+                                r#type: "text",
-                                    r#type: "file",
+                                placeholder: "https://git.example.com/acme.git",
-                                    onchange: move |evt| {
+                                value: "{new_source}",
-                                        let Some(file) = evt.files().into_iter().next() else { return; };
+                                oninput: move |e| new_source.set(e.value()),
-                                        let name = file.name();
-                                        // Auto-detect the PLC format from the file extension.
-                                        let lname = name.to_ascii_lowercase();
-                                        if lname.ends_with(".projectarchive") || lname.ends_with(".project") {
-                                            new_plc_format.set("project_archive".to_string());
-                                        } else if lname.ends_with(".xml") || lname.ends_with(".plcopen") {
-                                            new_plc_format.set("plcopen_xml".to_string());
-                                        } else if lname.ends_with(".st") || lname.ends_with(".exp") || lname.ends_with(".scl") {
-                                            new_plc_format.set("structured_text".to_string());
-                                        }
-                                        spawn(async move {
-                                            if let Ok(bytes) = file.read_bytes().await {
-                                                new_file.set(Some((name, bytes.to_vec())));
-                                            }
-                                        });
-                                    },
-                                }
                             }
-                            if new_kind() == "plc_project" {
+                        }
-                                div { class: "form-group", style: "margin: 0;",
+                        if new_kind() == "git_repo" {
-                                    label { "Format" }
+                            div { class: "form-group", style: "margin: 0;",
-                                    select {
+                                label { "Branch" }
-                                        value: "{new_plc_format}",
-                                        oninput: move |e| new_plc_format.set(e.value()),
-                                        option {
-                                            value: "plcopen_xml",
-                                            selected: new_plc_format() == "plcopen_xml",
-                                            "PLCopen XML",
-                                        }
-                                        option {
-                                            value: "structured_text",
-                                            selected: new_plc_format() == "structured_text",
-                                            "Structured Text",
-                                        }
-                                        option {
-                                            value: "project_archive",
-                                            selected: new_plc_format() == "project_archive",
-                                            "Project archive (.projectarchive)",
-                                        }
-                                    }
-                                }
-                            }
-                            button {
-                                class: "btn btn-secondary",
-                                disabled: new_file().is_none(),
-                                onclick: move |_| {
-                                    if let Some((fname, data)) = new_file() {
-                                        let kind = new_kind();
-                                        let plc_format = if kind == "plc_project" {
-                                            Some(new_plc_format())
-                                        } else {
-                                            None
-                                        };
-                                        pending_files.write().push(PendingFile {
-                                            kind,
-                                            plc_format,
-                                            filename: fname,
-                                            bytes: data,
-                                        });
-                                        new_file.set(None);
-                                    }
-                                },
-                                "+ Add file"
-                            }
-                        } else {
-                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                                label { "Reference (URL / path / text)" }
                                 input {
                                     r#type: "text",
-                                    placeholder: "https://git.example.com/acme.git",
+                                    value: "{new_branch}",
-                                    value: "{new_source}",
+                                    oninput: move |e| new_branch.set(e.value()),
-                                    oninput: move |e| new_source.set(e.value()),
                                 }
                             }
-                            if new_kind() == "git_repo" {
+                        }
-                                div { class: "form-group", style: "margin: 0;",
+                        button {
-                                    label { "Branch" }
+                            class: "btn btn-secondary",
-                                    input {
+                            disabled: new_source().trim().is_empty() || new_source_error.is_some(),
-                                        r#type: "text",
+                            onclick: move |_| {
-                                        value: "{new_branch}",
+                                let kind = new_kind();
-                                        oninput: move |e| new_branch.set(e.value()),
+                                if !new_source().trim().is_empty()
-                                    }
+                                    && validate_artifact_ref(&kind, &new_source()).is_none()
+                                {
+                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
+                                    artifacts.write().push(ArtifactInputDto {
+                                        kind,
+                                        source_ref: new_source(),
+                                        branch,
+                                        plc_format: None,
+                                    });
+                                    new_source.set(String::new());
                                 }
-                            }
+                            },
-                            button {
+                            "+ Add"
-                                class: "btn btn-secondary",
-                                disabled: new_source().trim().is_empty() || new_source_error.is_some(),
-                                onclick: move |_| {
-                                    let kind = new_kind();
-                                    if !new_source().trim().is_empty()
-                                        && validate_artifact_ref(&kind, &new_source()).is_none()
-                                    {
-                                        let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
-                                        artifacts.write().push(ArtifactInputDto {
-                                            kind,
-                                            source_ref: new_source(),
-                                            branch,
-                                            plc_format: None,
-                                        });
-                                        new_source.set(String::new());
-                                    }
-                                },
-                                "+ Add"
-                            }
                         }
                     }
-                    if is_file_kind(&new_kind()) {
+                    if let Some(err) = new_source_error.clone() {
-                        if let Some((fname, data)) = new_file() {
-                            div { style: "font-size: 0.85em; opacity: 0.7; margin-top: 6px;",
-                                "Selected: {fname} ({data.len()} bytes)"
-                            }
-                        }
-                    } else if let Some(err) = new_source_error.clone() {
                         div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
                     }
-                    // Staged file artifacts (uploaded after the target is created).
-                    for (i, pf) in pending_files().iter().enumerate() {
-                        div {
-                            style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-top: 6px;",
-                            span {
-                                span { style: "opacity: 0.7;", "{kind_label(&pf.kind)} (file): " }
-                                "{pf.filename} ({pf.bytes.len()} bytes)"
-                            }
-                            button {
-                                class: "btn btn-ghost-danger btn-sm",
-                                onclick: move |_| { pending_files.write().remove(i); },
-                                "Remove"
-                            }
-                        }
-                    }
 
                     div { style: "margin-top: 16px;",
                         if has_artifacts {
@@ -480,39 +311,6 @@ pub fn OnboardingPage() -> Element {
                             ScanRow { scan: s }
                         }
                     }
-                    if !optin_scans.is_empty() {
-                        div { style: "margin-top: 12px; padding: 10px; border: 1px dashed var(--border, #ccc); border-radius: 6px;",
-                            div { style: "font-weight: 600; margin-bottom: 6px;", "Enable opt-in scans" }
-                            div { style: "opacity: 0.7; font-size: 0.85em; margin-bottom: 8px;",
-                                "These are applicable but off by default (they touch a live device). Tick to enable before running."
-                            }
-                            for pair in optin_scans.clone() {
-                                {
-                                    let (display, serde_name) = pair;
-                                    let cb_name = serde_name.clone();
-                                    rsx! {
-                                        label {
-                                            style: "display: flex; gap: 6px; align-items: center; margin-top: 4px;",
-                                            input {
-                                                r#type: "checkbox",
-                                                checked: enabled_extra().contains(&serde_name),
-                                                onchange: move |_| {
-                                                    let mut v = enabled_extra();
-                                                    if let Some(p) = v.iter().position(|x| x == &cb_name) {
-                                                        v.remove(p);
-                                                    } else {
-                                                        v.push(cb_name.clone());
-                                                    }
-                                                    enabled_extra.set(v);
-                                                },
-                                            }
-                                            "Enable {display}"
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
                     if let Some(msg) = scan_msg() {
                         div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
                     }
@@ -521,21 +319,8 @@ pub fn OnboardingPage() -> Element {
                             class: "btn btn-primary",
                             onclick: move |_| {
                                 if let Some(id) = created_id() {
-                                    let extra = enabled_extra();
                                     scan_msg.set(Some("Scan triggered...".to_string()));
                                     spawn(async move {
-                                        // Persist any ticked opt-in scans first, so the
-                                        // agent's build_scan_plan includes them this run.
-                                        if !extra.is_empty() {
-                                            if let Err(e) =
-                                                enable_target_scans(id.clone(), extra).await
-                                            {
-                                                scan_msg.set(Some(format!(
-                                                    "Failed to enable opt-in scans: {e}"
-                                                )));
-                                                return;
-                                            }
-                                        }
                                         match trigger_target_scan(id).await {
                                             Ok(_) => scan_msg.set(Some(
                                                 "Scan started — findings will appear as it runs.".to_string(),
@@ -555,8 +340,6 @@ pub fn OnboardingPage() -> Element {
                                 target_type.set(String::new());
                                 description.set(String::new());
                                 artifacts.write().clear();
-                                pending_files.write().clear();
-                                new_file.set(None);
                                 scans.write().clear();
                                 suggested.set(None);
                                 created_id.set(None);
@@ -595,7 +378,6 @@ pub fn OnboardingPage() -> Element {
                             let tt = target_type();
                             let desc = description();
                             let arts = artifacts();
-                            let files = pending_files();
                             let d = if desc.trim().is_empty() { None } else { Some(desc) };
                             creating.set(true);
                             error.set(None);
@@ -610,23 +392,6 @@ pub fn OnboardingPage() -> Element {
                                             .map(String::from);
                                         if let Some(id) = id {
                                             created_id.set(Some(id.clone()));
-                                            // Upload staged file artifacts now that the target exists.
-                                            for pf in files {
-                                                let fname = pf.filename.clone();
-                                                if let Err(e) = upload_target_artifact(
-                                                    id.clone(),
-                                                    pf.kind,
-                                                    pf.plc_format,
-                                                    pf.filename,
-                                                    pf.bytes,
-                                                )
-                                                .await
-                                                {
-                                                    error.set(Some(format!(
-                                                        "Upload failed for {fname}: {e}"
-                                                    )));
-                                                }
-                                            }
                                             if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
                                                 scans.set(sc.data.scans);
                                             }

compliance-dashboard/src/pages/targets.rs

@@ -232,7 +232,7 @@ pub fn TargetsPage() -> Element {
                                 value: "{edit_type}",
                                 oninput: move |e| edit_type.set(e.value()),
                                 for (v, l) in TARGET_TYPES.iter().copied() {
-                                    option { value: "{v}", selected: edit_type() == v, "{l}" }
+                                    option { value: "{v}", "{l}" }
                                 }
                             }
                         }
@@ -257,7 +257,7 @@ pub fn TargetsPage() -> Element {
                                     value: "{e_kind}",
                                     oninput: move |e| e_kind.set(e.value()),
                                     for (v, l) in ARTIFACT_KINDS.iter().copied() {
-                                        option { value: "{v}", selected: e_kind() == v, "{l}" }
+                                        option { value: "{v}", "{l}" }
                                     }
                                 }
                             }

compliance-mcp/src/server.rs

@@ -4,7 +4,7 @@ use rmcp::{
 
 use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
-use crate::tools::{dast, findings, oscal, pentest, sbom};
+use crate::tools::{dast, findings, pentest, sbom};
 
 pub struct ComplianceMcpServer {
     pool: DatabasePool,
@@ -68,17 +68,6 @@ impl ComplianceMcpServer {
         findings::findings_summary(&db, params).await
     }
 
-    #[tool(
-        description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
-    )]
-    async fn oscal_assessment(
-        &self,
-        Parameters(params): Parameters<oscal::OscalAssessmentParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        oscal::oscal_assessment(&db, params).await
-    }
-
     // ── SBOM ──────────────────────────────────────────────
 
     #[tool(

compliance-mcp/src/tools/mod.rs

@@ -1,5 +1,4 @@
 pub mod dast;
 pub mod findings;
-pub mod oscal;
 pub mod pentest;
 pub mod sbom;

compliance-mcp/src/tools/oscal.rs

@@ -1,51 +0,0 @@
-//! OSCAL assessment MCP tool.
-//!
-//! Emits a standard OSCAL assessment-results document for a repo's findings —
-//! what breakpilot's scanner MCP client pulls. Mapped findings target their
-//! compliance controls (via the stamped `control_refs`); unmapped findings are
-//! reported as-is, so nothing is lost.
-
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use compliance_core::models::oscal_assessment::assess;
-use compliance_core::models::Finding;
-
-use crate::database::Database;
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct OscalAssessmentParams {
-    /// Repository / target id to assess.
-    pub repo_id: String,
-}
-
-pub async fn oscal_assessment(
-    db: &Database,
-    params: OscalAssessmentParams,
-) -> Result<CallToolResult, McpError> {
-    let mut cursor = db
-        .findings()
-        .find(doc! { "repo_id": &params.repo_id })
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut findings: Vec<Finding> = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        findings.push(
-            cursor
-                .deserialize_current()
-                .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
-        );
-    }
-
-    let document = assess(&findings, chrono::Utc::now());
-    let json = serde_json::to_string_pretty(&document)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}

control-map/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "control-map"
-version = "0.1.0"
-edition = "2021"
-
-[lints]
-workspace = true
-
-[dependencies]
-serde = { workspace = true }
-serde_json = { workspace = true }
-thiserror = { workspace = true }

control-map/data/cra_control_map.json

@@ -1,440 +0,0 @@
-{
-  "version": "1.0",
-  "framework": "cra",
-  "controls": [
-    {
-      "control": "cra-ai-1",
-      "title": "Secure-by-Default-Konfiguration",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-1-flask-debug-enabled",
-            "cra-ai-1-django-debug-true",
-            "cra-ai-1-tls-verify-disabled",
-            "cra-ai-1-cors-wildcard"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-2",
-      "title": "Minimale Angriffsflaeche",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-3",
-      "title": "Sichere Systemarchitektur",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-4",
-      "title": "Least-Privilege-Prinzip",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-5",
-      "title": "Manipulationsschutz",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-6",
-      "title": "Integritaetspruefung",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-7",
-      "title": "Starke Authentifizierung",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-7-weak-password-hash"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-8",
-      "title": "Keine Default-Passwoerter",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-259"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-9",
-      "title": "Sicheres Credential-Management",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-522"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-10",
-      "title": "Sitzungsmanagement",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-10-session-cookie-insecure",
-            "cra-ai-10-express-cookie-insecure"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-11",
-      "title": "Brute-Force-Schutz",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-12",
-      "title": "Rollenbasierte Autorisierung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-13",
-      "title": "Verschluesselung sensibler Daten",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-327",
-            "CWE-326"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-14",
-      "title": "Speicher-Schutz (Data at Rest)",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [],
-          "rules": [
-            "cra-ai-14-python-weak-cipher",
-            "cra-ai-14-node-weak-cipher"
-          ]
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-15",
-      "title": "Transport-Schutz (Data in Transit)",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-319",
-            "CWE-311"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-16",
-      "title": "Sicheres Schluesselmanagement",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-321"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-17",
-      "title": "Datenminimierung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-18",
-      "title": "Strukturierter SSDLC",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-19",
-      "title": "Systematische Code Reviews",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-20",
-      "title": "Automatisierte Sicherheitstests",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-89",
-            "CWE-78",
-            "CWE-79",
-            "CWE-22"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-21",
-      "title": "Supply-Chain-Security",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-22",
-      "title": "Dependency-Monitoring",
-      "scans": [
-        {
-          "tool": "osv",
-          "scan_type": "cve",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-23",
-      "title": "Software Bill of Materials (SBOM)",
-      "scans": [
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-24",
-      "title": "Security-Logging",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-25",
-      "title": "Ereignis-Monitoring",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-26",
-      "title": "Anomalie-Erkennung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-27",
-      "title": "Log-Integritaet und -Aufbewahrung",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-28",
-      "title": "Sichere Update-Mechanismen",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-29",
-      "title": "Update-Authentizitaet",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-30",
-      "title": "Update-Integritaet",
-      "scans": [],
-      "note": "absence-based — no syntactic pattern; covered by the grounded surface check (retrieve surface + LLM judge), gated (BREAKPILOT_GROUNDED_CHECKS) pending live tuning",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-31",
-      "title": "Lifecycle-Support",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-32",
-      "title": "Schwachstellen-Identifikation",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-33",
-      "title": "SBOM-Pflege und Analyse",
-      "scans": [
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "osv",
-          "scan_type": "cve",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-34",
-      "title": "Risikobasierte Priorisierung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-35",
-      "title": "Coordinated Vulnerability Disclosure",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-36",
-      "title": "Incident-Response-Prozess",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-37",
-      "title": "Fruehwarnung (24h)",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-38",
-      "title": "Detaillierter Vorfallsbericht (72h)",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-39",
-      "title": "Patch-Bereitstellung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-40",
-      "title": "Dokumentation und Nachbereitung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    }
-  ]
-}

control-map/src/lib.rs

@@ -1,229 +0,0 @@
-//! `control-map` — the deterministic control → scan lookup table (LUT).
-//!
-//! The "transcribing" layer: it maps each compliance control to the static-scan
-//! step(s) that check it, or marks it as needing custom tooling, or as not
-//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
-//! decides coverage. The LLM only enters later, downstream, to triage/ground the
-//! *tool's* findings (that lives in the agent, not here).
-//!
-//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
-//! + query helpers.
-
-use serde::{Deserialize, Serialize};
-
-/// Coverage bucket for a control under static (SAST-family) scanning.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Coverage {
-    /// An existing tool's scan surfaces findings for this control.
-    Covered,
-    /// Code-checkable, but no existing tool digs it out — we must write tooling.
-    NeedsTooling,
-    /// Process / document control — out of static-scan scope.
-    NotCodeCheckable,
-}
-
-/// One tool binding: a scan step that (at least partially) checks a control.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ScanBinding {
-    /// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
-    pub tool: String,
-    /// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
-    pub scan_type: String,
-    /// CWEs whose findings map to this control (used to attach findings back).
-    #[serde(default)]
-    pub cwe: Vec<String>,
-    /// Optional specific rule ids this control keys on.
-    #[serde(default)]
-    pub rules: Vec<String>,
-}
-
-/// One control's entry in the LUT.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlEntry {
-    /// Control id, e.g. `"cra-ai-8"`.
-    pub control: String,
-    /// Human-readable title (for the reviewable view).
-    #[serde(default)]
-    pub title: String,
-    /// Coverage bucket.
-    pub status: Coverage,
-    /// Tool bindings (empty unless `status == Covered`).
-    #[serde(default)]
-    pub scans: Vec<ScanBinding>,
-    /// Reviewer note — why it needs tooling / isn't code-checkable.
-    #[serde(default)]
-    pub note: Option<String>,
-}
-
-/// The control → scan lookup table for one framework.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlMap {
-    pub version: String,
-    pub framework: String,
-    pub controls: Vec<ControlEntry>,
-}
-
-const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
-
-/// Whether an authored rule id `bound` matches a scanner's emitted rule id
-/// `actual`. semgrep prefixes local-rule check_ids with a path
-/// (`tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled`), so match the final
-/// id segment rather than requiring exact equality.
-fn rule_id_matches(bound: &str, actual: &str) -> bool {
-    actual == bound || actual.ends_with(&format!(".{bound}"))
-}
-
-impl ControlMap {
-    /// Load the built-in CRA control map (the embedded, authored LUT).
-    pub fn cra() -> Result<Self, MapError> {
-        Ok(serde_json::from_str(CRA_MAP_JSON)?)
-    }
-
-    /// The coverage entry for a control id, if present.
-    pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
-        self.controls.iter().find(|c| c.control == control_id)
-    }
-
-    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
-    /// raw tool finding back to the control(s) it's evidence for.
-    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
-        self.controls_for_finding(tool, Some(cwe), None)
-    }
-
-    /// Controls a tool finding is evidence for, matched by CWE and/or the specific
-    /// rule id that fired. Off-the-shelf findings bind by CWE; our custom detectors
-    /// bind by rule id (precise — a broad CWE would over-attribute and then the
-    /// grounded judge could drop a genuine finding as a control false positive).
-    pub fn controls_for_finding(
-        &self,
-        tool: &str,
-        cwe: Option<&str>,
-        rule_id: Option<&str>,
-    ) -> Vec<&ControlEntry> {
-        self.controls
-            .iter()
-            .filter(|c| {
-                c.scans.iter().any(|s| {
-                    s.tool == tool
-                        && (cwe.is_some_and(|w| s.cwe.iter().any(|x| x == w))
-                            || rule_id
-                                .is_some_and(|r| s.rules.iter().any(|b| rule_id_matches(b, r))))
-                })
-            })
-            .collect()
-    }
-
-    /// Count of controls in each coverage bucket.
-    pub fn summary(&self) -> CoverageSummary {
-        let mut s = CoverageSummary::default();
-        for c in &self.controls {
-            match c.status {
-                Coverage::Covered => s.covered += 1,
-                Coverage::NeedsTooling => s.needs_tooling += 1,
-                Coverage::NotCodeCheckable => s.not_code_checkable += 1,
-            }
-        }
-        s
-    }
-}
-
-/// Coverage bucket counts.
-#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
-pub struct CoverageSummary {
-    pub covered: usize,
-    pub needs_tooling: usize,
-    pub not_code_checkable: usize,
-}
-
-impl CoverageSummary {
-    pub fn total(&self) -> usize {
-        self.covered + self.needs_tooling + self.not_code_checkable
-    }
-}
-
-/// Errors loading a control map.
-#[derive(Debug, thiserror::Error)]
-pub enum MapError {
-    #[error("failed to parse control map: {0}")]
-    Parse(#[from] serde_json::Error),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn cra_map_loads_all_40_controls() {
-        let map = ControlMap::cra().expect("CRA map should parse");
-        assert_eq!(map.framework, "cra");
-        assert_eq!(map.controls.len(), 40);
-        assert_eq!(map.summary().total(), 40);
-    }
-
-    #[test]
-    fn hardcoded_password_control_is_tool_covered() {
-        let map = ControlMap::cra().unwrap();
-        let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
-        assert_eq!(c.status, Coverage::Covered);
-        assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
-        assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
-    }
-
-    #[test]
-    fn finding_attaches_back_to_control_via_tool_and_cwe() {
-        let map = ControlMap::cra().unwrap();
-        let hits = map.controls_for("semgrep", "CWE-798");
-        assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
-    }
-
-    #[test]
-    fn every_bucket_is_represented() {
-        let s = ControlMap::cra().unwrap().summary();
-        assert!(s.covered > 0);
-        assert!(s.needs_tooling > 0);
-        assert!(s.not_code_checkable > 0);
-    }
-
-    #[test]
-    fn rule_id_matching_handles_semgrep_path_prefix() {
-        let bound = "cra-ai-1-flask-debug-enabled";
-        assert!(rule_id_matches(bound, bound)); // exact
-        assert!(rule_id_matches(
-            bound,
-            "tmp.compliance-cra-semgrep.cra-ai-1-flask-debug-enabled"
-        )); // semgrep path prefix
-        assert!(!rule_id_matches(
-            bound,
-            "cra-ai-1-flask-debug-enabled-extra"
-        )); // not a suffix segment
-        assert!(!rule_id_matches(
-            bound,
-            "python.lang.security.exec-detected"
-        )); // unrelated
-    }
-
-    #[test]
-    fn custom_rule_finding_attaches_to_control_by_rule_id() {
-        let map = ControlMap::cra().unwrap();
-        // cra-ai-1 is now tool-covered by custom rules.
-        assert_eq!(map.coverage("cra-ai-1").unwrap().status, Coverage::Covered);
-        // A prefixed check_id still maps back to cra-ai-1 by rule id.
-        let hits =
-            map.controls_for_finding("semgrep", None, Some("tmp.x.cra-ai-1-tls-verify-disabled"));
-        assert!(hits.iter().any(|c| c.control == "cra-ai-1"));
-    }
-
-    #[test]
-    fn custom_rule_controls_do_not_bind_by_broad_cwe() {
-        let map = ControlMap::cra().unwrap();
-        // cra-ai-1 rules emit CWE-489 in metadata, but the LUT binds by rule id
-        // only (cwe: []) — so a stray CWE-489 finding must NOT attach to it.
-        assert!(map.controls_for("semgrep", "CWE-489").is_empty());
-        // The CWE path for off-the-shelf findings is unchanged.
-        assert!(map
-            .controls_for("semgrep", "CWE-798")
-            .iter()
-            .any(|c| c.control == "cra-ai-8"));
-    }
-}

docs/.vitepress/config.mts

@@ -20,7 +20,6 @@ export default withMermaid(defineConfig({
           { text: 'Getting Started', link: '/guide/getting-started' },
           { text: 'Adding Repositories', link: '/guide/repositories' },
           { text: 'Running Scans', link: '/guide/scanning' },
-          { text: 'PLC / SPS (CODESYS)', link: '/guide/plc' },
           { text: 'Understanding Findings', link: '/guide/findings' },
           { text: 'SBOM & Licenses', link: '/guide/sbom' },
           { text: 'Issues & Tracking', link: '/guide/issues' },
@@ -44,7 +43,6 @@ export default withMermaid(defineConfig({
         items: [
           { text: 'Glossary', link: '/reference/glossary' },
           { text: 'Tools & Scanners', link: '/reference/tools' },
-          { text: 'PLC Runtime Landscape', link: '/reference/plc-runtimes' },
         ],
       },
     ],

docs/guide/plc.md

@@ -1,163 +0,0 @@
-# PLC / SPS Projects (CODESYS)
-
-Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such
-as CODESYS projects. A single PLC/SPS target is treated as a **composite device**:
-the control application *and* the device it runs on.
-
-| What you provide | What Certifai does |
-| --- | --- |
-| PLC project (PLCopen XML / ST, or a `.projectarchive`) | **Control-logic SAST** — semantic security rules over ST **and** graphical FBD/LD |
-| A `.projectarchive` | **Control-app SBOM** — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
-| A device firmware image | Firmware SBOM / CVE (opt-in) |
-| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
-
-## Anatomy: a soft PLC is a SoC + Linux + runtime
-
-A CODESYS controller is **not** a monolithic appliance like a classic Siemens
-S7. It is **PC-based ("soft") control** — commodity silicon running a
-general-purpose Linux, with a **software PLC runtime** as just another process:
-
-| Classic PLC (e.g. Siemens S7) | Soft PLC (CODESYS-on-Yocto, OpenPLC-on-Raspbian) |
-| --- | --- |
-| Proprietary hardware + firmware | Commodity SoC (x86 / ARM) |
-| Proprietary OS | General-purpose Linux (a **Yocto** image, or Raspbian) |
-| Proprietary runtime | Software runtime (**CODESYS Control**, or OpenPLC) |
-| STEP7 / TIA project | IEC 61131-3 control app (ST / LD / FBD / SFC) |
-
-Because of this, the device is built along **two independent tracks**, by
-different people, on different timelines, and shipped separately. It also
-inherits the **entire Linux / IT attack surface on top of** the OT / control
-one — which is exactly why a PLC/SPS target is treated as a **composite**:
-Certifai ingests one artifact per layer and scans each with the right pipeline.
-
-```mermaid
-flowchart TB
-    subgraph TA["Track A · Device platform — built by the hardware OEM / vendor"]
-        direction LR
-        A1["Yocto / OpenEmbedded<br/>BSP + RT kernel"] --> A2["Bake in the CODESYS<br/>Control for Linux runtime"] --> A3["bitbake → device image<br/>.wic / .tar + manifest"]
-    end
-    subgraph TB2["Track B · Control application — built by the machine builder / customer"]
-        direction LR
-        B1["CODESYS IDE<br/>ST / LD / FBD / SFC + WebVisu"] --> B2["Reference CODESYS +<br/>vendor libraries"] --> B3["Compile → download<br/>to device (gateway 11740)"]
-    end
-
-    A3 --> DEV(["Running soft-PLC device<br/>SoC + Linux + runtime + control app<br/>Modbus · OPC UA · EtherNet/IP · WebVisu"])
-    B3 --> DEV
-
-    subgraph CERT["What Certifai scans — one layer per artifact"]
-        direction LR
-        S1["Firmware layer<br/>FirmwareStatic · SBOM · CVE"]
-        S2["Control-logic layer<br/>PLC SAST — ST + FBD/LD"]
-        S3["Control-app SBOM<br/>libraries + runtime → CVE"]
-        S4["Running layer<br/>ICS probe · DAST (WebVisu)"]
-    end
-
-    A3 -. firmware image .-> S1
-    B1 -. PLCopen XML / ST via git .-> S2
-    B2 -. projectarchive (zip) .-> S3
-    DEV -. live URL / provisioned .-> S4
-
-    classDef yocto fill:#fde68a,stroke:#b45309,color:#111
-    classDef codesys fill:#bfdbfe,stroke:#1d4ed8,color:#111
-    classDef dev fill:#e9d5ff,stroke:#7e22ce,color:#111
-    classDef cert fill:#bbf7d0,stroke:#15803d,color:#111
-    class A1,A2,A3 yocto
-    class B1,B2,B3 codesys
-    class DEV dev
-    class S1,S2,S3,S4 cert
-```
-
-::: tip Where Yocto fits
-Yocto is **Track A** — the *build system* for the device platform. It produces
-the Linux image and bakes in the CODESYS runtime, so it is the **firmware
-layer**, entirely separate from the control application. Hand it to Certifai as
-its own **firmware image** artifact (scanned by the firmware pipeline, not the
-PLC pipeline). The device OS need not be Yocto — Raspbian/Debian/Buildroot, or
-even an RTOS / bare-metal, are all possible — but Yocto is the common,
-product-grade industrial choice.
-:::
-
-## Two ways to deliver the project
-
-You can either **upload** the project when onboarding, or point Certifai at a
-**git repository** (recommended — every scan is just a `git pull`, no re-upload).
-
-### Option A — Upload
-
-On the onboarding wizard, choose target type **PLC / SPS**, then attach a **PLC
-project** artifact and pick its format:
-
-- **PLCopen XML** (`.xml`) — export from CODESYS via *Project → Export PLCopenXML*.
-- **Structured Text** (`.st`) — a raw ST file.
-- **Project archive** (`.projectarchive`) — *File → Project Archive → Save/Send
-  Archive…* with **"Referenced libraries"** ticked. This is the only form that
-  also yields the **library + runtime SBOM**.
-
-### Option B — Git repository (recommended)
-
-Attach a **Git repository** artifact to the PLC/SPS target. Certifai clones it and
-runs the control-logic scan over the exported source in the repo.
-
-## Best-case git repository layout
-
-Because the binary `.project` does not diff or merge in git, commit **textual
-exports** for review-friendly SAST, and include the **`.projectarchive`** so the
-library/runtime SBOM is available too:
-
-```text
-my-plc-project/
-├── src/
-│   ├── PLC_PRG.xml          # PLCopen XML export (ST or FBD/LD) — one per POU
-│   ├── PumpController.xml
-│   ├── SafetyInterlock.xml
-│   └── GVL.xml              # global variable lists, also as PLCopen XML
-├── PumpStation.projectarchive   # optional but recommended → library + runtime SBOM
-└── README.md
-```
-
-**Guidelines**
-
-- **Export to PLCopen XML** (`Project → Export PLCopenXML`), one file per POU, and
-  commit those. ST, **and graphical FBD/LD**, are both analyzed.
-- Alternatively commit raw `.st` / `.exp` / `.scl` files — also analyzed.
-- **Do not** commit only the binary `.project` — it cannot be parsed (and does not
-  diff). If you want the library SBOM, commit the **`.projectarchive`** as well.
-- CODESYS's built-in Git integration, which stores an exported representation,
-  works too — as long as the committed form is PLCopen XML / textual.
-
-::: tip What unlocks what
-- **Control-logic SAST** needs textual source in the repo (PLCopen XML or `.st`).
-- **Library + runtime SBOM** needs a **`.projectarchive`** — PLCopen XML exports do
-  **not** carry the referenced libraries.
-:::
-
-## What the scanner finds
-
-The control-logic rules are CWE-mapped and include: hardcoded credentials
-(CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass
-(CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369,
-guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports
-(CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
-
-The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
-the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
-surface real CODESYS advisories as CVE alerts.
-
-## Dynamic testing — ICS protocol probe
-
-Beyond the static analysis, Certifai can **probe the running device** over
-industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
-URL) to the PLC/SPS target and enable the **ICS Probe** scan.
-
-The probe is **read-only** — it never writes to the live process. It currently
-speaks **Modbus/TCP** (port 502): it confirms whether the device answers
-unauthenticated Modbus requests and reads its device identity (vendor / product /
-revision). Because Modbus/TCP has no authentication or encryption in the protocol,
-a reachable endpoint that answers is reported as an exposed control interface
-(CWE-306). OPC UA and EtherNet/IP probes are planned.
-
-::: warning
-The ICS probe connects to the live device. It is **opt-in** (off by default) and
-should only be run against targets you are authorized to test. It performs reads
-only, never writes.
-:::

docs/reference/plc-runtimes.md

@@ -1,97 +0,0 @@
-# PLC Runtime Landscape & Support
-
-A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app**
-(see [PLC / SPS Projects](/guide/plc)).
-The **runtime** is what defines the device — it provides the IEC engine, the
-Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
-runtime ecosystems Certifai may encounter.
-
-We do **not** aim to support every runtime up front. Certifai supports the
-**CODESYS family** today; everything else is a **watch-list** — when a customer
-shows up using one, we add the parser/support for it then. The dynamic OT probe
-(Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of
-the runtime.
-
-## Support status
-
-| Status | Meaning |
-| --- | --- |
-| ✅ **Supported** | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
-| 🟡 **Covered via CODESYS** | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
-| 🔭 **Watch-list** | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
-| 🧪 **Test-bench** | A free runtime we use to *reconstruct and dynamically test* a device (see epic: provision-and-test). |
-
-## 1. CODESYS and rebranded CODESYS (the largest slice)
-
-Much of the market licenses the CODESYS runtime and rebrands the IDE. If a
-customer "doesn't use CODESYS", they often do — under another name.
-
-| Product / vendor | Based on | Status |
-| --- | --- | --- |
-| **CODESYS** (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
-| Schneider **EcoStruxure Machine Expert** (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
-| **WAGO** e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
-| **ABB** AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
-| **Bosch Rexroth** ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
-| **Eaton** XSoft-CODESYS, **KEBA** KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |
-
-## 2. Other embeddable IEC 61131-3 runtime toolkits
-
-Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a
-device), but with **different project formats and libraries**.
-
-| Toolkit | Vendor | Status |
-| --- | --- | --- |
-| **ProConOS / MULTIPROG** | Phoenix Contact / KW-Software | 🔭 Watch-list |
-| **ISaGRAF** (also does IEC 61499) | Rockwell | 🔭 Watch-list |
-| **straton** | COPA-DATA | 🔭 Watch-list |
-| **logi.CAD** | logi.cals | 🔭 Watch-list |
-
-## 3. Fully proprietary ecosystems (own runtime + IDE + protocols)
-
-Static analysis here needs a **per-vendor project parser**; the **dynamic OT
-probe still works** (they speak Modbus / OPC UA / EtherNet/IP, plus vendor
-protocols like S7comm / CIP).
-
-| Ecosystem | Vendor | Notes | Status |
-| --- | --- | --- | --- |
-| **TIA Portal / STEP 7** (S7-1200/1500), S7-1500 **Software Controller**, **Virtual PLC** | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
-| **Studio 5000** (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
-| **TwinCAT 3** | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 **+ C++ + Simulink** | 🔭 Watch-list |
-| **Automation Studio** | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
-| **GX Works** (MELSEC) | Mitsubishi | | 🔭 Watch-list |
-| **Sysmac Studio** (NX / NJ) | Omron | | 🔭 Watch-list |
-| **Proficy Machine Edition** (PACSystems) | Emerson / GE | | 🔭 Watch-list |
-
-## 4. Linux-native / containerized soft-PLC (the direction of travel)
-
-| Product | Vendor | Notes | Status |
-| --- | --- | --- | --- |
-| **PLCnext** | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
-| **ctrlX** | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
-| **Virtual PLC** / **CODESYS Virtual Control** | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |
-
-## 5. Open-source runtimes (free — our test-bench substrates)
-
-Used to **reconstruct and dynamically test** a customer device without touching
-their network (provision-and-test).
-
-| Runtime | Standard | Notes | Status |
-| --- | --- | --- | --- |
-| **OpenPLC** | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
-| **Beremiz + MatIEC** | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
-| **Eclipse 4diac (FORTE)** | IEC **61499** | Distributed, event-driven — a *different paradigm* from 61131-3's scan cycle | 🔭 Watch-list |
-| **ProView** | — | Open-source process control + SCADA | 🔭 Watch-list |
-
-## How we add support for a new runtime
-
-- **Static (SAST / SBOM):** needs a parser for that runtime's **project format**
-  (and its library/package convention). This is the per-vendor work.
-- **Dynamic (ICS probe / DAST):** already **vendor-agnostic** — it targets the
-  device's OT ports and WebVisu, not the runtime's file format. So a brand-new
-  ecosystem still gets dynamic coverage on day one.
-
-::: tip Rule of thumb
-Confirm whether a "non-CODESYS" controller is actually a **rebranded CODESYS**
-runtime (Section 1) before assuming new work — most of the long tail is.
-:::

examples/plc-demo/pump_fbd.xml

@@ -1,56 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Function Block Diagram (FBD) POU in PLCopen TC6 XML form. Demonstrates that
-     the scanner analyses graphical logic, not just Structured Text: the same
-     defects (cleartext Modbus master on 502, a hardcoded HMI password, a safety
-     enable driven FALSE) are here wired as blocks and in/out variables. -->
-<project xmlns="http://www.plcopen.org/xml/tc6_0201">
-  <types>
-    <pous>
-      <pou name="PumpFbdCtrl" pouType="functionBlock">
-        <interface>
-          <inputVars>
-            <variable name="HmiPassword"><type><string/></type></variable>
-            <variable name="Safety_Enable"><type><BOOL/></type></variable>
-            <variable name="ServerIp"><type><string/></type></variable>
-          </inputVars>
-        </interface>
-        <body>
-          <FBD>
-            <!-- Modbus/TCP master: cleartext (AUTH := FALSE) on port 502 -->
-            <inVariable localId="1"><expression>'10.20.0.5'</expression><connectionPointOut/></inVariable>
-            <inVariable localId="2"><expression>502</expression><connectionPointOut/></inVariable>
-            <inVariable localId="3"><expression>FALSE</expression><connectionPointOut/></inVariable>
-            <block localId="10" typeName="Modbus_TCP_Master">
-              <inputVariables>
-                <variable formalParameter="IP">
-                  <connectionPointIn><connection refLocalId="1"/></connectionPointIn>
-                </variable>
-                <variable formalParameter="PORT">
-                  <connectionPointIn><connection refLocalId="2"/></connectionPointIn>
-                </variable>
-                <variable formalParameter="AUTH">
-                  <connectionPointIn><connection refLocalId="3"/></connectionPointIn>
-                </variable>
-              </inputVariables>
-              <outputVariables/>
-            </block>
-
-            <!-- Hardcoded HMI password wired into an output -->
-            <inVariable localId="20"><expression>'admin123'</expression><connectionPointOut/></inVariable>
-            <outVariable localId="21">
-              <expression>HmiPassword</expression>
-              <connectionPointIn><connection refLocalId="20"/></connectionPointIn>
-            </outVariable>
-
-            <!-- Safety enable driven FALSE in logic -->
-            <inVariable localId="30"><expression>FALSE</expression><connectionPointOut/></inVariable>
-            <outVariable localId="31">
-              <expression>Safety_Enable</expression>
-              <connectionPointIn><connection refLocalId="30"/></connectionPointIn>
-            </outVariable>
-          </FBD>
-        </body>
-      </pou>
-    </pous>
-  </types>
-</project>

werkbank-exec/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "werkbank-exec"
-version = "0.1.0"
-edition = "2021"
-description = "Shared dynamic-execution logic: soft-PLC provisioning + industrial-protocol probing, used by the compliance agent and the Werkbank runner."
-
-[lints]
-workspace = true
-
-[dependencies]
-compliance-core = { workspace = true }
-compliance-dast = { path = "../compliance-dast" }
-tokio = { workspace = true }
-reqwest = { workspace = true }
-uuid = { workspace = true }
-regex = { workspace = true }
-secrecy = { workspace = true }
-sha2 = { workspace = true }
-hex = { workspace = true }
-tracing = { workspace = true }
-thiserror = { workspace = true }
-walkdir = "2"
-futures-util = "0.3"

werkbank-exec/src/error.rs

@@ -1,16 +0,0 @@
-//! Error type for the dynamic-execution logic.
-
-/// Anything that can go wrong provisioning and testing a soft-PLC. The compliance
-/// agent maps this into its own `AgentError` at the call boundary.
-#[derive(thiserror::Error, Debug)]
-pub enum ExecError {
-    /// An HTTP request (to OpenPLC) failed.
-    #[error("HTTP error: {0}")]
-    Http(#[from] reqwest::Error),
-    /// A local IO / process error (e.g. invoking `docker`).
-    #[error("IO error: {0}")]
-    Io(#[from] std::io::Error),
-    /// Any other failure, with a message.
-    #[error("{0}")]
-    Other(String),
-}

werkbank-exec/src/fingerprint.rs

@@ -1,32 +0,0 @@
-//! Finding fingerprint helper (a SHA-256 over the salient parts), shared by the
-//! probe modules for stable dedup keys. Mirrors the agent's `dedup` helper.
-
-use sha2::{Digest, Sha256};
-
-/// A stable fingerprint over the given parts (order-sensitive, separated so
-/// `["ab","c"]` and `["a","bc"]` differ).
-pub fn compute_fingerprint(parts: &[&str]) -> String {
-    let mut hasher = Sha256::new();
-    for part in parts {
-        hasher.update(part.as_bytes());
-        hasher.update(b"|");
-    }
-    hex::encode(hasher.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn deterministic_and_hex() {
-        let a = compute_fingerprint(&["repo", "rule", "1"]);
-        assert_eq!(a, compute_fingerprint(&["repo", "rule", "1"]));
-        assert_eq!(a.len(), 64);
-        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
-        assert_ne!(
-            compute_fingerprint(&["ab", "c"]),
-            compute_fingerprint(&["a", "bc"])
-        );
-    }
-}

werkbank-exec/src/ics/ethernetip.rs

@@ -1,95 +0,0 @@
-//! Minimal EtherNet/IP (CIP) reachability probe.
-//!
-//! Sends an EtherNet/IP encapsulation **ListIdentity** command (0x0063) over TCP
-//! 44818 and checks for a valid encapsulation reply — confirming a CIP device
-//! without opening a session or writing anything.
-
-use std::time::Duration;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Outcome of an EtherNet/IP handshake probe.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct EnipProbe {
-    /// A TCP connection to the port was established.
-    pub reachable: bool,
-    /// The endpoint returned a valid EtherNet/IP encapsulation reply.
-    pub is_enip: bool,
-}
-
-/// Probe an EtherNet/IP endpoint with a ListIdentity request. Read-only.
-pub async fn probe(host: &str, port: u16, budget: Duration) -> EnipProbe {
-    let mut out = EnipProbe::default();
-    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
-        return out;
-    };
-    out.reachable = true;
-
-    // Encapsulation header (24 bytes): command(2) length(2) session(4) status(4)
-    // context(8) options(4). ListIdentity = command 0x0063, everything else zero.
-    let mut req = vec![0u8; 24];
-    req[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
-    if timeout(budget, stream.write_all(&req))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-
-    let mut hdr = [0u8; 24];
-    if timeout(budget, stream.read_exact(&mut hdr))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-    let command = u16::from_le_bytes([hdr[0], hdr[1]]);
-    let status = u32::from_le_bytes([hdr[8], hdr[9], hdr[10], hdr[11]]);
-    // Echoed command + success status = a valid EtherNet/IP encapsulation reply.
-    if command == 0x0063 && status == 0 {
-        out.is_enip = true;
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    async fn mock_server() -> std::net::SocketAddr {
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let addr = listener.local_addr().expect("addr");
-        tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.expect("accept");
-            let mut req = [0u8; 24];
-            if sock.read_exact(&mut req).await.is_err() {
-                return;
-            }
-            // Reply: echo command 0x0063, status 0, no data.
-            let mut hdr = vec![0u8; 24];
-            hdr[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
-            let _ = sock.write_all(&hdr).await;
-        });
-        addr
-    }
-
-    #[tokio::test]
-    async fn probe_detects_an_ethernetip_device() {
-        let addr = mock_server().await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.reachable && p.is_enip);
-    }
-
-    #[tokio::test]
-    async fn probe_reports_unreachable_for_a_closed_port() {
-        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
-        assert!(!p.reachable && !p.is_enip);
-    }
-}

werkbank-exec/src/ics/mod.rs

@@ -1,306 +0,0 @@
-//! Dynamic ICS (industrial control system) probing for PLC/SPS targets.
-//!
-//! Where the control-logic scanner is static (over ST / PLCopen XML), this probes
-//! the *running* device over industrial protocols and reports exposed /
-//! unauthenticated control interfaces. It is read-only: it never writes to a live
-//! process. Modbus/TCP and OPC UA are implemented; EtherNet-IP is a follow-on.
-
-pub mod ethernetip;
-pub mod modbus;
-pub mod opcua;
-pub mod portscan;
-
-use std::time::Duration;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-
-use crate::fingerprint as dedup;
-
-/// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
-const MODBUS_PORT: u16 = 502;
-const OPCUA_PORT: u16 = 4840;
-const ENIP_PORT: u16 = 44818;
-
-/// Probe a PLC/SPS device's industrial-protocol surface and return findings.
-/// Read-only. Deep-probes Modbus/TCP, OPC UA and EtherNet/IP, plus a service
-/// discovery scan of the remaining OT / insecure-management ports. `endpoint` is
-/// the target's live-URL / host reference.
-pub async fn probe_target(endpoint: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let (host, modbus_port) = parse_endpoint(endpoint);
-    let mut findings = modbus_findings(&host, modbus_port, repo_id, budget).await;
-    findings.extend(opcua_findings(&host, OPCUA_PORT, repo_id, budget).await);
-    findings.extend(enip_findings(&host, ENIP_PORT, repo_id, budget).await);
-    findings.extend(portscan_findings(&host, repo_id, budget).await);
-    findings
-}
-
-/// Findings from probing the Modbus/TCP surface.
-async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let probe = modbus::probe(host, port, budget).await;
-    let mut findings = Vec::new();
-    if !probe.speaks_modbus {
-        // Not reachable, or the port does not speak Modbus — nothing to report.
-        return findings;
-    }
-    let target = format!("{host}:{port}");
-
-    // Reachable Modbus/TCP = unauthenticated, cleartext control access by design.
-    let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed", &target]);
-    let mut f = Finding::new(
-        repo_id.to_string(),
-        fp,
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "Modbus/TCP control interface exposed without authentication".to_string(),
-        format!(
-            "The device at {target} answers Modbus/TCP requests. Modbus/TCP has no \
-             authentication or encryption in the protocol, so any host that can reach this \
-             port can read and write process variables (coils/registers) and disrupt the \
-             controlled process."
-        ),
-        Severity::Critical,
-    );
-    f.rule_id = Some("ics-modbus-exposed".to_string());
-    f.cwe = Some("CWE-306".to_string());
-    f.remediation = Some(
-        "Restrict the Modbus/TCP port to a trusted control network (segmentation / \
-         firewall / VPN), never expose it to IT or the internet, and prefer an authenticated \
-         transport (e.g. Modbus/TLS) or a secure protocol gateway where available."
-            .to_string(),
-    );
-    findings.push(f);
-
-    if let Some(dev) = &probe.device {
-        let details = [
-            dev.vendor.as_deref(),
-            dev.product.as_deref(),
-            dev.revision.as_deref(),
-        ]
-        .into_iter()
-        .flatten()
-        .collect::<Vec<_>>()
-        .join(" / ");
-        let fp = dedup::compute_fingerprint(&[repo_id, "ics-device-disclosure", &target]);
-        let mut f = Finding::new(
-            repo_id.to_string(),
-            fp,
-            "ics-probe".to_string(),
-            ScanType::IcsProbe,
-            "PLC device identity disclosed over Modbus".to_string(),
-            format!(
-                "The device at {target} discloses its identity via Modbus Read Device \
-                 Identification: {details}. This aids fingerprinting and targeting of \
-                 known-vulnerable firmware/runtime versions."
-            ),
-            Severity::Low,
-        );
-        f.rule_id = Some("ics-device-disclosure".to_string());
-        f.cwe = Some("CWE-200".to_string());
-        f.remediation = Some(
-            "Limit network reach to the device; Modbus device identification cannot be \
-             disabled, so exposure is bounded by network segmentation."
-                .to_string(),
-        );
-        findings.push(f);
-    }
-
-    // Exposed process points: coils / holding registers that a read enumerated
-    // and that, over unauthenticated Modbus/TCP, are also writable. This is the
-    // concrete attack surface behind the exposure — the live variables an
-    // attacker can overwrite. (Read-only to detect: we never write.)
-    let coils = probe.coils_readable.unwrap_or(0);
-    let registers = probe.holding_registers_readable.unwrap_or(0);
-    if coils > 0 || registers > 0 {
-        let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed-points", &target]);
-        let mut f = Finding::new(
-            repo_id.to_string(),
-            fp,
-            "ics-probe".to_string(),
-            ScanType::IcsProbe,
-            "Writable process points exposed over unauthenticated Modbus/TCP".to_string(),
-            format!(
-                "Reading the device at {target} enumerated {coils} coil(s) and {registers} \
-                 holding register(s). Coils and holding registers are read/write process points \
-                 in Modbus, so any host that can reach this port can not only read but overwrite \
-                 live process state (force coils, change setpoints) without authentication."
-            ),
-            Severity::High,
-        );
-        f.rule_id = Some("ics-modbus-exposed-points".to_string());
-        f.cwe = Some("CWE-306".to_string());
-        f.remediation = Some(
-            "Segment the Modbus/TCP port to a trusted control network; where the device \
-             supports it use Modbus/TLS or an authenticating protocol gateway; restrict which \
-             function codes and register ranges are reachable from outside the control zone."
-                .to_string(),
-        );
-        findings.push(f);
-    }
-    findings
-}
-
-/// Findings from probing the OPC UA surface (default port 4840). A reachability
-/// probe only: it flags an exposed OPC UA server for review of its security
-/// policy / authentication (deep SecurityPolicy analysis is a follow-on).
-async fn opcua_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let probe = opcua::probe(host, port, budget).await;
-    let mut findings = Vec::new();
-    if !probe.is_opcua {
-        return findings;
-    }
-    let target = format!("{host}:{port}");
-    let fp = dedup::compute_fingerprint(&[repo_id, "ics-opcua-exposed", &target]);
-    let mut f = Finding::new(
-        repo_id.to_string(),
-        fp,
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "OPC UA server exposed on the network".to_string(),
-        format!(
-            "An OPC UA server answers at {target}. Verify it enforces message security \
-             (a SecurityPolicy other than None) and rejects anonymous sessions — the common \
-             default of SecurityPolicy None + an Anonymous user token allows unauthenticated, \
-             unencrypted read/write of the server's address space."
-        ),
-        Severity::Medium,
-    );
-    f.rule_id = Some("ics-opcua-exposed".to_string());
-    f.cwe = Some("CWE-319".to_string());
-    f.remediation = Some(
-        "Restrict OPC UA (4840) to a trusted network; require a signed & encrypted \
-         SecurityPolicy (Basic256Sha256 or better) with certificate / username \
-         authentication, and disable the Anonymous user token."
-            .to_string(),
-    );
-    findings.push(f);
-    findings
-}
-
-/// Findings from probing the EtherNet/IP (CIP) surface (default port 44818).
-async fn enip_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let probe = ethernetip::probe(host, port, budget).await;
-    if !probe.is_enip {
-        return Vec::new();
-    }
-    let target = format!("{host}:{port}");
-    let fp = dedup::compute_fingerprint(&[repo_id, "ics-ethernetip-exposed", &target]);
-    let mut f = Finding::new(
-        repo_id.to_string(),
-        fp,
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "EtherNet/IP (CIP) interface exposed on the network".to_string(),
-        format!(
-            "The device at {target} answers EtherNet/IP (CIP) requests. EtherNet/IP has no \
-             authentication in the base protocol, so a host that can reach it can enumerate \
-             and interact with the device's control objects."
-        ),
-        Severity::High,
-    );
-    f.rule_id = Some("ics-ethernetip-exposed".to_string());
-    f.cwe = Some("CWE-306".to_string());
-    f.remediation = Some(
-        "Restrict EtherNet/IP (44818/2222) to a trusted control network; use CIP Security \
-         (encryption + authentication) on devices that support it."
-            .to_string(),
-    );
-    vec![f]
-}
-
-/// Findings from the service-discovery port scan of the remaining OT /
-/// insecure-management surface.
-async fn portscan_findings(host: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let open = portscan::scan(host, portscan::KNOWN_PORTS, budget).await;
-    open.into_iter()
-        .map(|kp| {
-            let target = format!("{host}:{}", kp.port);
-            let (title, severity, cwe, description) = match kp.kind {
-                portscan::PortKind::Ics => (
-                    format!("ICS service exposed: {}", kp.service),
-                    Severity::High,
-                    "CWE-306",
-                    format!(
-                        "{target} exposes {} ({}). Industrial protocols are typically \
-                         unauthenticated, so network reach implies control access.",
-                        kp.service, kp.note
-                    ),
-                ),
-                portscan::PortKind::InsecureMgmt => (
-                    format!("Cleartext service exposed: {}", kp.service),
-                    Severity::Medium,
-                    "CWE-319",
-                    format!(
-                        "{target} exposes {} ({}), which transmits credentials and data in \
-                         cleartext.",
-                        kp.service, kp.note
-                    ),
-                ),
-            };
-            let fp = dedup::compute_fingerprint(&[repo_id, "ics-service-exposed", &target]);
-            let mut f = Finding::new(
-                repo_id.to_string(),
-                fp,
-                "ics-probe".to_string(),
-                ScanType::IcsProbe,
-                title,
-                description,
-                severity,
-            );
-            f.rule_id = Some("ics-service-exposed".to_string());
-            f.cwe = Some(cwe.to_string());
-            f.remediation = Some(
-                "Restrict the service to a trusted network segment; disable it if unused; \
-                 replace cleartext protocols (Telnet/FTP) with SSH/SFTP."
-                    .to_string(),
-            );
-            f
-        })
-        .collect()
-}
-
-/// Extract `(host, port)` from a target reference. Modbus lives on its own port
-/// (502 by default), independent of any HTTP/WebVisu URL, so unless the reference
-/// explicitly carries `modbus://host:port` or a bare `host:port`, we probe 502.
-fn parse_endpoint(endpoint: &str) -> (String, u16) {
-    let s = endpoint.trim();
-    let (scheme, rest) = match s.split_once("://") {
-        Some((sch, r)) => (Some(sch.to_ascii_lowercase()), r),
-        None => (None, s),
-    };
-    let hostport = rest.split(['/', '?']).next().unwrap_or(rest);
-    let (host, port) = match hostport.rsplit_once(':') {
-        Some((h, p)) => (h.to_string(), p.parse::<u16>().ok()),
-        None => (hostport.to_string(), None),
-    };
-    let port = match (scheme.as_deref(), port) {
-        // Explicit Modbus port, or a bare host:port the user chose.
-        (Some("modbus"), Some(p)) | (None, Some(p)) => p,
-        // An http(s)/WebVisu URL (or no port): Modbus is on its own port.
-        _ => MODBUS_PORT,
-    };
-    (host, port)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::parse_endpoint;
-
-    #[test]
-    fn endpoint_parsing_picks_the_modbus_port() {
-        assert_eq!(parse_endpoint("10.0.0.5"), ("10.0.0.5".into(), 502));
-        assert_eq!(parse_endpoint("10.0.0.5:1502"), ("10.0.0.5".into(), 1502));
-        assert_eq!(
-            parse_endpoint("modbus://plc.local:5020"),
-            ("plc.local".into(), 5020)
-        );
-        // A WebVisu URL: the http port is ignored; Modbus is on 502.
-        assert_eq!(
-            parse_endpoint("http://plc.local:8080/webvisu"),
-            ("plc.local".into(), 502)
-        );
-        assert_eq!(
-            parse_endpoint("https://plc.local/"),
-            ("plc.local".into(), 502)
-        );
-    }
-}

werkbank-exec/src/ics/modbus.rs

@@ -1,262 +0,0 @@
-//! Minimal Modbus/TCP client for dynamic ICS probing.
-//!
-//! Modbus/TCP (port 502) has no authentication or encryption in the protocol, so
-//! an endpoint that answers requests is, by design, open to any host that can
-//! reach it. The probe only *reads* — a Read Holding Registers request and a Read
-//! Device Identification request — and never writes to the live process.
-
-use std::time::Duration;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Outcome of probing a Modbus/TCP endpoint.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct ModbusProbe {
-    /// A TCP connection to the port was established.
-    pub reachable: bool,
-    /// The endpoint answered a Modbus request (a normal reply or a Modbus
-    /// exception) — i.e. it speaks Modbus, unauthenticated.
-    pub speaks_modbus: bool,
-    /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
-    pub device: Option<DeviceId>,
-    /// Coils returned by a Read Coils of the first block, if that address range
-    /// exists. Coils are read/write process bits, so an exposed block is an
-    /// unauthenticated write surface on the live process.
-    pub coils_readable: Option<u16>,
-    /// Holding registers returned by a Read Holding Registers of the first block,
-    /// if that range exists. Holding registers are read/write process words.
-    pub holding_registers_readable: Option<u16>,
-}
-
-/// Vendor / product / revision from Read Device Identification.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct DeviceId {
-    pub vendor: Option<String>,
-    pub product: Option<String>,
-    pub revision: Option<String>,
-}
-
-/// How many coils / holding registers to request when enumerating the exposed
-/// process surface. Read-only: a normal reply means the block exists and is,
-/// over unauthenticated Modbus/TCP, also writable.
-const ENUM_QTY: u16 = 16;
-
-/// Probe a Modbus/TCP endpoint. Read-only: issues Read Holding Registers, Read
-/// Coils, and Read Device Identification requests; never writes to the device.
-pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
-    let mut out = ModbusProbe::default();
-    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
-        return out; // unreachable
-    };
-    out.reachable = true;
-
-    // Read Holding Registers (FC 0x03), unit 1, addr 0 — a benign read that also
-    // enumerates the exposed register block.
-    let rhr = [0x03u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
-    if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
-        // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
-        if matches!(resp.first(), Some(0x03) | Some(0x83)) {
-            out.speaks_modbus = true;
-        }
-        if resp.first() == Some(&0x03) {
-            out.holding_registers_readable = Some(register_count_from_reply(&resp));
-        }
-    }
-
-    // Read Coils (FC 0x01), addr 0 — enumerates the exposed coil (bit) block.
-    let rc = [0x01u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
-    if let Some(resp) = txn(&mut stream, 1, &rc, budget).await {
-        if matches!(resp.first(), Some(0x01) | Some(0x81)) {
-            out.speaks_modbus = true;
-        }
-        if resp.first() == Some(&0x01) {
-            out.coils_readable = Some(coil_count_from_reply(&resp));
-        }
-    }
-
-    // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
-    let rdi = [0x2Bu8, 0x0E, 0x01, 0x00];
-    if let Some(resp) = txn(&mut stream, 1, &rdi, budget).await {
-        if resp.first() == Some(&0x2B) {
-            out.speaks_modbus = true;
-            out.device = parse_device_id(&resp);
-        }
-    }
-    out
-}
-
-/// Coils reported by a Read Coils reply `[0x01, byte_count, data…]` (8 per byte).
-fn coil_count_from_reply(pdu: &[u8]) -> u16 {
-    pdu.get(1).map(|&b| u16::from(b) * 8).unwrap_or(0)
-}
-
-/// Registers reported by a Read Holding Registers reply `[0x03, byte_count,
-/// data…]` (2 bytes per register).
-fn register_count_from_reply(pdu: &[u8]) -> u16 {
-    pdu.get(1).map(|&b| u16::from(b) / 2).unwrap_or(0)
-}
-
-/// Send one Modbus PDU and return the response PDU (function code + data), or
-/// `None` on timeout / malformed reply.
-async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
-    // MBAP header: transaction id (2) + protocol id (2) = 0 + length (2) + unit (1),
-    // then the PDU. `length` counts the unit byte plus the PDU.
-    let len = (pdu.len() + 1) as u16;
-    let mut frame = Vec::with_capacity(7 + pdu.len());
-    frame.extend_from_slice(&[0x00, 0x01]); // transaction id
-    frame.extend_from_slice(&[0x00, 0x00]); // protocol id
-    frame.extend_from_slice(&len.to_be_bytes());
-    frame.push(unit);
-    frame.extend_from_slice(pdu);
-    timeout(budget, stream.write_all(&frame)).await.ok()?.ok()?;
-
-    let mut hdr = [0u8; 7];
-    timeout(budget, stream.read_exact(&mut hdr))
-        .await
-        .ok()?
-        .ok()?;
-    // Reject non-Modbus replies (protocol id must be 0).
-    if hdr[2] != 0 || hdr[3] != 0 {
-        return None;
-    }
-    let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
-    if !(2..=260).contains(&plen) {
-        return None;
-    }
-    let mut body = vec![0u8; plen - 1]; // minus the unit id already in hdr[6]
-    timeout(budget, stream.read_exact(&mut body))
-        .await
-        .ok()?
-        .ok()?;
-    Some(body)
-}
-
-/// Parse vendor / product / revision from a Read Device Identification PDU:
-/// `[0x2B, 0x0E, readDevIdCode, conformity, moreFollows, nextObjId, numObjects,
-/// (objId, len, bytes…)…]`.
-fn parse_device_id(pdu: &[u8]) -> Option<DeviceId> {
-    if pdu.len() < 7 {
-        return None;
-    }
-    let num = pdu[6] as usize;
-    let mut i = 7;
-    let mut dev = DeviceId::default();
-    for _ in 0..num {
-        if i + 2 > pdu.len() {
-            break;
-        }
-        let id = pdu[i];
-        let l = pdu[i + 1] as usize;
-        i += 2;
-        if i + l > pdu.len() {
-            break;
-        }
-        let val = String::from_utf8_lossy(&pdu[i..i + l]).trim().to_string();
-        i += l;
-        match id {
-            0x00 => dev.vendor = Some(val),
-            0x01 => dev.product = Some(val),
-            0x02 => dev.revision = Some(val),
-            _ => {}
-        }
-    }
-    if dev == DeviceId::default() {
-        None
-    } else {
-        Some(dev)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    /// A one-shot mock Modbus/TCP server that answers a Read Holding Registers
-    /// request and a Read Device Identification request on one connection.
-    async fn mock_server(with_device: bool) -> std::net::SocketAddr {
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let addr = listener.local_addr().expect("addr");
-        tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.expect("accept");
-            loop {
-                let mut hdr = [0u8; 7];
-                if sock.read_exact(&mut hdr).await.is_err() {
-                    break;
-                }
-                let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
-                let mut pdu = vec![0u8; plen - 1];
-                if sock.read_exact(&mut pdu).await.is_err() {
-                    break;
-                }
-                let reply_pdu: Vec<u8> = match pdu.first() {
-                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register (byte_count 2)
-                    Some(0x01) => vec![0x01, 0x02, 0xFF, 0xFF], // 16 coils (byte_count 2)
-                    Some(0x2B) if with_device => vec![
-                        0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
-                        0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
-                        0x01, 0x03, b'P', b'L', b'C', // product
-                    ],
-                    _ => vec![pdu[0] | 0x80, 0x01], // exception
-                };
-                let len = (reply_pdu.len() + 1) as u16;
-                let mut frame = vec![hdr[0], hdr[1], 0x00, 0x00];
-                frame.extend_from_slice(&len.to_be_bytes());
-                frame.push(hdr[6]);
-                frame.extend_from_slice(&reply_pdu);
-                if sock.write_all(&frame).await.is_err() {
-                    break;
-                }
-            }
-        });
-        addr
-    }
-
-    #[tokio::test]
-    async fn probe_detects_a_modbus_endpoint_and_reads_device_id() {
-        let addr = mock_server(true).await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.reachable && p.speaks_modbus);
-        let dev = p.device.expect("device id");
-        assert_eq!(dev.vendor.as_deref(), Some("ACME"));
-        assert_eq!(dev.product.as_deref(), Some("PLC"));
-    }
-
-    #[tokio::test]
-    async fn probe_enumerates_exposed_process_points() {
-        let addr = mock_server(false).await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.speaks_modbus);
-        // The mock returns a 2-byte holding-register block (1 register) and a
-        // 2-byte coil block (16 coils).
-        assert_eq!(p.holding_registers_readable, Some(1));
-        assert_eq!(p.coils_readable, Some(16));
-    }
-
-    #[test]
-    fn reply_counts_decode_byte_counts() {
-        assert_eq!(register_count_from_reply(&[0x03, 0x08]), 4); // 8 bytes → 4 regs
-        assert_eq!(coil_count_from_reply(&[0x01, 0x03]), 24); // 3 bytes → 24 coils
-        assert_eq!(register_count_from_reply(&[0x03]), 0); // malformed → 0
-    }
-
-    #[tokio::test]
-    async fn probe_reports_unreachable_for_a_closed_port() {
-        // 127.0.0.1:1 is (almost certainly) closed.
-        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
-        assert!(!p.reachable && !p.speaks_modbus);
-    }
-
-    #[test]
-    fn parses_device_identification_objects() {
-        let pdu = [
-            0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x01, // 1 object
-            0x02, 0x05, b'v', b'1', b'.', b'2', b'3', // revision
-        ];
-        let dev = parse_device_id(&pdu).expect("device");
-        assert_eq!(dev.revision.as_deref(), Some("v1.23"));
-        assert!(dev.vendor.is_none());
-    }
-}

werkbank-exec/src/ics/opcua.rs

@@ -1,131 +0,0 @@
-//! Minimal OPC UA reachability probe.
-//!
-//! Speaks just the OPC UA Connection Protocol (UACP) handshake — a `HEL` (Hello)
-//! message, expecting an `ACK` (or `ERR`) reply — to confirm an OPC UA server is
-//! listening (default port 4840). It does **not** open a secure channel or make
-//! service calls; deep analysis of the server's SecurityPolicy / user-token
-//! policies (the common `None` + `Anonymous` misconfiguration) is a follow-on best
-//! done with a full OPC UA stack.
-
-use std::time::Duration;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Outcome of an OPC UA handshake probe.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct OpcUaProbe {
-    /// A TCP connection to the port was established.
-    pub reachable: bool,
-    /// The endpoint replied to the UACP Hello (`ACK`) or rejected it (`ERR`) —
-    /// either way it speaks OPC UA.
-    pub is_opcua: bool,
-}
-
-/// Probe an OPC UA endpoint with a UACP Hello. Read-only handshake only.
-pub async fn probe(host: &str, port: u16, budget: Duration) -> OpcUaProbe {
-    let mut out = OpcUaProbe::default();
-    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
-        return out;
-    };
-    out.reachable = true;
-
-    let hello = hello_message(&format!("opc.tcp://{host}:{port}"));
-    if timeout(budget, stream.write_all(&hello))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-
-    // Read the 3-byte message type of the reply: ACK (accepted) or ERR (rejected
-    // our hello) both prove the peer speaks the OPC UA connection protocol.
-    let mut mt = [0u8; 3];
-    if timeout(budget, stream.read_exact(&mut mt))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-    if &mt == b"ACK" || &mt == b"ERR" {
-        out.is_opcua = true;
-    }
-    out
-}
-
-/// Build a UACP `HEL` (Hello) message advertising our buffer sizes + endpoint URL.
-fn hello_message(endpoint_url: &str) -> Vec<u8> {
-    let url = endpoint_url.as_bytes();
-    let mut m = Vec::with_capacity(32 + url.len());
-    m.extend_from_slice(b"HELF");
-    m.extend_from_slice(&0u32.to_le_bytes()); // message size — patched below
-    m.extend_from_slice(&0u32.to_le_bytes()); // ProtocolVersion
-    m.extend_from_slice(&65536u32.to_le_bytes()); // ReceiveBufferSize
-    m.extend_from_slice(&65536u32.to_le_bytes()); // SendBufferSize
-    m.extend_from_slice(&0u32.to_le_bytes()); // MaxMessageSize (0 = no limit)
-    m.extend_from_slice(&0u32.to_le_bytes()); // MaxChunkCount
-    m.extend_from_slice(&(url.len() as i32).to_le_bytes()); // EndpointUrl length
-    m.extend_from_slice(url);
-    let size = m.len() as u32;
-    m[4..8].copy_from_slice(&size.to_le_bytes());
-    m
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    /// A mock OPC UA server that reads the Hello and replies with an `ACK` frame.
-    async fn mock_server() -> std::net::SocketAddr {
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let addr = listener.local_addr().expect("addr");
-        tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.expect("accept");
-            // Read the Hello header (8 bytes) to learn the size, then drain it.
-            let mut hdr = [0u8; 8];
-            if sock.read_exact(&mut hdr).await.is_err() {
-                return;
-            }
-            let size = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
-            let mut rest = vec![0u8; size.saturating_sub(8)];
-            let _ = sock.read_exact(&mut rest).await;
-            // Reply: ACK + size + 5 u32 fields.
-            let mut ack = Vec::new();
-            ack.extend_from_slice(b"ACKF");
-            ack.extend_from_slice(&28u32.to_le_bytes());
-            for _ in 0..5 {
-                ack.extend_from_slice(&0u32.to_le_bytes());
-            }
-            let _ = sock.write_all(&ack).await;
-        });
-        addr
-    }
-
-    #[tokio::test]
-    async fn probe_detects_an_opcua_server() {
-        let addr = mock_server().await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.reachable && p.is_opcua);
-    }
-
-    #[tokio::test]
-    async fn probe_reports_unreachable_for_a_closed_port() {
-        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
-        assert!(!p.reachable && !p.is_opcua);
-    }
-
-    #[test]
-    fn hello_message_is_well_formed() {
-        let m = hello_message("opc.tcp://h:4840");
-        assert_eq!(&m[0..4], b"HELF");
-        // The embedded size equals the actual length.
-        let size = u32::from_le_bytes([m[4], m[5], m[6], m[7]]) as usize;
-        assert_eq!(size, m.len());
-    }
-}

werkbank-exec/src/ics/portscan.rs

@@ -1,137 +0,0 @@
-//! TCP service discovery for a device.
-//!
-//! Connect-scans a curated set of OT/ICS and insecure-management ports and reports
-//! the ones that are open. The deep protocol probes own Modbus (502), OPC UA
-//! (4840) and EtherNet/IP (44818); this surfaces the *rest* of the industrial and
-//! cleartext-management surface (Siemens S7, DNP3, CODESYS programming, Telnet, …).
-
-use std::time::Duration;
-
-use futures_util::future::join_all;
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Whether an open port is an industrial protocol or an insecure management service.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PortKind {
-    /// An industrial control protocol (typically unauthenticated).
-    Ics,
-    /// A cleartext management service (credentials/data in the clear).
-    InsecureMgmt,
-}
-
-/// A well-known port worth flagging when open.
-#[derive(Debug, Clone, Copy)]
-pub struct KnownPort {
-    pub port: u16,
-    pub service: &'static str,
-    pub kind: PortKind,
-    pub note: &'static str,
-}
-
-/// The curated scan list. Excludes 502 / 4840 / 44818 — those have dedicated deep
-/// probes (Modbus, OPC UA, EtherNet/IP) that report richer findings.
-pub const KNOWN_PORTS: &[KnownPort] = &[
-    KnownPort {
-        port: 102,
-        service: "S7comm / ISO-TSAP",
-        kind: PortKind::Ics,
-        note: "Siemens S7 PLC communication",
-    },
-    KnownPort {
-        port: 20000,
-        service: "DNP3",
-        kind: PortKind::Ics,
-        note: "SCADA / DNP3",
-    },
-    KnownPort {
-        port: 1911,
-        service: "Niagara Fox",
-        kind: PortKind::Ics,
-        note: "Tridium Niagara building automation",
-    },
-    KnownPort {
-        port: 11740,
-        service: "CODESYS",
-        kind: PortKind::Ics,
-        note: "CODESYS programming protocol",
-    },
-    KnownPort {
-        port: 1962,
-        service: "PCWorx",
-        kind: PortKind::Ics,
-        note: "Phoenix Contact PCWorx",
-    },
-    KnownPort {
-        port: 9600,
-        service: "OMRON FINS",
-        kind: PortKind::Ics,
-        note: "Omron FINS",
-    },
-    KnownPort {
-        port: 789,
-        service: "Red Lion Crimson",
-        kind: PortKind::Ics,
-        note: "Red Lion controllers",
-    },
-    KnownPort {
-        port: 23,
-        service: "Telnet",
-        kind: PortKind::InsecureMgmt,
-        note: "cleartext remote shell",
-    },
-    KnownPort {
-        port: 21,
-        service: "FTP",
-        kind: PortKind::InsecureMgmt,
-        note: "cleartext file transfer",
-    },
-];
-
-/// Connect-scan `ports` on `host` (concurrently) and return those that accept a
-/// TCP connection.
-pub async fn scan<'a>(host: &str, ports: &'a [KnownPort], budget: Duration) -> Vec<&'a KnownPort> {
-    let checks = ports.iter().map(|kp| async move {
-        let open = timeout(budget, TcpStream::connect((host, kp.port)))
-            .await
-            .map(|r| r.is_ok())
-            .unwrap_or(false);
-        (kp, open)
-    });
-    join_all(checks)
-        .await
-        .into_iter()
-        .filter_map(|(kp, open)| open.then_some(kp))
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    #[tokio::test]
-    async fn scan_reports_only_open_ports() {
-        // Bind one port (open) and pick another that is closed.
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let open_port = listener.local_addr().expect("addr").port();
-
-        let ports = [
-            KnownPort {
-                port: open_port,
-                service: "test-open",
-                kind: PortKind::Ics,
-                note: "",
-            },
-            KnownPort {
-                port: 1,
-                service: "test-closed",
-                kind: PortKind::InsecureMgmt,
-                note: "",
-            },
-        ];
-        let found = scan("127.0.0.1", &ports, Duration::from_millis(500)).await;
-        let services: Vec<&str> = found.iter().map(|p| p.service).collect();
-        assert_eq!(services, vec!["test-open"]);
-    }
-}

werkbank-exec/src/lib.rs

@@ -1,18 +0,0 @@
-//! Shared dynamic-execution logic for Werkbank.
-//!
-//! The soft-PLC provisioning + industrial-protocol probing that turns a control-
-//! logic artifact into findings: provision an ephemeral OpenPLC, load the program,
-//! start it, probe it over Modbus/OPC-UA/EtherNet-IP, DAST its web endpoint, tear
-//! it down. Extracted from the compliance agent (#183) so both the agent (in
-//! process) and the Werkbank runner (WB-04) run identical logic.
-//!
-//! - [`ics`] — read-only industrial-protocol probing.
-//! - [`plc`] — ephemeral soft-PLC provisioning + the provision-and-test loop.
-
-pub mod error;
-pub mod ics;
-pub mod plc;
-
-mod fingerprint;
-
-pub use error::ExecError;

werkbank-exec/src/plc/mod.rs

@@ -1,422 +0,0 @@
-//! Dynamic PLC testing via an ephemeral soft-PLC (#183).
-//!
-//! When a PLC/SPS target ships control logic but no reachable live device, the
-//! agent instantiates that logic itself instead of trying to reach the customer's
-//! OT network: it provisions a throwaway soft-PLC (OpenPLC) container in-cluster,
-//! loads the program, starts the runtime, probes it over industrial protocols,
-//! then tears the instance down. No customer network access, sandboxed, and
-//! reproducible — destructive tests become safe because the target is ours.
-//!
-//! - [`provision`] owns the container lifecycle (sub-task 1 + 5).
-//! - [`openplc`] loads the program into the running instance (sub-task 2).
-//! - [`provision_and_test`] composes them with a hard deadline and guaranteed
-//!   teardown, and runs the ICS probe against the provisioned endpoint.
-
-pub mod openplc;
-pub mod provision;
-
-use std::path::Path;
-use std::time::Duration;
-
-use secrecy::ExposeSecret;
-
-use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
-use compliance_core::models::Finding;
-use compliance_core::PlcRuntimeConfig;
-
-use crate::error::ExecError;
-
-pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
-
-/// The result of a DAST scan against a provisioned web endpoint.
-#[derive(Debug)]
-pub struct DastRunResult {
-    /// The scan-run record (linked to the onboarded target).
-    pub scan_run: DastScanRun,
-    /// The DAST findings.
-    pub findings: Vec<DastFinding>,
-}
-
-/// Everything a provision-and-test run produced: the ICS-probe findings plus, if
-/// it ran, the DAST scan of the provisioned web endpoint. The caller persists
-/// both — keeping this a plain data return means the whole run is portable to a
-/// remote execution backend that just hands the results back.
-#[derive(Debug, Default)]
-pub struct ProvisionOutcome {
-    /// ICS-probe findings from the provisioned Modbus endpoint.
-    pub findings: Vec<Finding>,
-    /// DAST scan of the provisioned web endpoint, if it ran.
-    pub dast: Option<DastRunResult>,
-}
-
-/// A control-logic program ready to load into a soft-PLC: the source text plus a
-/// cosmetic file name (OpenPLC re-stores it under its own name).
-#[derive(Debug, Clone)]
-pub struct PlcProgram {
-    /// The original file name (for the upload form; OpenPLC renames on storage).
-    pub file_name: String,
-    /// The program source — Structured Text or PLCopen XML.
-    pub source: String,
-}
-
-/// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
-/// isolates the OpenPLC session (its Flask login cookie) from every other scan.
-pub fn http_client() -> Result<reqwest::Client, ExecError> {
-    reqwest::Client::builder()
-        .cookie_store(true)
-        .timeout(Duration::from_secs(30))
-        .build()
-        .map_err(ExecError::Http)
-}
-
-/// Pick the control-logic program to run from an ingested PLC source tree.
-///
-/// OpenPLC runs one program, so we choose the best single candidate: a complete
-/// Structured Text program (one carrying a `CONFIGURATION` block) is ideal;
-/// failing that the largest ST file; failing that a PLCopen XML export. Returns
-/// `None` when the tree holds no loadable control logic.
-pub fn extract_program(root: &Path) -> Option<PlcProgram> {
-    let mut st: Vec<(String, String)> = Vec::new();
-    let mut xml: Vec<(String, String)> = Vec::new();
-    for entry in walkdir::WalkDir::new(root)
-        .into_iter()
-        .filter_map(Result::ok)
-    {
-        if !entry.file_type().is_file() {
-            continue;
-        }
-        let path = entry.path();
-        let ext = path
-            .extension()
-            .and_then(|e| e.to_str())
-            .unwrap_or("")
-            .to_ascii_lowercase();
-        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
-        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
-        if !is_st && !is_xml {
-            continue;
-        }
-        let Ok(content) = std::fs::read_to_string(path) else {
-            continue;
-        };
-        let name = path
-            .file_name()
-            .and_then(|n| n.to_str())
-            .unwrap_or("program")
-            .to_string();
-        if is_st {
-            st.push((name, content));
-        } else if looks_like_plcopen(&content) {
-            xml.push((name, content));
-        }
-    }
-
-    if let Some((name, source)) = st.iter().find(|(_, c)| has_configuration(c)) {
-        return Some(PlcProgram {
-            file_name: name.clone(),
-            source: source.clone(),
-        });
-    }
-    if let Some((name, source)) = st.iter().max_by_key(|(_, c)| c.len()) {
-        return Some(PlcProgram {
-            file_name: name.clone(),
-            source: source.clone(),
-        });
-    }
-    xml.into_iter()
-        .max_by_key(|(_, c)| c.len())
-        .map(|(file_name, source)| PlcProgram { file_name, source })
-}
-
-/// Whether an ST source is a complete, runnable program (has a `CONFIGURATION`).
-fn has_configuration(source: &str) -> bool {
-    source.to_ascii_uppercase().contains("CONFIGURATION")
-}
-
-/// Whether an XML file looks like a PLCopen project export.
-fn looks_like_plcopen(source: &str) -> bool {
-    let lower = source.to_ascii_lowercase();
-    lower.contains("<project") || lower.contains("plcopen")
-}
-
-/// Provision an ephemeral soft-PLC, load `program`, start it, probe it over
-/// industrial protocols, and tear it down. Returns the ICS-probe findings.
-///
-/// Teardown is guaranteed: the load/probe work runs under a hard deadline
-/// (`max_lifetime_secs`) and the instance is removed afterwards on every path —
-/// success, error, or deadline expiry.
-pub async fn provision_and_test<P: SoftPlc>(
-    provisioner: &P,
-    http: &reqwest::Client,
-    cfg: &PlcRuntimeConfig,
-    program: &PlcProgram,
-    target_id: &str,
-) -> Result<ProvisionOutcome, ExecError> {
-    let handle = provisioner.provision(target_id).await?;
-    tracing::info!(
-        target_id,
-        instance = %handle.name,
-        modbus = %handle.modbus_endpoint,
-        "provisioned ephemeral soft-PLC"
-    );
-
-    let deadline = Duration::from_secs(cfg.max_lifetime_secs);
-    let result = tokio::time::timeout(
-        deadline,
-        run_dynamic_test(http, cfg, program, target_id, &handle),
-    )
-    .await;
-
-    // Guaranteed teardown — runs on success, error, and deadline expiry. The
-    // inner future is panic-free (the workspace lint bans unwrap/expect), so no
-    // unwind can skip this; a container leaked by an agent *crash* is swept by
-    // the next run's stale reaper.
-    provisioner.teardown(&handle).await;
-
-    match result {
-        Ok(inner) => inner,
-        Err(_) => {
-            tracing::warn!(
-                target_id,
-                instance = %handle.name,
-                "provision-and-test hit the lifetime deadline; torn down"
-            );
-            Ok(ProvisionOutcome::default())
-        }
-    }
-}
-
-/// The load → start → probe → DAST body, run under the caller's deadline.
-async fn run_dynamic_test(
-    http: &reqwest::Client,
-    cfg: &PlcRuntimeConfig,
-    program: &PlcProgram,
-    target_id: &str,
-    handle: &ProvisionedRuntime,
-) -> Result<ProvisionOutcome, ExecError> {
-    let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
-    openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
-
-    let compile_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
-    openplc::load_and_start(
-        http,
-        &handle.webvisu_url,
-        &cfg.openplc_user,
-        cfg.openplc_password.expose_secret(),
-        program,
-        compile_budget,
-    )
-    .await?;
-
-    // Give the runtime a moment to open the Modbus/TCP server before probing.
-    tokio::time::sleep(Duration::from_secs(3)).await;
-
-    let probe_budget = Duration::from_secs(5);
-    let findings = crate::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
-    tracing::info!(
-        target_id,
-        instance = %handle.name,
-        found = findings.len(),
-        "provision-and-test probe complete"
-    );
-
-    // DAST the provisioned web endpoint (independently bounded so it can't eat
-    // the whole lifetime). On the OpenPLC substrate this is OpenPLC's own web UI,
-    // not a customer HMI — the CODESYS-runtime follow-up raises the fidelity —
-    // but it proves the deploy→run→probe→DAST loop end to end.
-    let dast_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
-    let dast = match tokio::time::timeout(dast_budget, run_webvisu_dast(handle, target_id)).await {
-        Ok(d) => d,
-        Err(_) => {
-            tracing::warn!(target_id, instance = %handle.name, "provision-and-test DAST timed out");
-            None
-        }
-    };
-
-    Ok(ProvisionOutcome { findings, dast })
-}
-
-/// Run a bounded DAST scan against the provisioned web endpoint and tag the
-/// results with our target id. Best-effort — a DAST failure never fails the run.
-async fn run_webvisu_dast(handle: &ProvisionedRuntime, target_id: &str) -> Option<DastRunResult> {
-    let mut dt = DastTarget::new(
-        "provisioned-webvisu".to_string(),
-        handle.webvisu_url.clone(),
-        DastTargetType::WebApp,
-    );
-    dt.repo_id = Some(target_id.to_string());
-    dt.max_crawl_depth = 2; // shallow — the instance is ephemeral
-
-    let orchestrator = compliance_dast::DastOrchestrator::new(100);
-    match orchestrator.run_scan(&dt, Vec::new()).await {
-        Ok((mut scan_run, mut findings)) => {
-            scan_run.target_id = target_id.to_string();
-            for f in &mut findings {
-                f.target_id = target_id.to_string();
-            }
-            tracing::info!(
-                target_id,
-                instance = %handle.name,
-                dast_findings = findings.len(),
-                "provision-and-test DAST complete"
-            );
-            Some(DastRunResult { scan_run, findings })
-        }
-        Err(e) => {
-            tracing::warn!(target_id, instance = %handle.name, error = %e, "provision-and-test DAST failed");
-            None
-        }
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use std::sync::Arc;
-
-    /// A scratch dir removed on drop.
-    struct Scratch(std::path::PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-plc-rt-{}", uuid::Uuid::new_v4()));
-            std::fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    #[test]
-    fn extract_prefers_a_complete_st_program() {
-        let s = Scratch::new();
-        std::fs::write(s.0.join("fragment.st"), "PROGRAM P\nEND_PROGRAM\n").expect("w");
-        std::fs::write(
-            s.0.join("full.st"),
-            "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION Config0\n  RESOURCE R\nEND_CONFIGURATION\n",
-        )
-        .expect("w");
-        let prog = extract_program(&s.0).expect("program");
-        assert_eq!(prog.file_name, "full.st");
-        assert!(prog.source.contains("CONFIGURATION"));
-    }
-
-    #[test]
-    fn extract_falls_back_to_largest_st_then_plcopen() {
-        let s = Scratch::new();
-        std::fs::write(s.0.join("small.st"), "PROGRAM A\nEND_PROGRAM\n").expect("w");
-        std::fs::write(
-            s.0.join("big.st"),
-            "PROGRAM B\nVAR x : INT; y : INT; z : INT; END_VAR\nEND_PROGRAM\n",
-        )
-        .expect("w");
-        let prog = extract_program(&s.0).expect("program");
-        assert_eq!(
-            prog.file_name, "big.st",
-            "largest ST wins when none complete"
-        );
-
-        // Only a PLCopen XML present.
-        let s2 = Scratch::new();
-        std::fs::write(
-            s2.0.join("proj.xml"),
-            "<?xml version='1.0'?><project xmlns='http://www.plcopen.org/xml/tc6_0201'><pou/></project>",
-        )
-        .expect("w");
-        let prog2 = extract_program(&s2.0).expect("program");
-        assert_eq!(prog2.file_name, "proj.xml");
-    }
-
-    #[test]
-    fn extract_returns_none_without_control_logic() {
-        let s = Scratch::new();
-        std::fs::write(s.0.join("readme.md"), "# not a plc program").expect("w");
-        std::fs::write(s.0.join("data.xml"), "<config><db/></config>").expect("w");
-        assert!(extract_program(&s.0).is_none());
-    }
-
-    /// A fake provisioner recording provision/teardown calls, for lifecycle tests.
-    struct FakeSoftPlc {
-        provisions: Arc<AtomicUsize>,
-        teardowns: Arc<AtomicUsize>,
-        fail_provision: bool,
-    }
-
-    impl SoftPlc for FakeSoftPlc {
-        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
-            self.provisions.fetch_add(1, Ordering::SeqCst);
-            if self.fail_provision {
-                return Err(ExecError::Other("provision failed".into()));
-            }
-            // Unreachable address so run_dynamic_test blocks on readiness until the
-            // deadline fires — exercising the teardown-on-deadline path.
-            Ok(ProvisionedRuntime {
-                name: "fake-plc".into(),
-                modbus_endpoint: "fake-plc:502".into(),
-                webvisu_url: "http://fake-plc.invalid:8080".into(),
-            })
-        }
-        async fn teardown(&self, _handle: &ProvisionedRuntime) {
-            self.teardowns.fetch_add(1, Ordering::SeqCst);
-        }
-    }
-
-    fn short_cfg() -> PlcRuntimeConfig {
-        PlcRuntimeConfig {
-            enabled: true,
-            max_lifetime_secs: 1, // keep the deadline path fast
-            ..PlcRuntimeConfig::default()
-        }
-    }
-
-    #[tokio::test]
-    async fn teardown_runs_even_when_the_test_never_completes() {
-        let provisions = Arc::new(AtomicUsize::new(0));
-        let teardowns = Arc::new(AtomicUsize::new(0));
-        let fake = FakeSoftPlc {
-            provisions: provisions.clone(),
-            teardowns: teardowns.clone(),
-            fail_provision: false,
-        };
-        let http = http_client().expect("client");
-        let prog = PlcProgram {
-            file_name: "p.st".into(),
-            source: "PROGRAM P\nEND_PROGRAM\n".into(),
-        };
-        let out = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1")
-            .await
-            .expect("ok on deadline");
-        assert!(out.findings.is_empty(), "deadline path yields no findings");
-        assert!(out.dast.is_none(), "deadline path runs no DAST");
-        assert_eq!(provisions.load(Ordering::SeqCst), 1);
-        assert_eq!(teardowns.load(Ordering::SeqCst), 1, "teardown must run");
-    }
-
-    #[tokio::test]
-    async fn provision_failure_propagates_and_skips_teardown() {
-        let provisions = Arc::new(AtomicUsize::new(0));
-        let teardowns = Arc::new(AtomicUsize::new(0));
-        let fake = FakeSoftPlc {
-            provisions: provisions.clone(),
-            teardowns: teardowns.clone(),
-            fail_provision: true,
-        };
-        let http = http_client().expect("client");
-        let prog = PlcProgram {
-            file_name: "p.st".into(),
-            source: String::new(),
-        };
-        let err = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1").await;
-        assert!(err.is_err(), "provision failure propagates");
-        assert_eq!(provisions.load(Ordering::SeqCst), 1);
-        assert_eq!(
-            teardowns.load(Ordering::SeqCst),
-            0,
-            "nothing to tear down when provisioning failed"
-        );
-    }
-}

werkbank-exec/src/plc/openplc.rs

@@ -1,254 +0,0 @@
-//! Loading a control-logic program into a provisioned OpenPLC (#183, sub-task 2).
-//!
-//! Drives the OpenPLC v3 web UI over HTTP to turn a static control-logic artifact
-//! into a *running* PLC: log in, upload the program, save it, compile it (MatIEC),
-//! and start the runtime — at which point OpenPLC opens its Modbus/TCP server on
-//! 502 and the ICS probe has something to talk to. The endpoint sequence mirrors
-//! the OpenPLC web UI: `POST /login` → `POST /upload-program` (which hands back a
-//! server-assigned `prog_file`) → `POST /upload-program-action` →
-//! `GET /compile-program?file=<prog_file>` → `GET /start_plc`.
-
-use std::time::Duration;
-
-use crate::error::ExecError;
-
-use super::PlcProgram;
-
-/// Default OpenPLC program name/description recorded in its UI.
-const PROG_NAME: &str = "certifai-provisioned";
-const PROG_DESCR: &str = "Uploaded by the Certifai provision-and-test scan";
-
-/// Poll interval while waiting for readiness / compilation.
-const POLL_INTERVAL: Duration = Duration::from_secs(2);
-
-/// Wait until the OpenPLC web UI answers (any non-5xx reply to `/login`), or the
-/// budget elapses. A freshly-started container needs a few seconds to boot.
-pub async fn wait_ready(
-    http: &reqwest::Client,
-    base_url: &str,
-    budget: Duration,
-) -> Result<(), ExecError> {
-    let login = format!("{base_url}/login");
-    let outcome = tokio::time::timeout(budget, async {
-        loop {
-            if let Ok(resp) = http.get(&login).send().await {
-                if !resp.status().is_server_error() {
-                    return;
-                }
-            }
-            tokio::time::sleep(POLL_INTERVAL).await;
-        }
-    })
-    .await;
-    outcome.map_err(|_| ExecError::Other(format!("OpenPLC at {base_url} did not become ready")))
-}
-
-/// Log in, upload the program, compile it, and start the runtime. On success the
-/// OpenPLC Modbus/TCP server is listening on 502.
-pub async fn load_and_start(
-    http: &reqwest::Client,
-    base_url: &str,
-    user: &str,
-    password: &str,
-    program: &PlcProgram,
-    compile_budget: Duration,
-) -> Result<(), ExecError> {
-    login(http, base_url, user, password).await?;
-    let prog_file = upload_program(http, base_url, program).await?;
-    save_program(http, base_url, &prog_file).await?;
-    compile(http, base_url, &prog_file, compile_budget).await?;
-    start(http, base_url).await?;
-    Ok(())
-}
-
-/// `POST /login` — establishes the session cookie (the client must have a cookie
-/// store; see the provision-and-test entry point).
-async fn login(
-    http: &reqwest::Client,
-    base_url: &str,
-    user: &str,
-    password: &str,
-) -> Result<(), ExecError> {
-    let resp = http
-        .post(format!("{base_url}/login"))
-        .form(&[("username", user), ("password", password)])
-        .send()
-        .await?;
-    if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
-            "OpenPLC login failed: HTTP {}",
-            resp.status()
-        )));
-    }
-    Ok(())
-}
-
-/// `POST /upload-program` (multipart `file`) — OpenPLC stores the program under a
-/// server-assigned name and returns it in a hidden `prog_file` form field, which
-/// we parse out for the follow-up save/compile steps.
-async fn upload_program(
-    http: &reqwest::Client,
-    base_url: &str,
-    program: &PlcProgram,
-) -> Result<String, ExecError> {
-    let part = reqwest::multipart::Part::text(program.source.clone())
-        .file_name(program.file_name.clone())
-        .mime_str("application/octet-stream")?;
-    let form = reqwest::multipart::Form::new().part("file", part);
-    let resp = http
-        .post(format!("{base_url}/upload-program"))
-        .multipart(form)
-        .send()
-        .await?;
-    let html = resp.text().await?;
-    parse_prog_file(&html).ok_or_else(|| {
-        ExecError::Other("OpenPLC upload did not return a prog_file handle".to_string())
-    })
-}
-
-/// `POST /upload-program-action` — records the uploaded program in OpenPLC's
-/// program list. `epoch_time` must be close to the server's clock (OpenPLC
-/// rejects stale timestamps), so we send the current time.
-async fn save_program(
-    http: &reqwest::Client,
-    base_url: &str,
-    prog_file: &str,
-) -> Result<(), ExecError> {
-    let epoch = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-        .to_string();
-    let resp = http
-        .post(format!("{base_url}/upload-program-action"))
-        .form(&[
-            ("prog_name", PROG_NAME),
-            ("prog_descr", PROG_DESCR),
-            ("prog_file", prog_file),
-            ("epoch_time", &epoch),
-        ])
-        .send()
-        .await?;
-    if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
-            "OpenPLC save-program failed: HTTP {}",
-            resp.status()
-        )));
-    }
-    Ok(())
-}
-
-/// `GET /compile-program?file=<prog_file>` then poll `/compilation-logs` until
-/// MatIEC reports it finished (or the budget elapses). Errors if compilation
-/// finishes with errors — a program that won't compile can't be started.
-async fn compile(
-    http: &reqwest::Client,
-    base_url: &str,
-    prog_file: &str,
-    budget: Duration,
-) -> Result<(), ExecError> {
-    http.get(format!("{base_url}/compile-program"))
-        .query(&[("file", prog_file)])
-        .send()
-        .await?;
-
-    let logs_url = format!("{base_url}/compilation-logs");
-    let outcome = tokio::time::timeout(budget, async {
-        loop {
-            if let Ok(resp) = http.get(&logs_url).send().await {
-                if let Ok(text) = resp.text().await {
-                    if compilation_finished(&text) {
-                        return !compilation_failed(&text);
-                    }
-                }
-            }
-            tokio::time::sleep(POLL_INTERVAL).await;
-        }
-    })
-    .await;
-    match outcome {
-        Ok(true) => Ok(()),
-        Ok(false) => Err(ExecError::Other(
-            "OpenPLC compilation finished with errors".to_string(),
-        )),
-        Err(_) => Err(ExecError::Other(
-            "OpenPLC compilation did not finish in time".to_string(),
-        )),
-    }
-}
-
-/// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
-async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), ExecError> {
-    let resp = http.get(format!("{base_url}/start_plc")).send().await?;
-    if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
-            "OpenPLC start_plc failed: HTTP {}",
-            resp.status()
-        )));
-    }
-    Ok(())
-}
-
-/// Extract the server-assigned `prog_file` from the `/upload-program` response,
-/// which embeds it in a hidden input. Attribute order varies, so accept both
-/// `value=… name='prog_file'` and `name='prog_file' … value=…`.
-fn parse_prog_file(html: &str) -> Option<String> {
-    // The OpenPLC template renders `value='<name>.st' id='prog_file'
-    // name='prog_file'`. Match the value bound to that input, either order.
-    let value_then_name =
-        regex::Regex::new(r#"(?is)value=['"]([^'"]+)['"][^>]*name=['"]prog_file['"]"#).ok()?;
-    if let Some(c) = value_then_name.captures(html) {
-        return c.get(1).map(|m| m.as_str().to_string());
-    }
-    let name_then_value =
-        regex::Regex::new(r#"(?is)name=['"]prog_file['"][^>]*value=['"]([^'"]+)['"]"#).ok()?;
-    name_then_value
-        .captures(html)
-        .and_then(|c| c.get(1))
-        .map(|m| m.as_str().to_string())
-}
-
-/// Whether the MatIEC compilation log shows the build has finished (either way).
-fn compilation_finished(log: &str) -> bool {
-    log.contains("Compilation finished")
-}
-
-/// Whether a finished compilation ended in failure.
-fn compilation_failed(log: &str) -> bool {
-    log.contains("Compilation finished with errors")
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_prog_file_value_then_name() {
-        let html = "<form><input type='hidden' value='483927.st' id='prog_file' \
-                    name='prog_file'/></form>";
-        assert_eq!(parse_prog_file(html), Some("483927.st".to_string()));
-    }
-
-    #[test]
-    fn parses_prog_file_name_then_value() {
-        let html = r#"<input name="prog_file" id="prog_file" value="12.st" />"#;
-        assert_eq!(parse_prog_file(html), Some("12.st".to_string()));
-    }
-
-    #[test]
-    fn parse_prog_file_none_when_absent() {
-        assert_eq!(parse_prog_file("<html>no form here</html>"), None);
-    }
-
-    #[test]
-    fn compilation_predicates() {
-        assert!(!compilation_finished("Compiling..."));
-        assert!(compilation_finished(
-            "...\nCompilation finished successfully!\n"
-        ));
-        assert!(compilation_finished("Compilation finished with errors!"));
-        assert!(compilation_failed("Compilation finished with errors!"));
-        assert!(!compilation_failed("Compilation finished successfully!"));
-    }
-}

werkbank-exec/src/plc/provision.rs

@@ -1,306 +0,0 @@
-//! Ephemeral soft-PLC container lifecycle (#183, sub-task 1 + 5).
-//!
-//! Provisions a throwaway OpenPLC container per scan, isolated on the agent's own
-//! Docker network with hard resource caps and **no host port exposure**, then
-//! guarantees teardown. The container is reachable in-cluster only, by its name
-//! (the shared user-defined network's embedded DNS resolves it); it is never
-//! published to the host.
-//!
-//! The `docker` argv is produced by pure functions so provisioning is unit-tested
-//! without a Docker daemon — only the thin [`run_docker`] wrapper touches the OS.
-//! It requires the agent's runtime to have Docker access (a socket mount), which
-//! is why the whole path is gated behind [`PlcRuntimeConfig::enabled`].
-
-use std::time::{SystemTime, UNIX_EPOCH};
-
-use compliance_core::PlcRuntimeConfig;
-
-use crate::error::ExecError;
-
-/// The Modbus/TCP port an OpenPLC instance opens once a program is running.
-const MODBUS_PORT: u16 = 502;
-/// The OpenPLC web-UI / WebVisu port.
-const WEBVISU_PORT: u16 = 8080;
-
-/// Label key marking a container as an ephemeral PLC runtime we own.
-const OWNER_LABEL_KEY: &str = "certifai.ephemeral";
-/// Label value for our ephemeral PLC runtimes.
-const OWNER_LABEL_VALUE: &str = "plc-runtime";
-
-/// A running ephemeral soft-PLC instance. Reachable in-cluster by `name`.
-#[derive(Debug, Clone)]
-pub struct ProvisionedRuntime {
-    /// The container name — also its in-network DNS alias.
-    pub name: String,
-    /// `name:502` — the Modbus/TCP endpoint the ICS probe targets.
-    pub modbus_endpoint: String,
-    /// `http://name:8080` — the WebVisu / OpenPLC web UI.
-    pub webvisu_url: String,
-}
-
-/// A source of ephemeral soft-PLC instances. Abstracted so the provision-and-test
-/// orchestration is unit-testable with a fake that never touches Docker.
-pub trait SoftPlc {
-    /// Start a fresh instance for a target and return its handle.
-    fn provision(
-        &self,
-        target_id: &str,
-    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, ExecError>> + Send;
-
-    /// Tear an instance down. Best-effort and idempotent — never fails the scan.
-    fn teardown(&self, handle: &ProvisionedRuntime)
-        -> impl std::future::Future<Output = ()> + Send;
-}
-
-/// Provisions OpenPLC instances by shelling out to the Docker CLI.
-pub struct DockerSoftPlc {
-    cfg: PlcRuntimeConfig,
-}
-
-impl DockerSoftPlc {
-    /// Build a provisioner from the PLC-runtime config.
-    pub fn new(cfg: PlcRuntimeConfig) -> Self {
-        Self { cfg }
-    }
-}
-
-impl SoftPlc for DockerSoftPlc {
-    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
-        // Best-effort sweep of any container leaked by a crashed earlier run
-        // before we add another. Only removes instances past their max lifetime,
-        // so it can never disturb a concurrent run.
-        reap_stale(&self.cfg, now_epoch()).await;
-
-        let name = instance_name(target_id, now_epoch(), &random_suffix());
-        let args = run_args(&self.cfg, &name, target_id);
-        let out = run_docker(&args).await?;
-        if !out.status.success() {
-            return Err(ExecError::Other(format!(
-                "docker run for soft-PLC {name} failed: {}",
-                String::from_utf8_lossy(&out.stderr).trim()
-            )));
-        }
-        Ok(ProvisionedRuntime {
-            modbus_endpoint: format!("{name}:{MODBUS_PORT}"),
-            webvisu_url: format!("http://{name}:{WEBVISU_PORT}"),
-            name,
-        })
-    }
-
-    async fn teardown(&self, handle: &ProvisionedRuntime) {
-        match run_docker(&rm_args(&handle.name)).await {
-            Ok(out) if out.status.success() => {
-                tracing::info!(instance = %handle.name, "soft-PLC instance torn down");
-            }
-            Ok(out) => tracing::warn!(
-                instance = %handle.name,
-                "soft-PLC teardown non-zero exit: {}",
-                String::from_utf8_lossy(&out.stderr).trim()
-            ),
-            Err(e) => {
-                tracing::warn!(instance = %handle.name, error = %e, "soft-PLC teardown failed")
-            }
-        }
-    }
-}
-
-/// Seconds since the Unix epoch (0 if the clock is before 1970, which never
-/// happens in practice).
-fn now_epoch() -> u64 {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_secs())
-        .unwrap_or(0)
-}
-
-/// A short random, docker-name-safe suffix.
-fn random_suffix() -> String {
-    uuid::Uuid::new_v4().simple().to_string()
-}
-
-/// A unique, docker-safe container name that encodes the creation epoch (for the
-/// stale reaper) and the target it belongs to. Shape:
-/// `certifai-plc-<epoch>-<target12>-<rand6>`.
-fn instance_name(target_id: &str, epoch: u64, rand: &str) -> String {
-    let short: String = target_id
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(12)
-        .collect();
-    let rand: String = rand
-        .chars()
-        .filter(char::is_ascii_alphanumeric)
-        .take(6)
-        .collect();
-    format!("certifai-plc-{epoch}-{short}-{rand}")
-}
-
-/// The creation epoch encoded in an instance name, if it is one of ours.
-fn parse_epoch(name: &str) -> Option<u64> {
-    name.strip_prefix("certifai-plc-")?
-        .split('-')
-        .next()?
-        .parse()
-        .ok()
-}
-
-/// The `docker run` argv for an ephemeral soft-PLC: detached, joined to the
-/// agent's network, resource-capped, hardened, labelled for reaping, and — by
-/// omitting any `-p` — never published to the host.
-fn run_args(cfg: &PlcRuntimeConfig, name: &str, target_id: &str) -> Vec<String> {
-    vec![
-        "run".into(),
-        "-d".into(),
-        "--name".into(),
-        name.into(),
-        "--network".into(),
-        cfg.network.clone(),
-        "--memory".into(),
-        cfg.memory.clone(),
-        "--cpus".into(),
-        cfg.cpus.clone(),
-        "--pids-limit".into(),
-        "512".into(),
-        "--security-opt".into(),
-        "no-new-privileges".into(),
-        "--stop-timeout".into(),
-        "5".into(),
-        "--label".into(),
-        format!("{OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
-        "--label".into(),
-        format!("certifai.target={target_id}"),
-        cfg.image.clone(),
-    ]
-}
-
-/// The `docker rm -f` argv that stops and removes an instance.
-fn rm_args(name: &str) -> Vec<String> {
-    vec!["rm".into(), "-f".into(), name.into()]
-}
-
-/// The `docker ps` argv listing the names of every ephemeral PLC container we own.
-fn reap_list_args() -> Vec<String> {
-    vec![
-        "ps".into(),
-        "-a".into(),
-        "--filter".into(),
-        format!("label={OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
-        "--format".into(),
-        "{{.Names}}".into(),
-    ]
-}
-
-/// Remove any ephemeral PLC container older than twice the configured max
-/// lifetime — i.e. one a crashed run leaked. The generous threshold guarantees a
-/// container from a *live* run (still within its own deadline) is never swept.
-/// Best-effort: any Docker error (e.g. no daemon) is ignored.
-async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
-    let cutoff = cfg.max_lifetime_secs.saturating_mul(2);
-    let Ok(out) = run_docker(&reap_list_args()).await else {
-        return;
-    };
-    if !out.status.success() {
-        return;
-    }
-    let names = String::from_utf8_lossy(&out.stdout);
-    for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
-        let Some(epoch) = parse_epoch(name) else {
-            continue;
-        };
-        if now.saturating_sub(epoch) > cutoff {
-            tracing::warn!(instance = %name, "reaping stale soft-PLC instance");
-            let _ = run_docker(&rm_args(name)).await;
-        }
-    }
-}
-
-/// Run a `docker` subcommand, capturing its output.
-async fn run_docker(args: &[String]) -> Result<std::process::Output, ExecError> {
-    tokio::process::Command::new("docker")
-        .args(args)
-        .output()
-        .await
-        .map_err(ExecError::Io)
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn cfg() -> PlcRuntimeConfig {
-        PlcRuntimeConfig {
-            enabled: true,
-            image: "registry.example.com/openplc:latest".into(),
-            network: "certifai".into(),
-            memory: "512m".into(),
-            cpus: "0.5".into(),
-            max_lifetime_secs: 180,
-            ..PlcRuntimeConfig::default()
-        }
-    }
-
-    #[test]
-    fn instance_name_is_unique_docker_safe_and_reaper_parseable() {
-        let a = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "abcdef123456");
-        assert_eq!(a, "certifai-plc-1700000000-64f0aabbccdd-abcdef");
-        assert_eq!(parse_epoch(&a), Some(1_700_000_000));
-        // Docker names: only [A-Za-z0-9_.-].
-        assert!(a
-            .chars()
-            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')));
-        // A different random suffix yields a different name for the same target.
-        let b = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "zzzzzz999999");
-        assert_ne!(a, b);
-    }
-
-    #[test]
-    fn parse_epoch_rejects_foreign_names() {
-        assert_eq!(parse_epoch("some-other-container"), None);
-        assert_eq!(parse_epoch("certifai-plc-notanumber-x"), None);
-    }
-
-    #[test]
-    fn run_args_cap_resources_harden_label_and_never_publish_a_port() {
-        let args = run_args(&cfg(), "certifai-plc-1-t-r", "target-123");
-        // No host port publishing.
-        assert!(!args.iter().any(|a| a == "-p" || a == "--publish"));
-        // Detached.
-        assert!(args.contains(&"-d".to_string()));
-        // Joined to the agent's own network.
-        let net = args.iter().position(|a| a == "--network").expect("network");
-        assert_eq!(args[net + 1], "certifai");
-        // Resource caps.
-        let mem = args.iter().position(|a| a == "--memory").expect("memory");
-        assert_eq!(args[mem + 1], "512m");
-        let cpu = args.iter().position(|a| a == "--cpus").expect("cpus");
-        assert_eq!(args[cpu + 1], "0.5");
-        assert!(args.iter().any(|a| a == "--pids-limit"));
-        // Hardening.
-        let so = args
-            .iter()
-            .position(|a| a == "--security-opt")
-            .expect("secopt");
-        assert_eq!(args[so + 1], "no-new-privileges");
-        // Ownership + target labels for reaping / attribution.
-        assert!(args.contains(&"certifai.ephemeral=plc-runtime".to_string()));
-        assert!(args.contains(&"certifai.target=target-123".to_string()));
-        // Image is last.
-        assert_eq!(
-            args.last().map(String::as_str),
-            Some("registry.example.com/openplc:latest")
-        );
-    }
-
-    #[test]
-    fn rm_args_force_remove() {
-        assert_eq!(rm_args("x"), vec!["rm", "-f", "x"]);
-    }
-
-    #[test]
-    fn reap_list_filters_by_owner_label() {
-        let args = reap_list_args();
-        assert!(args.contains(&"label=certifai.ephemeral=plc-runtime".to_string()));
-        assert!(args.contains(&"{{.Names}}".to_string()));
-    }
-}