feat(pipeline): unified run_target execution behind UNIFIED_PIPELINE (#133 part 2)

Wire the scan-plan builder into a runnable pipeline that scans an OnboardedTarget:
- AgentConfig.unified_pipeline (env UNIFIED_PIPELINE, default off). agent.run_scan
  dispatches to run_target when set, else the legacy run().
- orchestrator::run_target: loads the target from onboarded_targets, creates a
  ScanRun, and runs run_target_pipeline; run_target_pipeline builds the scan plan
  and, for a code (git) artifact, reuses the full legacy pipeline via a
  TrackedRepository view (clone → SAST umbrella → triage → persist → issues →
  DAST) then syncs findings_count + the git watermark back to the target.
  Firmware/PLC/mobile scanners are follow-ups (#128/#129/#130); URL-only targets
  attempt DAST.
- repo_view_from_target: inverse of the migration's repo_to_target, _id-preserving.

Additive + flag-gated: the legacy path is unchanged and default. Unit tests for
repo_view_from_target (+ the part-1 build_scan_plan tests). Full E2E verification
is via UNIFIED_PIPELINE=1 on a running instance.

Closes #133.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/src/agent.rs

@@ -63,8 +63,12 @@ impl ComplianceAgent {
         let db = self.db_pool.for_tenant_id(tenant_id).await?;
         let orchestrator =
             PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+        if self.config.unified_pipeline {
+            orchestrator.run_target(repo_id, trigger).await
+        } else {
             orchestrator.run(repo_id, trigger).await
         }
+    }
 
     /// Run a PR review: scan the diff and post review comments.
     pub async fn run_pr_review(

compliance-agent/src/api/handlers/mod.rs

@@ -9,6 +9,7 @@ pub mod help_chat;
 pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod repos;

compliance-agent/src/api/handlers/onboarding.rs

@@ -0,0 +1,350 @@
+//! Onboarding API — CRUD for unified targets, artifact add, classification, and
+//! the scan-applicability matrix. The wizard (and future integrations) drive
+//! onboarding through these endpoints.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use axum::extract::{Extension, Path, Query};
+use axum::http::StatusCode;
+use axum::Json;
+use mongodb::bson::{doc, oid::ObjectId, to_bson};
+use serde::{Deserialize, Serialize};
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
+    TargetType,
+};
+use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
+use compliance_core::tenant_ctx::TenantCtx;
+
+use crate::agent::ComplianceAgent;
+use crate::classify::{classify_target, MockFirmwareDetector};
+
+use super::dto::tenant_db;
+use super::{collect_cursor_async, ApiResponse, PaginationParams};
+
+type AgentExt = Extension<Arc<ComplianceAgent>>;
+
+/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
+/// id) from it, so clients never set internal fields.
+#[derive(Deserialize)]
+pub struct ArtifactInput {
+    pub kind: ArtifactKind,
+    pub source_ref: String,
+    #[serde(default)]
+    pub branch: Option<String>,
+    #[serde(default)]
+    pub plc_format: Option<PlcFormat>,
+}
+
+impl ArtifactInput {
+    fn build(&self) -> Artifact {
+        let s = self.source_ref.clone();
+        match self.kind {
+            ArtifactKind::GitRepo => {
+                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
+            }
+            ArtifactKind::LiveUrl => Artifact::live_url(s),
+            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
+            ArtifactKind::SourceArchive => Artifact::source_archive(s),
+            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
+            ArtifactKind::ContainerImage => Artifact::container_image(s),
+            ArtifactKind::PlcProject => {
+                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
+            }
+            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub struct CreateTargetRequest {
+    pub name: String,
+    pub target_type: TargetType,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub artifacts: Vec<ArtifactInput>,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateTargetRequest {
+    pub name: Option<String>,
+    pub target_type: Option<TargetType>,
+    pub scan_config: Option<TargetScanConfig>,
+    pub compliance_profile: Option<ComplianceProfile>,
+    pub scan_schedule: Option<String>,
+}
+
+/// One applicable-scan option, serialized for the wizard.
+#[derive(Serialize)]
+pub struct ScanOptionDto {
+    pub scan: String,
+    pub default_on: bool,
+    pub rationale: String,
+    pub required_artifact: Option<String>,
+    pub blocked_reason: Option<String>,
+}
+
+#[derive(Serialize)]
+pub struct ApplicableScansResponse {
+    pub scans: Vec<ScanOptionDto>,
+    pub pentest_supported: bool,
+}
+
+fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
+    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+/// GET /api/v1/targets — list onboarded targets (paginated).
+#[tracing::instrument(skip_all)]
+pub async fn list_targets(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
+    let db = tenant_db(&agent, &tenant).await?;
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = db
+        .onboarded_targets()
+        .count_documents(doc! {})
+        .await
+        .unwrap_or(0);
+    let targets = match db
+        .onboarded_targets()
+        .find(doc! {})
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch onboarded targets: {e}");
+            Vec::new()
+        }
+    };
+    Ok(Json(ApiResponse {
+        data: targets,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+/// POST /api/v1/targets — create an onboarded target.
+#[tracing::instrument(skip_all)]
+pub async fn create_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<CreateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let mut target = OnboardedTarget::new(req.name, req.target_type);
+    target.description = req.description;
+    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
+
+    let db = tenant_db(&agent, &tenant).await?;
+    let res = db
+        .onboarded_targets()
+        .insert_one(&target)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.id = res.inserted_id.as_object_id();
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/targets/{id} — fetch one target.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn get_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// PATCH /api/v1/targets/{id} — update mutable fields.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn update_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+
+    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
+    if let Some(name) = req.name {
+        set.insert("name", name);
+    }
+    if let Some(tt) = req.target_type {
+        set.insert(
+            "target_type",
+            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(sc) = req.scan_config {
+        set.insert(
+            "scan_config",
+            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(cp) = req.compliance_profile {
+        set.insert(
+            "compliance_profile",
+            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(ss) = req.scan_schedule {
+        set.insert("scan_schedule", ss);
+    }
+
+    db.onboarded_targets()
+        .update_one(doc! { "_id": oid }, doc! { "$set": set })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn delete_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    db.onboarded_targets()
+        .delete_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    // Cascade the collections keyed by repo_id == target id (best-effort).
+    let by_repo = doc! { "repo_id": &id };
+    let _ = db.findings().delete_many(by_repo.clone()).await;
+    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
+    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
+    let _ = db.cve_alerts().delete_many(by_repo).await;
+    Ok(Json(serde_json::json!({ "status": "deleted" })))
+}
+
+/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn add_artifact(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(input): Json<ArtifactInput>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn applicable_scans_for_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    let scans = applicable_scans(&target)
+        .into_iter()
+        .map(|o| ScanOptionDto {
+            scan: o.scan.to_string(),
+            default_on: o.default_on,
+            rationale: o.rationale,
+            required_artifact: o.required_artifact.map(|k| k.to_string()),
+            blocked_reason: o.blocked_reason,
+        })
+        .collect();
+
+    Ok(Json(ApiResponse {
+        data: ApplicableScansResponse {
+            scans,
+            pentest_supported: supports_pentest(target.target_type),
+        },
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
+///
+/// This is the lightweight pass: it classifies from artifact kinds without
+/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
+/// ingest, with tramiton firmware analysis) is a follow-up background step.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn detect_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let mut target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // No ingested working paths here → kind-based classification only; the mock
+    // firmware detector is never invoked (no firmware working path present).
+    let empty = HashMap::new();
+    let detector = MockFirmwareDetector { detection: None };
+    let classification = classify_target(&target, &empty, &detector)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let classification_bson =
+        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.classification = Some(classification);
+
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}

compliance-agent/src/api/routes.rs

@@ -25,6 +25,29 @@ pub fn build_router() -> Router {
             "/api/v1/repositories/{id}/webhook-config",
             get(handlers::get_webhook_config),
         )
+        // Unified onboarding targets (#131).
+        .route(
+            "/api/v1/targets",
+            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
+        )
+        .route(
+            "/api/v1/targets/{id}",
+            get(handlers::onboarding::get_target)
+                .patch(handlers::onboarding::update_target)
+                .delete(handlers::onboarding::delete_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/artifacts",
+            post(handlers::onboarding::add_artifact),
+        )
+        .route(
+            "/api/v1/targets/{id}/applicable-scans",
+            get(handlers::onboarding::applicable_scans_for_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/detect",
+            post(handlers::onboarding::detect_target),
+        )
         .route("/api/v1/findings", get(handlers::list_findings))
         .route("/api/v1/findings/{id}", get(handlers::get_finding))
         .route(

compliance-agent/src/config.rs

@@ -47,6 +47,9 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
         artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
+        unified_pipeline: env_var_opt("UNIFIED_PIPELINE")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(false),
         ssh_key_path: env_var_opt("SSH_KEY_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),

compliance-agent/src/database.rs

@@ -179,6 +179,23 @@ impl DatabasePool {
             .collect())
     }
 
+    /// Tenant ids for every provisioned tenant database, derived by stripping
+    /// the `<prefix>_` from the database names. Skips the admin database
+    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
+    /// at the cluster level and cannot be recovered here — in practice tenant
+    /// ids are UUIDs and never hit that path. Used by the migration CLI's
+    /// `--all` mode.
+    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
+        let prefix = format!("{}_", self.db_prefix);
+        Ok(self
+            .list_tenant_db_names()
+            .await?
+            .into_iter()
+            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
+            .filter(|id| !id.starts_with('_'))
+            .collect())
+    }
+
     /// Drop the database for a specific tenant. Used by GDPR delete
     /// and tenant offboarding. Idempotent — dropping a non-existent
     /// database is a no-op at the driver level.
@@ -521,6 +538,13 @@ impl Database {
         self.inner.collection("onboarded_targets")
     }
 
+    /// A typed handle to an arbitrary collection by name. For bookkeeping
+    /// collections without a dedicated model (e.g. `schema_migrations`,
+    /// `onboarding_migration_log`).
+    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
+        self.inner.collection(name)
+    }
+
     pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
         self.inner.collection("dast_scan_runs")
     }

compliance-agent/src/lib.rs

@@ -8,6 +8,7 @@ pub mod database;
 pub mod error;
 pub mod ingest;
 pub mod llm;
+pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;

compliance-agent/src/main.rs

@@ -1,4 +1,50 @@
-use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
+use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
+
+/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
+/// unified `onboarded_targets` collection per tenant.
+///
+/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
+async fn run_migration(
+    args: &[String],
+    pool: &database::DatabasePool,
+) -> Result<(), compliance_agent::error::AgentError> {
+    if args.get(2).map(String::as_str) != Some("onboarding") {
+        eprintln!(
+            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
+        );
+        std::process::exit(2);
+    }
+    let has = |flag: &str| args.iter().any(|a| a == flag);
+    let dry_run = has("--dry-run");
+    let revert = has("--revert");
+    let tenant = args
+        .iter()
+        .position(|a| a == "--tenant")
+        .and_then(|i| args.get(i + 1))
+        .cloned();
+
+    let tenants: Vec<String> = if has("--all") {
+        pool.list_tenant_ids().await?
+    } else if let Some(t) = tenant {
+        vec![t]
+    } else {
+        eprintln!("specify --all or --tenant <id>");
+        std::process::exit(2);
+    };
+
+    for tenant_id in tenants {
+        let db = pool.for_tenant_id(&tenant_id).await?;
+        if revert {
+            migrate::onboarding::revert(&db).await?;
+            println!("[{tenant_id}] reverted onboarding backfill");
+        } else {
+            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
+            let prefix = if dry_run { "(dry-run) " } else { "" };
+            println!("[{tenant_id}] {prefix}{report:?}");
+        }
+    }
+    Ok(())
+}
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -31,6 +77,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let db_pool =
         database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
+    // One-shot subcommands run and exit without starting the servers.
+    let args: Vec<String> = std::env::args().collect();
+    if args.get(1).map(String::as_str) == Some("migrate") {
+        run_migration(&args, &db_pool).await?;
+        return Ok(());
+    }
+
     let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
 
     tracing::info!("Starting scheduler...");

compliance-agent/src/migrate/mod.rs

@@ -0,0 +1,8 @@
+//! One-time data migrations.
+//!
+//! Currently just the onboarding backfill ([`onboarding`]), which folds the
+//! legacy `repositories` and `dast_targets` collections into the unified
+//! `onboarded_targets` collection, preserving `_id` so every downstream record
+//! keyed by `repo_id` / `target_id` keeps resolving.
+
+pub mod onboarding;

compliance-agent/src/migrate/onboarding.rs

@@ -0,0 +1,406 @@
+//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
+//!
+//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
+//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
+//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
+//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
+//! existing webhook URLs keep working. The mapping functions are pure and unit
+//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
+//! thin driver over them.
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
+    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
+};
+use futures_util::TryStreamExt;
+use mongodb::bson::{doc, Document};
+
+use crate::database::Database;
+use crate::error::AgentError;
+
+/// Marker id in `schema_migrations` recording that the backfill has run.
+const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
+
+/// Summary of a backfill run.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct MigrationReport {
+    /// Repositories turned into onboarded targets.
+    pub repos_migrated: u64,
+    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
+    pub dast_targets_folded: u64,
+    /// DAST targets with no repo link, migrated as standalone targets.
+    pub dast_targets_standalone: u64,
+    /// Records skipped because a target with that `_id` already existed.
+    pub skipped_existing: u64,
+}
+
+/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
+/// are backend services; a browser app is a web app.
+fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
+    match kind {
+        DastTargetType::WebApp => TargetType::WebApp,
+        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
+    }
+}
+
+/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
+/// auth). Shared by fold-in and standalone migration.
+pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
+    let mut artifact = Artifact::live_url(dast.base_url.clone());
+    artifact.web = Some(WebArtifactConfig {
+        target_kind: dast.target_type.clone(),
+        excluded_paths: dast.excluded_paths.clone(),
+        max_crawl_depth: dast.max_crawl_depth,
+        rate_limit: dast.rate_limit,
+        allow_destructive: dast.allow_destructive,
+    });
+    artifact.auth = dast.auth_config.clone().map(Into::into);
+    artifact
+}
+
+/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
+/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
+/// and auth; tracker config folds into `scan_config`.
+///
+/// `target_type` is a safe default (`BackendService`) — the classifier can
+/// refine it later; `classification` is left `None` (unconfirmed).
+pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
+    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
+    target.id = repo.id;
+
+    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
+    artifact.git = Some(GitArtifactConfig {
+        default_branch: repo.default_branch.clone(),
+        last_scanned_commit: repo.last_scanned_commit.clone(),
+        local_path: repo.local_path.clone(),
+    });
+    if repo.auth_token.is_some() || repo.auth_username.is_some() {
+        artifact.auth = Some(compliance_core::models::ArtifactAuth {
+            method: "token".to_string(),
+            username: repo.auth_username.clone(),
+            secret: repo.auth_token.clone(),
+            ..Default::default()
+        });
+    }
+    target.artifacts.push(artifact);
+
+    if repo.tracker_type.is_some() {
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: repo.tracker_type.clone(),
+            owner: repo.tracker_owner.clone(),
+            repo: repo.tracker_repo.clone(),
+            token: repo.tracker_token.clone(),
+        });
+    }
+
+    target.scan_schedule = repo.scan_schedule.clone();
+    target.webhook_enabled = repo.webhook_enabled;
+    target.webhook_secret = repo.webhook_secret.clone();
+    target.findings_count = repo.findings_count;
+    target.created_at = repo.created_at;
+    target.updated_at = repo.updated_at;
+    target
+}
+
+/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
+/// target. If the repo default was `BackendService` but the DAST target is a
+/// browser web app, promote the type to `WebApp`.
+pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
+    if matches!(dast.target_type, DastTargetType::WebApp)
+        && target.target_type == TargetType::BackendService
+    {
+        target.target_type = TargetType::WebApp;
+    }
+    if !target.has(ArtifactKind::LiveUrl) {
+        target.artifacts.push(dast_to_artifact(dast));
+    }
+}
+
+/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
+pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
+    let mut target =
+        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
+    target.id = dast.id;
+    target.artifacts.push(dast_to_artifact(dast));
+    target.created_at = dast.created_at;
+    target.updated_at = dast.updated_at;
+    target
+}
+
+/// Whether the onboarding backfill has already been applied to this database.
+pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
+    let found = db
+        .collection_named::<Document>("schema_migrations")
+        .find_one(doc! { "_id": MIGRATION_MARKER })
+        .await?;
+    Ok(found.is_some())
+}
+
+/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
+/// tenant database.
+///
+/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
+/// skipped, so re-running is safe. With `dry_run`, computes the report without
+/// writing. The legacy collections are never deleted; the only mutation outside
+/// `onboarded_targets` is the history relink of folded DAST targets, which is
+/// logged so [`revert`] can undo it.
+pub async fn backfill_onboarded_targets(
+    db: &Database,
+    dry_run: bool,
+) -> Result<MigrationReport, AgentError> {
+    let mut report = MigrationReport::default();
+
+    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
+    let mut repos = db.repositories().find(doc! {}).await?;
+    while let Some(repo) = repos.try_next().await? {
+        let Some(id) = repo.id else { continue };
+        if db
+            .onboarded_targets()
+            .find_one(doc! { "_id": id })
+            .await?
+            .is_some()
+        {
+            report.skipped_existing += 1;
+            continue;
+        }
+        if !dry_run {
+            db.onboarded_targets()
+                .insert_one(repo_to_target(&repo))
+                .await?;
+        }
+        report.repos_migrated += 1;
+    }
+
+    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
+    let mut dasts = db.dast_targets().find(doc! {}).await?;
+    while let Some(dast) = dasts.try_next().await? {
+        let Some(dast_id) = dast.id else { continue };
+        let repo_oid = dast
+            .repo_id
+            .as_deref()
+            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
+        let linked = match repo_oid {
+            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
+            None => None,
+        };
+
+        match (linked, repo_oid) {
+            // Fold into an existing repo-derived target.
+            (Some(mut target), Some(oid)) => {
+                if target.has(ArtifactKind::LiveUrl) {
+                    report.skipped_existing += 1; // already folded on a prior run
+                    continue;
+                }
+                fold_dast_into_target(&mut target, &dast);
+                if !dry_run {
+                    db.onboarded_targets()
+                        .replace_one(doc! { "_id": oid }, &target)
+                        .await?;
+                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
+                }
+                report.dast_targets_folded += 1;
+            }
+            // No linked repo target: migrate as a standalone target (keeps _id).
+            _ => {
+                if db
+                    .onboarded_targets()
+                    .find_one(doc! { "_id": dast_id })
+                    .await?
+                    .is_some()
+                {
+                    report.skipped_existing += 1;
+                    continue;
+                }
+                if !dry_run {
+                    db.onboarded_targets()
+                        .insert_one(dast_to_standalone_target(&dast))
+                        .await?;
+                }
+                report.dast_targets_standalone += 1;
+            }
+        }
+    }
+
+    if !dry_run {
+        db.collection_named::<Document>("schema_migrations")
+            .update_one(
+                doc! { "_id": MIGRATION_MARKER },
+                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
+            )
+            .upsert(true)
+            .await?;
+    }
+    Ok(report)
+}
+
+/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
+/// unified target id, logging each move so [`revert`] can undo it.
+///
+/// Note: if multiple DAST targets fold into the same repo target, revert
+/// restores only the last-logged mapping — a rare edge. The source collections
+/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
+async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
+    db.dast_scan_runs()
+        .update_many(
+            doc! { "target_id": old_id },
+            doc! { "$set": { "target_id": new_id } },
+        )
+        .await?;
+    db.pentest_sessions()
+        .update_many(
+            doc! { "target_id": old_id },
+            doc! { "$set": { "target_id": new_id } },
+        )
+        .await?;
+    db.collection_named::<Document>("onboarding_migration_log")
+        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
+        .await?;
+    Ok(())
+}
+
+/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
+/// and the log, and clear the marker. The legacy collections are untouched, so
+/// this restores the pre-migration state.
+pub async fn revert(db: &Database) -> Result<(), AgentError> {
+    let log = db.collection_named::<Document>("onboarding_migration_log");
+    let mut cursor = log.find(doc! {}).await?;
+    while let Some(entry) = cursor.try_next().await? {
+        if let (Ok(old), Ok(new)) = (
+            entry.get_str("old_target_id"),
+            entry.get_str("new_target_id"),
+        ) {
+            db.dast_scan_runs()
+                .update_many(
+                    doc! { "target_id": new },
+                    doc! { "$set": { "target_id": old } },
+                )
+                .await?;
+            db.pentest_sessions()
+                .update_many(
+                    doc! { "target_id": new },
+                    doc! { "$set": { "target_id": old } },
+                )
+                .await?;
+        }
+    }
+    db.onboarded_targets().drop().await?;
+    log.drop().await?;
+    db.collection_named::<Document>("schema_migrations")
+        .delete_one(doc! { "_id": MIGRATION_MARKER })
+        .await?;
+    Ok(())
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{DastAuthConfig, TrackerType};
+
+    fn repo() -> TrackedRepository {
+        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
+        r.id = Some(mongodb::bson::oid::ObjectId::new());
+        r.default_branch = "develop".to_string();
+        r.last_scanned_commit = Some("abc123".to_string());
+        r.auth_token = Some("pat".to_string());
+        r.auth_username = Some("bob".to_string());
+        r.tracker_type = Some(TrackerType::Gitea);
+        r.tracker_owner = Some("acme".to_string());
+        r.findings_count = 7;
+        r
+    }
+
+    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
+        let mut d = DastTarget::new(
+            "acme-web".to_string(),
+            "https://acme.example.com".to_string(),
+            kind,
+        );
+        d.id = Some(mongodb::bson::oid::ObjectId::new());
+        d.repo_id = repo_id;
+        d.max_crawl_depth = 5;
+        d.auth_config = Some(DastAuthConfig {
+            method: "bearer".to_string(),
+            login_url: None,
+            username: None,
+            password: None,
+            token: Some("tok".to_string()),
+            headers: None,
+        });
+        d
+    }
+
+    #[test]
+    fn repo_maps_preserving_id_and_git_artifact() {
+        let r = repo();
+        let t = repo_to_target(&r);
+        assert_eq!(t.id, r.id); // id preserved
+        assert_eq!(t.findings_count, 7);
+        assert_eq!(t.scan_schedule, r.scan_schedule);
+        let git = t.code_artifact().expect("git artifact");
+        assert_eq!(git.kind, ArtifactKind::GitRepo);
+        assert_eq!(git.source_ref, "https://git/acme.git");
+        let gc = git.git.as_ref().expect("git config");
+        assert_eq!(gc.default_branch, "develop");
+        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
+        let auth = git.auth.as_ref().expect("auth");
+        assert_eq!(auth.secret.as_deref(), Some("pat"));
+        assert_eq!(auth.username.as_deref(), Some("bob"));
+        assert_eq!(
+            t.scan_config
+                .issue_tracker
+                .as_ref()
+                .and_then(|it| it.tracker_type.clone()),
+            Some(TrackerType::Gitea)
+        );
+    }
+
+    #[test]
+    fn standalone_dast_maps_preserving_id_and_live_url() {
+        let d = dast(None, DastTargetType::WebApp);
+        let t = dast_to_standalone_target(&d);
+        assert_eq!(t.id, d.id);
+        assert_eq!(t.target_type, TargetType::WebApp);
+        let url = t.live_url().expect("live url");
+        assert_eq!(url.source_ref, "https://acme.example.com");
+        let web = url.web.as_ref().expect("web config");
+        assert_eq!(web.max_crawl_depth, 5);
+        assert_eq!(
+            url.auth.as_ref().and_then(|a| a.secret.clone()),
+            Some("tok".to_string())
+        );
+    }
+
+    #[test]
+    fn rest_api_dast_maps_to_backend_service() {
+        let d = dast(None, DastTargetType::RestApi);
+        assert_eq!(
+            dast_to_standalone_target(&d).target_type,
+            TargetType::BackendService
+        );
+    }
+
+    #[test]
+    fn fold_adds_live_url_and_promotes_webapp() {
+        let mut t = repo_to_target(&repo());
+        assert_eq!(t.target_type, TargetType::BackendService);
+        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
+        assert_eq!(t.target_type, TargetType::WebApp); // promoted
+        assert!(t.has(ArtifactKind::LiveUrl));
+        assert!(t.has(ArtifactKind::GitRepo));
+    }
+
+    #[test]
+    fn fold_is_idempotent_on_live_url() {
+        let mut t = repo_to_target(&repo());
+        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
+        fold_dast_into_target(&mut t, &d);
+        fold_dast_into_target(&mut t, &d);
+        let live_urls = t
+            .artifacts
+            .iter()
+            .filter(|a| a.kind == ArtifactKind::LiveUrl)
+            .count();
+        assert_eq!(live_urls, 1);
+    }
+}

compliance-agent/src/pentest/cleanup.rs

@@ -342,6 +342,7 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            unified_pipeline: false,
         }
     }
 

compliance-agent/src/pipeline/mod.rs

@@ -8,6 +8,7 @@ mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
+pub mod plan;
 mod pr_review;
 pub mod sbom;
 pub mod semgrep;

compliance-agent/src/pipeline/orchestrator.rs

@@ -15,6 +15,7 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
+use crate::pipeline::plan::build_scan_plan;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
 
@@ -419,6 +420,149 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
+    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
+    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
+    /// `onboarded_targets` and dispatches by the scan plan.
+    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
+    pub async fn run_target(
+        &self,
+        target_id: &str,
+        trigger: ScanTrigger,
+    ) -> Result<(), AgentError> {
+        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
+            .map_err(|e| AgentError::Other(e.to_string()))?;
+        let target = self
+            .db
+            .onboarded_targets()
+            .find_one(doc! { "_id": oid })
+            .await?
+            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
+
+        let scan_run = ScanRun::new(target_id.to_string(), trigger);
+        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
+        let scan_run_id = insert
+            .inserted_id
+            .as_object_id()
+            .map(|id| id.to_hex())
+            .unwrap_or_default();
+
+        let result = self.run_target_pipeline(&target, &scan_run_id).await;
+        match &result {
+            Ok(count) => {
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "completed",
+                            "current_phase": "completed",
+                            "new_findings_count": *count as i64,
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+            Err(e) => {
+                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "failed",
+                            "error_message": e.to_string(),
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+        }
+        result.map(|_| ())
+    }
+
+    /// Run the applicable scans for a target. For a code target this reuses the
+    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
+    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
+    /// follow-ups (#128/#129/#130). Returns the number of new findings.
+    async fn run_target_pipeline(
+        &self,
+        target: &OnboardedTarget,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
+        let plan = build_scan_plan(target);
+        tracing::info!(
+            target_id = %target_id,
+            target_type = %target.target_type,
+            planned_steps = plan.steps.len(),
+            "Unified pipeline: scan plan built"
+        );
+
+        match target.code_artifact() {
+            Some(code) if code.kind == ArtifactKind::GitRepo => {
+                let repo = repo_view_from_target(target, code);
+                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
+                self.finalize_target(target, &repo, new_count).await?;
+                Ok(new_count)
+            }
+            Some(_) => {
+                tracing::warn!(
+                    target_id = %target_id,
+                    "Unified pipeline: source-archive scanning not yet wired; skipping"
+                );
+                Ok(0)
+            }
+            None => {
+                // No code to scan. Firmware/PLC/mobile static scanners land in
+                // #128/#129/#130; DAST for a running URL still works when a
+                // DastTarget row exists (migrated targets).
+                tracing::info!(
+                    target_id = %target_id,
+                    "Unified pipeline: no code artifact; attempting DAST only"
+                );
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+                Ok(0)
+            }
+        }
+    }
+
+    /// Sync the onboarded-target document after a scan: bump `findings_count`
+    /// and advance the git artifact's `last_scanned_commit` watermark.
+    async fn finalize_target(
+        &self,
+        target: &OnboardedTarget,
+        repo: &TrackedRepository,
+        new_count: u32,
+    ) -> Result<(), AgentError> {
+        let oid = match target.id {
+            Some(id) => id,
+            None => return Ok(()),
+        };
+        self.db
+            .onboarded_targets()
+            .update_one(
+                doc! { "_id": oid },
+                doc! {
+                    "$inc": { "findings_count": new_count as i64 },
+                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
+                },
+            )
+            .await?;
+
+        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
+        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
+            self.db
+                .onboarded_targets()
+                .update_one(
+                    doc! { "_id": oid, "artifacts.id": &code.id },
+                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
+                )
+                .await?;
+        }
+        Ok(())
+    }
+
     pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
             let _ = self
@@ -436,6 +580,37 @@ impl PipelineOrchestrator {
     }
 }
 
+/// Build a legacy `TrackedRepository` view from an onboarded target's code
+/// artifact, so the unified pipeline can reuse the existing repo pipeline. The
+/// inverse of the migration's `repo_to_target`. `_id` is preserved so findings
+/// and DAST lookups resolve against the same key.
+fn repo_view_from_target(target: &OnboardedTarget, code: &Artifact) -> TrackedRepository {
+    let mut repo = TrackedRepository::new(target.name.clone(), code.source_ref.clone());
+    repo.id = target.id;
+    if let Some(git) = &code.git {
+        repo.default_branch = git.default_branch.clone();
+        repo.last_scanned_commit = git.last_scanned_commit.clone();
+        repo.local_path = git.local_path.clone();
+    }
+    if let Some(auth) = &code.auth {
+        repo.auth_token = auth.secret.clone();
+        repo.auth_username = auth.username.clone();
+    }
+    if let Some(it) = &target.scan_config.issue_tracker {
+        repo.tracker_type = it.tracker_type.clone();
+        repo.tracker_owner = it.owner.clone();
+        repo.tracker_repo = it.repo.clone();
+        repo.tracker_token = it.token.clone();
+    }
+    repo.scan_schedule = target.scan_schedule.clone();
+    repo.webhook_enabled = target.webhook_enabled;
+    repo.webhook_secret = target.webhook_secret.clone();
+    repo.findings_count = target.findings_count;
+    repo.created_at = target.created_at;
+    repo.updated_at = target.updated_at;
+    repo
+}
+
 /// Extract the scheme + host from a git URL.
 /// e.g. "https://gitea.example.com/owner/repo.git" -> "https://gitea.example.com"
 /// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" -> "https://gitea.example.com"
@@ -460,3 +635,50 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
         None
     }
 }
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{
+        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
+    };
+
+    #[test]
+    fn repo_view_preserves_id_git_auth_and_tracker() {
+        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
+        target.id = Some(mongodb::bson::oid::ObjectId::new());
+        target.findings_count = 3;
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: Some(TrackerType::Gitea),
+            owner: Some("acme".to_string()),
+            repo: Some("web".to_string()),
+            token: Some("tt".to_string()),
+        });
+
+        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
+        if let Some(git) = artifact.git.as_mut() {
+            git.last_scanned_commit = Some("abc123".to_string());
+        }
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        target.artifacts.push(artifact);
+
+        let code = target.code_artifact().expect("code artifact");
+        let repo = repo_view_from_target(&target, code);
+
+        assert_eq!(repo.id, target.id); // preserved
+        assert_eq!(repo.git_url, "https://git/acme.git");
+        assert_eq!(repo.default_branch, "develop");
+        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
+        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
+        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
+        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
+        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
+        assert_eq!(repo.findings_count, 3);
+    }
+}

compliance-agent/src/pipeline/plan.rs

@@ -0,0 +1,195 @@
+//! The scan plan.
+//!
+//! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
+//! list of scans to run, each bound to the artifact it consumes. It intersects
+//! the scan-applicability matrix ([`applicable_scans`]) with the target's
+//! `scan_config` overrides: a scan runs when its required artifact is present and
+//! it is either on by default or explicitly enabled, and is not explicitly
+//! disabled. This is the decision engine the unified pipeline (`run_target`)
+//! executes.
+
+use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
+use compliance_core::scan_matrix::applicable_scans;
+
+/// One scan to run, bound to the artifact it operates on.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ScanStep {
+    /// The scan to run.
+    pub scan_type: ScanType,
+    /// The pipeline phase to report while it runs.
+    pub phase: ScanPhase,
+    /// The id of the artifact this scan consumes ([`Artifact::id`]).
+    pub artifact_id: String,
+}
+
+/// The ordered set of scans to run for a target.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct ScanPlan {
+    /// The scans, in matrix order.
+    pub steps: Vec<ScanStep>,
+}
+
+impl ScanPlan {
+    /// Whether the plan contains a step for the given scan type.
+    pub fn has(&self, scan: ScanType) -> bool {
+        self.steps.iter().any(|s| s.scan_type == scan)
+    }
+
+    /// Whether the plan is empty (nothing to run).
+    pub fn is_empty(&self) -> bool {
+        self.steps.is_empty()
+    }
+}
+
+/// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
+/// bound to the artifact it consumes. Scans whose required artifact is absent, or
+/// that are disabled, or off-by-default and not explicitly enabled, are dropped.
+pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
+    let enabled = &target.scan_config.enabled_scans;
+    let disabled = &target.scan_config.disabled_scans;
+
+    let mut steps = Vec::new();
+    for option in applicable_scans(target) {
+        // Required artifact missing → not runnable.
+        if option.blocked_reason.is_some() {
+            continue;
+        }
+        // Explicit opt-out wins.
+        if disabled.contains(&option.scan) {
+            continue;
+        }
+        // Run if on by default, or explicitly enabled.
+        if !option.default_on && !enabled.contains(&option.scan) {
+            continue;
+        }
+        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
+            continue;
+        };
+        steps.push(ScanStep {
+            scan_type: option.scan,
+            phase: phase_for(option.scan),
+            artifact_id: artifact.id.clone(),
+        });
+    }
+    ScanPlan { steps }
+}
+
+/// Resolve the artifact a scan consumes. A "code" requirement (represented by
+/// `GitRepo`) is satisfied by a git repo *or* a source archive.
+fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
+    match required {
+        Some(ArtifactKind::GitRepo) => target.code_artifact(),
+        Some(kind) => target.first_of(kind),
+        None => target.code_artifact().or_else(|| target.artifacts.first()),
+    }
+}
+
+/// The pipeline phase reported while a given scan runs.
+fn phase_for(scan: ScanType) -> ScanPhase {
+    match scan {
+        ScanType::Sast => ScanPhase::Sast,
+        ScanType::Sbom => ScanPhase::SbomGeneration,
+        ScanType::Cve => ScanPhase::CveScanning,
+        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
+        ScanType::SecretDetection => ScanPhase::SecretDetection,
+        ScanType::Lint => ScanPhase::LintScanning,
+        ScanType::CodeReview => ScanPhase::CodeReview,
+        ScanType::Graph => ScanPhase::GraphBuilding,
+        ScanType::Dast => ScanPhase::DastScanning,
+        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
+        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
+        ScanType::MobileStatic => ScanPhase::MobileStatic,
+        ScanType::ContainerScan => ScanPhase::ContainerScan,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{PlcFormat, TargetType};
+
+    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("t".to_string(), target_type);
+        t.artifacts = artifacts;
+        t
+    }
+
+    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
+        plan.steps.iter().find(|s| s.scan_type == scan)
+    }
+
+    #[test]
+    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
+        let code = Artifact::git_repo("https://git/x", "main");
+        let url = Artifact::live_url("https://x");
+        let (code_id, url_id) = (code.id.clone(), url.id.clone());
+        let t = target(TargetType::WebApp, vec![code, url]);
+
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, code_id);
+        assert_eq!(sast.phase, ScanPhase::Sast);
+        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
+        assert_eq!(dast.artifact_id, url_id);
+    }
+
+    #[test]
+    fn webapp_without_url_omits_dast() {
+        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.has(ScanType::Sast));
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn code_scan_binds_to_source_archive_when_no_git_repo() {
+        let arc = Artifact::source_archive("src.zip");
+        let arc_id = arc.id.clone();
+        let t = target(TargetType::BackendService, vec![arc]);
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, arc_id);
+    }
+
+    #[test]
+    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
+        let fw = Artifact::firmware_image("fw.bin");
+        let fw_id = fw.id.clone();
+        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
+        let plan = build_scan_plan(&t);
+        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
+        assert_eq!(sbom.artifact_id, fw_id);
+        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn plc_plans_only_control_logic() {
+        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
+        let t = target(TargetType::PlcSps, vec![plc]);
+        let plan = build_scan_plan(&t);
+        assert_eq!(plan.steps.len(), 1);
+        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
+        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
+    }
+
+    #[test]
+    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
+        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        t.scan_config.disabled_scans = vec![ScanType::Lint];
+        // CodeReview is off by default for web; enable it explicitly.
+        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
+        let plan = build_scan_plan(&t);
+        assert!(!plan.has(ScanType::Lint));
+        assert!(plan.has(ScanType::CodeReview));
+        assert!(plan.has(ScanType::Sast));
+    }
+
+    #[test]
+    fn no_code_artifact_yields_empty_plan_for_web() {
+        let t = target(TargetType::WebApp, vec![]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.is_empty());
+    }
+}

compliance-agent/tests/common/mod.rs

@@ -25,8 +25,9 @@ impl TestServer {
         let mongodb_uri = std::env::var("TEST_MONGODB_URI")
             .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
 
-        // Unique database name per test run to avoid collisions
-        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
+        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
 
         let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await
@@ -69,6 +70,7 @@ impl TestServer {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            unified_pipeline: false,
         };
 
         let agent = ComplianceAgent::new(config, db_pool);

compliance-agent/tests/integration/api/mod.rs

@@ -2,5 +2,6 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
+mod onboarding;
 mod repositories;
 mod stats;

compliance-agent/tests/integration/api/onboarding.rs

@@ -0,0 +1,115 @@
+use crate::common::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn create_list_and_applicable_scans() {
+    let server = TestServer::start().await;
+
+    // Initially empty.
+    let resp = server.get("/api/v1/targets").await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Create a web-app target with a git repo + a live URL.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "acme-web",
+                "target_type": "web_app",
+                "artifacts": [
+                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
+                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
+                ]
+            }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    assert!(!id.is_empty());
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
+
+    // List returns it.
+    let resp = server.get("/api/v1/targets").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 1);
+
+    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
+    let resp = server
+        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let scans = body["data"]["scans"].as_array().unwrap();
+    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
+    assert!(names.contains(&"sast"));
+    assert!(names.contains(&"dast"));
+    assert_eq!(body["data"]["pentest_supported"], true);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn detect_classifies_a_plc_target() {
+    let server = TestServer::start().await;
+
+    // A PLC project artifact is a strong kind-based signal.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "line-controller",
+                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
+                "artifacts": [
+                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
+                ]
+            }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    let resp = server
+        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn add_artifact_and_delete_target() {
+    let server = TestServer::start().await;
+
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({ "name": "svc", "target_type": "backend_service" }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    // Attach a git repo.
+    let resp = server
+        .post(
+            &format!("/api/v1/targets/{id}/artifacts"),
+            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
+
+    // Delete it.
+    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 200);
+    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 404);
+
+    server.cleanup().await;
+}

compliance-agent/tests/integration/migration.rs

@@ -0,0 +1,156 @@
+// Integration tests for the onboarding backfill migration.
+//
+// Requires MongoDB (set TEST_MONGODB_URI if not at the default).
+// Not run in CI (which is `--lib` only) — run locally:
+//   cargo test -p compliance-agent --test e2e migration
+
+use compliance_agent::database::{Database, DatabasePool};
+use compliance_agent::migrate::onboarding;
+use compliance_core::models::{
+    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
+};
+use mongodb::bson::{doc, Document};
+
+async fn fresh_db() -> (DatabasePool, String, Database) {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
+    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
+    let pool = DatabasePool::connect(&uri, &prefix)
+        .await
+        .expect("connect mongo");
+    let db = pool.for_tenant_id("t1").await.expect("tenant db");
+    (pool, prefix, db)
+}
+
+async fn cleanup(pool: &DatabasePool, prefix: &str) {
+    if let Ok(names) = pool.client().list_database_names().await {
+        for n in names {
+            if n.starts_with(prefix) {
+                pool.client().database(&n).drop().await.ok();
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn backfill_folds_relinks_is_idempotent_and_reversible() {
+    let (pool, prefix, db) = fresh_db().await;
+
+    // Seed a repo.
+    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
+    let repo_id = db
+        .repositories()
+        .insert_one(repo)
+        .await
+        .expect("insert repo")
+        .inserted_id
+        .as_object_id()
+        .expect("repo oid");
+
+    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
+    let mut linked = DastTarget::new(
+        "acme-web".into(),
+        "https://acme.example.com".into(),
+        DastTargetType::WebApp,
+    );
+    linked.repo_id = Some(repo_id.to_hex());
+    let linked_id = db
+        .dast_targets()
+        .insert_one(linked)
+        .await
+        .expect("insert linked dast")
+        .inserted_id
+        .as_object_id()
+        .expect("linked oid");
+
+    // A repo-less DAST target (standalone).
+    let standalone = DastTarget::new(
+        "acme-api".into(),
+        "https://api.acme.com".into(),
+        DastTargetType::RestApi,
+    );
+    let standalone_id = db
+        .dast_targets()
+        .insert_one(standalone)
+        .await
+        .expect("insert standalone dast")
+        .inserted_id
+        .as_object_id()
+        .expect("standalone oid");
+
+    // A DAST scan run pointing at the linked target — should be relinked to the repo.
+    db.collection_named::<Document>("dast_scan_runs")
+        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
+        .await
+        .expect("insert dast run");
+
+    // --- Backfill ---
+    assert!(!onboarding::already_applied(&db).await.unwrap());
+    let report = onboarding::backfill_onboarded_targets(&db, false)
+        .await
+        .expect("backfill");
+    assert_eq!(report.repos_migrated, 1);
+    assert_eq!(report.dast_targets_folded, 1);
+    assert_eq!(report.dast_targets_standalone, 1);
+    assert!(onboarding::already_applied(&db).await.unwrap());
+
+    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
+    let repo_target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": repo_id })
+        .await
+        .unwrap()
+        .expect("repo target");
+    assert!(repo_target.has(ArtifactKind::GitRepo));
+    assert!(repo_target.has(ArtifactKind::LiveUrl));
+    assert_eq!(repo_target.target_type, TargetType::WebApp);
+
+    // Standalone target: preserved _id, live-url, backend service.
+    let standalone_target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": standalone_id })
+        .await
+        .unwrap()
+        .expect("standalone target");
+    assert!(standalone_target.has(ArtifactKind::LiveUrl));
+    assert_eq!(standalone_target.target_type, TargetType::BackendService);
+
+    // The DAST run was relinked from the old dast id to the repo (unified) id.
+    let run = db
+        .collection_named::<Document>("dast_scan_runs")
+        .find_one(doc! {})
+        .await
+        .unwrap()
+        .expect("run");
+    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
+
+    // --- Idempotent: re-run migrates nothing new ---
+    let again = onboarding::backfill_onboarded_targets(&db, false)
+        .await
+        .expect("backfill again");
+    assert_eq!(again.repos_migrated, 0);
+    assert_eq!(again.dast_targets_folded, 0);
+    assert_eq!(again.dast_targets_standalone, 0);
+    assert!(again.skipped_existing >= 2);
+
+    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
+    onboarding::revert(&db).await.expect("revert");
+    assert_eq!(
+        db.onboarded_targets()
+            .count_documents(doc! {})
+            .await
+            .unwrap(),
+        0
+    );
+    let run_after = db
+        .collection_named::<Document>("dast_scan_runs")
+        .find_one(doc! {})
+        .await
+        .unwrap()
+        .expect("run");
+    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
+    assert!(!onboarding::already_applied(&db).await.unwrap());
+
+    cleanup(&pool, &prefix).await;
+}

compliance-agent/tests/integration/mod.rs

@@ -7,3 +7,4 @@
 // Or nightly: (via CI with MongoDB service container)
 
 mod api;
+mod migration;

compliance-core/src/config.rs

@@ -49,6 +49,10 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
+    /// When true, `run_scan` dispatches to the unified `run_target` pipeline
+    /// (reads `onboarded_targets`) instead of the legacy repository pipeline.
+    /// Env `UNIFIED_PIPELINE`. Defaults off during the transition.
+    pub unified_pipeline: bool,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]