test(plc): add realistic OpenPLC-style traffic-light sample

Second demo fixture (public-sample shape) to complement the all-rules
pump_station.st: a timed pedestrian-crossing state machine adapted from
the OpenPLC traffic-light example, extended with a SCADA/Modbus uplink and
a maintenance override. Mostly sound control logic with three planted,
field-realistic defects (hardcoded SCADA password, cleartext Modbus master,
maintenance mode that drops the pedestrian safety permit).

The regression test asserts the scanner surfaces those defects while staying
quiet on the guarded duty-cycle division and the JMP-free CASE machine —
demonstrating low false positives on real-world-shaped code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Cargo.toml

@@ -23,7 +23,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"

compliance-agent/Cargo.toml

@@ -34,7 +34,7 @@ hex = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
 regex = { workspace = true }
-axum = { version = "0.8", features = ["multipart"] }
+axum = "0.8"
 tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
 git2 = "0.20"
 octocrab = "0.44"
@@ -65,5 +65,5 @@ tokio = { workspace = true }
 mongodb = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
-axum = { version = "0.8", features = ["multipart"] }
+axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }

compliance-agent/src/api/handlers/onboarding.rs

@@ -5,7 +5,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-use axum::extract::{Extension, Multipart, Path, Query};
+use axum::extract::{Extension, Path, Query};
 use axum::http::StatusCode;
 use axum::Json;
 use mongodb::bson::{doc, oid::ObjectId, to_bson};
@@ -377,116 +377,6 @@ pub async fn add_artifact(
     get_target(Extension(agent), tenant, Path(id)).await
 }
 
-/// POST /api/v1/targets/{id}/artifacts/upload — attach an artifact by uploading
-/// its file (PLC project, firmware image, source archive, mobile package). The
-/// bytes are written to the artifact blob store and referenced by `stored_path`,
-/// so ingest resolves them locally (no URL fetch).
-///
-/// Multipart fields: `file` (required), `kind` (required, snake_case
-/// `ArtifactKind`), `plc_format` (optional, for PLC projects).
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn upload_artifact(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    mut multipart: Multipart,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    if db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .is_none()
-    {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    let mut kind: Option<ArtifactKind> = None;
-    let mut plc_format: Option<PlcFormat> = None;
-    let mut filename = String::from("upload.bin");
-    let mut bytes: Option<axum::body::Bytes> = None;
-
-    while let Some(field) = multipart
-        .next_field()
-        .await
-        .map_err(|_| StatusCode::BAD_REQUEST)?
-    {
-        match field.name().unwrap_or("") {
-            "kind" => {
-                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
-                kind = parse_enum(&v);
-            }
-            "plc_format" => {
-                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
-                plc_format = parse_enum(&v);
-            }
-            "file" => {
-                if let Some(fname) = field.file_name() {
-                    filename = fname.to_string();
-                }
-                bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
-            }
-            _ => {}
-        }
-    }
-
-    let (Some(kind), Some(bytes)) = (kind, bytes) else {
-        return Err(StatusCode::BAD_REQUEST);
-    };
-
-    // Store the uploaded bytes under the artifact blob store.
-    let safe_name: String = filename
-        .chars()
-        .map(|c| {
-            if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
-                c
-            } else {
-                '_'
-            }
-        })
-        .collect();
-    let dir = std::path::Path::new(&agent.config.artifact_store_base_path)
-        .join("uploads")
-        .join(&id);
-    std::fs::create_dir_all(&dir).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    let dest = dir.join(format!("{}_{safe_name}", uuid::Uuid::new_v4()));
-    std::fs::write(&dest, bytes.as_ref()).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    // Build the artifact for this kind, referencing the stored file.
-    let mut artifact = match kind {
-        ArtifactKind::PlcProject => Artifact::plc_project(
-            filename.clone(),
-            plc_format.unwrap_or(PlcFormat::PlcopenXml),
-        ),
-        ArtifactKind::FirmwareImage => Artifact::firmware_image(filename.clone()),
-        ArtifactKind::SourceArchive => Artifact::source_archive(filename.clone()),
-        ArtifactKind::MobilePackage => Artifact::mobile_package(filename.clone()),
-        // Non-file kinds (git repo, live URL, container ref, text) use the JSON
-        // add-artifact endpoint, not upload.
-        _ => return Err(StatusCode::BAD_REQUEST),
-    };
-    artifact.stored_path = Some(dest.to_string_lossy().to_string());
-    artifact.size_bytes = Some(bytes.len() as u64);
-
-    let artifact_bson = to_bson(&artifact).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$push": { "artifacts": artifact_bson }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// Deserialize a snake_case enum value from a plain string.
-fn parse_enum<T: for<'de> Deserialize<'de>>(s: &str) -> Option<T> {
-    serde_json::from_value(serde_json::Value::String(s.to_string())).ok()
-}
-
 /// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn applicable_scans_for_target(

compliance-agent/src/api/routes.rs

@@ -26,10 +26,6 @@ pub fn build_router() -> Router {
             "/api/v1/targets/{id}/artifacts",
             post(handlers::onboarding::add_artifact),
         )
-        .route(
-            "/api/v1/targets/{id}/artifacts/upload",
-            post(handlers::onboarding::upload_artifact),
-        )
         .route(
             "/api/v1/targets/{id}/applicable-scans",
             get(handlers::onboarding::applicable_scans_for_target),

compliance-agent/src/api/server.rs

@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use axum::extract::{DefaultBodyLimit, Request};
+use axum::extract::Request;
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
@@ -74,9 +74,6 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
 
     let mut app = routes::build_router()
         .merge(admin_router)
-        // Allow large artifact uploads (PLC .projectarchive, firmware images,
-        // mobile packages) — axum's default request-body limit is only 2 MiB.
-        .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
         .layer(Extension(Arc::new(agent.clone())))
         .layer(CorsLayer::permissive())
         .layer(TraceLayer::new_for_http())

compliance-agent/src/ingest/mod.rs

@@ -162,27 +162,14 @@ fn ingest_blob(
         match blob::extract_zip(&stored, &dest) {
             Ok(()) => dest,
             Err(e) => {
-                // Not a zip container — this is a single uploaded file (e.g. a
-                // `.st`/`.xml` PLC project or a `.tar.gz`). The content-addressed
-                // blob has no extension, so materialize it into a working dir
-                // under its original name; extension-based scanners (PLC) can then
-                // discover it and report a readable path.
+                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
+                // note it so later stages can decide what to do.
                 facts.push(DetectedFact::new(
                     "archive_unextracted",
                     e.to_string(),
                     "ingest",
                 ));
-                match materialize_single(&stored, &dest, &blob_file_name(artifact)) {
-                    Ok(dir) => dir,
-                    Err(copy_err) => {
-                        facts.push(DetectedFact::new(
-                            "materialize_failed",
-                            copy_err.to_string(),
-                            "ingest",
-                        ));
-                        stored.clone()
-                    }
-                }
+                stored.clone()
             }
         }
     } else {
@@ -199,27 +186,6 @@ fn ingest_blob(
     })
 }
 
-/// Copy a stored blob into `dest`/`name`, returning `dest`. Used when an
-/// "extractable" artifact turns out to be a single file rather than an archive.
-fn materialize_single(stored: &Path, dest: &Path, name: &str) -> Result<PathBuf, AgentError> {
-    std::fs::create_dir_all(dest)?;
-    std::fs::copy(stored, dest.join(name))?;
-    Ok(dest.to_path_buf())
-}
-
-/// A safe, single-segment file name for an artifact, preserving the original
-/// extension so scanners can identify it. Derives from `source_ref` (the
-/// uploaded/original file name); `file_name` strips any directory components,
-/// so this is traversal-safe. Falls back to the artifact id.
-fn blob_file_name(artifact: &Artifact) -> String {
-    Path::new(&artifact.source_ref)
-        .file_name()
-        .and_then(|n| n.to_str())
-        .map(str::to_string)
-        .filter(|s| !s.is_empty())
-        .unwrap_or_else(|| format!("artifact-{}", artifact.id))
-}
-
 /// An artifact with no on-disk form: record a single fact, no hash/path.
 fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
     IngestedArtifact {
@@ -365,52 +331,4 @@ mod tests {
         assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
         assert!(creds.auth_token.is_none());
     }
-
-    /// A single uploaded PLC file (not an archive) must land in a working dir
-    /// under its original name so the PLC scanner can discover it by extension
-    /// and report a readable path — the demo's upload → scan path.
-    #[test]
-    fn single_uploaded_plc_file_is_materialized_and_scannable() {
-        use compliance_core::models::PlcFormat;
-
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        // Simulate the upload handler: bytes written to an `uploads/` path,
-        // `source_ref` carrying the original (clean) file name.
-        let uploads = scratch.0.join("uploads");
-        std::fs::create_dir_all(&uploads).expect("mkdir uploads");
-        let uploaded = uploads.join("a1b2c3_pump_station.st");
-        std::fs::write(
-            &uploaded,
-            "PROGRAM P\nVAR\n  ApiKey : STRING := 'sk-live-1234';\nEND_VAR\nEND_PROGRAM\n",
-        )
-        .expect("write st");
-
-        let mut artifact = Artifact::plc_project("pump_station.st", PlcFormat::StructuredText);
-        artifact.stored_path = Some(uploaded.to_string_lossy().to_string());
-
-        let ctx = ctx_for(&store, "t-plc");
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-
-        // Working path is a directory (not the extensionless blob) holding the
-        // file under its original name.
-        let wp = out.working_path.expect("working path");
-        assert!(wp.is_dir(), "expected a working dir, got {wp:?}");
-        assert!(wp.join("pump_station.st").is_file());
-
-        // The PLC scanner finds the hardcoded credential and reports a clean path.
-        let findings = crate::pipeline::plc::analyze_tree(&wp, "t-plc");
-        assert!(
-            !findings.is_empty(),
-            "scanner should flag the uploaded file"
-        );
-        assert!(findings
-            .iter()
-            .any(|f| f.rule_id.as_deref() == Some("plc-hardcoded-credential")));
-        assert_eq!(
-            findings[0].file_path.as_deref(),
-            Some("pump_station.st"),
-            "finding should reference the original file name"
-        );
-    }
 }

compliance-agent/src/pipeline/cve.rs

@@ -204,202 +204,6 @@ impl CveScanner {
 
         Ok(results)
     }
-
-    /// Match the CODESYS **runtime** component against NVD by CPE.
-    ///
-    /// CODESYS advisories (the CoDe16 cluster and friends) are indexed in NVD by
-    /// CPE (`cpe:2.3:a:codesys:control*`) keyed off the *runtime* version — not by
-    /// the internal `Cmp*`/`Sys*` library names OSV-by-purl would look up. So we
-    /// find the runtime SBOM entry, pull every `cpe:2.3:a:codesys:*` CVE from NVD,
-    /// and keep the ones whose affected-version range covers our runtime version.
-    /// Best-effort: returns empty without an NVD key, on a network error, or when
-    /// no CODESYS runtime component is present.
-    pub async fn scan_codesys(&self, repo_id: &str, entries: &mut [SbomEntry]) -> Vec<CveAlert> {
-        let Some((name, version)) = codesys_runtime(entries) else {
-            return Vec::new();
-        };
-        let url = "https://services.nvd.nist.gov/rest/json/cves/2.0\
-                   ?virtualMatchString=cpe:2.3:a:codesys";
-        let mut req = self.http.get(url);
-        if let Some(key) = &self.nvd_api_key {
-            req = req.header("apiKey", key.as_str());
-        }
-        let body: serde_json::Value = match req.send().await {
-            Ok(r) if r.status().is_success() => match r.json().await {
-                Ok(b) => b,
-                Err(e) => {
-                    tracing::warn!("CODESYS NVD parse failed: {e}");
-                    return Vec::new();
-                }
-            },
-            Ok(r) => {
-                tracing::warn!("CODESYS NVD returned {}", r.status());
-                return Vec::new();
-            }
-            Err(e) => {
-                tracing::warn!("CODESYS NVD request failed: {e}");
-                return Vec::new();
-            }
-        };
-
-        let matched = parse_codesys_nvd(&body, &version);
-        let mut alerts = Vec::new();
-        for cve in matched {
-            if let Some(e) = entries
-                .iter_mut()
-                .find(|e| e.name == name && e.version == version)
-            {
-                e.known_vulnerabilities.push(VulnRef {
-                    id: cve.id.clone(),
-                    source: "nvd".to_string(),
-                    severity: None,
-                    url: Some(format!("https://nvd.nist.gov/vuln/detail/{}", cve.id)),
-                });
-            }
-            let mut alert = CveAlert::new(
-                cve.id,
-                repo_id.to_string(),
-                name.clone(),
-                version.clone(),
-                CveSource::Nvd,
-            );
-            alert.summary = cve.summary;
-            alert.cvss_score = cve.cvss;
-            alerts.push(alert);
-        }
-        tracing::info!(runtime = %name, version = %version, cves = alerts.len(), "CODESYS CVE match");
-        alerts
-    }
-}
-
-/// The CODESYS runtime component (name + version) from an SBOM, if present. The
-/// runtime carries the version CODESYS advisories key off; the internal library
-/// components do not.
-fn codesys_runtime(entries: &[SbomEntry]) -> Option<(String, String)> {
-    entries
-        .iter()
-        .find(|e| e.package_manager == "codesys" && e.name.starts_with("CODESYS Control"))
-        .map(|e| (e.name.clone(), e.version.clone()))
-}
-
-/// A parsed NVD CVE that affects the CODESYS runtime.
-struct CodesysCve {
-    id: String,
-    summary: Option<String>,
-    cvss: Option<f64>,
-}
-
-/// Version constraints from an NVD `cpeMatch` node.
-#[derive(Default)]
-struct CpeRange {
-    exact: Option<String>,
-    start_incl: Option<String>,
-    start_excl: Option<String>,
-    end_incl: Option<String>,
-    end_excl: Option<String>,
-}
-
-/// Parse an NVD CVE-list response and keep the CVEs whose CODESYS CPE match covers
-/// `runtime_version`.
-fn parse_codesys_nvd(body: &serde_json::Value, runtime_version: &str) -> Vec<CodesysCve> {
-    let mut out = Vec::new();
-    let Some(vulns) = body["vulnerabilities"].as_array() else {
-        return out;
-    };
-    for v in vulns {
-        let cve = &v["cve"];
-        let Some(id) = cve["id"].as_str() else {
-            continue;
-        };
-        let covered = cve["configurations"]
-            .as_array()
-            .into_iter()
-            .flatten()
-            .flat_map(|c| c["nodes"].as_array().into_iter().flatten())
-            .flat_map(|n| n["cpeMatch"].as_array().into_iter().flatten())
-            .any(|cm| {
-                cm["vulnerable"].as_bool() == Some(true)
-                    && cm["criteria"]
-                        .as_str()
-                        .is_some_and(|c| c.contains(":codesys:"))
-                    && version_matches(runtime_version, &cpe_range(cm))
-            });
-        if covered {
-            let summary = cve["descriptions"]
-                .as_array()
-                .and_then(|d| d.iter().find(|x| x["lang"].as_str() == Some("en")))
-                .and_then(|x| x["value"].as_str())
-                .map(String::from);
-            let cvss = cve["metrics"]["cvssMetricV31"]
-                .as_array()
-                .and_then(|m| m.first())
-                .and_then(|m| m["cvssData"]["baseScore"].as_f64());
-            out.push(CodesysCve {
-                id: id.to_string(),
-                summary,
-                cvss,
-            });
-        }
-    }
-    out
-}
-
-/// Build a [`CpeRange`] from an NVD `cpeMatch` object.
-fn cpe_range(cm: &serde_json::Value) -> CpeRange {
-    let exact = cm["criteria"]
-        .as_str()
-        .and_then(cpe_version)
-        .filter(|v| v != "*" && v != "-" && !v.is_empty());
-    CpeRange {
-        exact,
-        start_incl: cm["versionStartIncluding"].as_str().map(String::from),
-        start_excl: cm["versionStartExcluding"].as_str().map(String::from),
-        end_incl: cm["versionEndIncluding"].as_str().map(String::from),
-        end_excl: cm["versionEndExcluding"].as_str().map(String::from),
-    }
-}
-
-/// The version field (6th component) of a CPE 2.3 string.
-fn cpe_version(criteria: &str) -> Option<String> {
-    criteria.split(':').nth(5).map(String::from)
-}
-
-/// Whether `v` satisfies a CPE version range.
-fn version_matches(v: &str, r: &CpeRange) -> bool {
-    use std::cmp::Ordering::{Equal, Greater, Less};
-    if let Some(exact) = &r.exact {
-        return cmp_dotted(v, exact) == Equal;
-    }
-    let mut ok = true;
-    if let Some(s) = &r.start_incl {
-        ok &= cmp_dotted(v, s) != Less;
-    }
-    if let Some(s) = &r.start_excl {
-        ok &= cmp_dotted(v, s) == Greater;
-    }
-    if let Some(e) = &r.end_incl {
-        ok &= cmp_dotted(v, e) != Greater;
-    }
-    if let Some(e) = &r.end_excl {
-        ok &= cmp_dotted(v, e) == Less;
-    }
-    ok
-}
-
-/// Compare two dotted numeric versions (`4.17.0.0` vs `4.9.0.0`); missing
-/// components count as 0, non-numeric components as 0.
-fn cmp_dotted(a: &str, b: &str) -> std::cmp::Ordering {
-    let pa: Vec<u64> = a.split('.').map(|x| x.parse().unwrap_or(0)).collect();
-    let pb: Vec<u64> = b.split('.').map(|x| x.parse().unwrap_or(0)).collect();
-    for i in 0..pa.len().max(pb.len()) {
-        let x = pa.get(i).copied().unwrap_or(0);
-        let y = pb.get(i).copied().unwrap_or(0);
-        match x.cmp(&y) {
-            std::cmp::Ordering::Equal => continue,
-            other => return other,
-        }
-    }
-    std::cmp::Ordering::Equal
 }
 
 #[derive(serde::Deserialize)]
@@ -424,90 +228,3 @@ struct OsvVuln {
     summary: Option<String>,
     severity: Option<String>,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::cmp::Ordering::{Equal, Greater, Less};
-
-    fn entry(name: &str, ver: &str, pm: &str) -> SbomEntry {
-        SbomEntry::new("t".into(), name.into(), ver.into(), pm.into())
-    }
-
-    #[test]
-    fn finds_the_codesys_runtime_component() {
-        let entries = vec![
-            entry("Standard", "3.5.18.0", "codesys"),
-            entry("CODESYS Control for Linux ARM SL", "4.17.0.0", "codesys"),
-        ];
-        assert_eq!(
-            codesys_runtime(&entries),
-            Some(("CODESYS Control for Linux ARM SL".into(), "4.17.0.0".into()))
-        );
-        // Internal library components are not the runtime.
-        assert!(codesys_runtime(&[entry("Util", "3.5.21.0", "codesys")]).is_none());
-    }
-
-    #[test]
-    fn dotted_version_comparison() {
-        assert_eq!(cmp_dotted("4.17.0.0", "4.9.0.0"), Greater);
-        assert_eq!(cmp_dotted("4.9.0.0", "4.17.0.0"), Less);
-        assert_eq!(cmp_dotted("3.5.18.0", "3.5.18.0"), Equal);
-        assert_eq!(cmp_dotted("4.2", "4.2.0.0"), Equal); // missing components = 0
-    }
-
-    #[test]
-    fn version_range_matching() {
-        let end_excl = CpeRange {
-            end_excl: Some("4.9.0.0".into()),
-            ..Default::default()
-        };
-        assert!(!version_matches("4.17.0.0", &end_excl)); // patched
-        assert!(version_matches("4.5.0.0", &end_excl)); // affected
-
-        let exact = CpeRange {
-            exact: Some("3.5.16.0".into()),
-            ..Default::default()
-        };
-        assert!(version_matches("3.5.16.0", &exact));
-        assert!(!version_matches("3.5.17.0", &exact));
-
-        let span = CpeRange {
-            start_incl: Some("3.0.0.0".into()),
-            end_incl: Some("3.5.16.0".into()),
-            ..Default::default()
-        };
-        assert!(version_matches("3.5.16.0", &span));
-        assert!(!version_matches("3.5.17.0", &span));
-    }
-
-    #[test]
-    fn parses_nvd_and_matches_by_runtime_version() {
-        // Two CODESYS CVEs: one affects < 4.9 (our 4.17 is patched), one affects
-        // <= 4.20 (our 4.17 is affected). Only the latter should match.
-        let body = serde_json::json!({
-          "vulnerabilities": [
-            {"cve": {"id":"CVE-2023-0001",
-              "descriptions":[{"lang":"en","value":"old CmpBlkDrvTcp bug"}],
-              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":7.5}}]},
-              "configurations":[{"nodes":[{"cpeMatch":[
-                {"vulnerable":true,
-                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
-                 "versionEndExcluding":"4.9.0.0"}
-              ]}]}]}},
-            {"cve": {"id":"CVE-2024-0002",
-              "descriptions":[{"lang":"en","value":"recent runtime bug"}],
-              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":9.8}}]},
-              "configurations":[{"nodes":[{"cpeMatch":[
-                {"vulnerable":true,
-                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
-                 "versionEndIncluding":"4.20.0.0"}
-              ]}]}]}}
-          ]
-        });
-        let matched = parse_codesys_nvd(&body, "4.17.0.0");
-        let ids: Vec<&str> = matched.iter().map(|c| c.id.as_str()).collect();
-        assert_eq!(ids, vec!["CVE-2024-0002"]);
-        assert_eq!(matched[0].cvss, Some(9.8));
-    }
-}

compliance-agent/src/pipeline/ics/ethernetip.rs

@@ -1,95 +0,0 @@
-//! Minimal EtherNet/IP (CIP) reachability probe.
-//!
-//! Sends an EtherNet/IP encapsulation **ListIdentity** command (0x0063) over TCP
-//! 44818 and checks for a valid encapsulation reply — confirming a CIP device
-//! without opening a session or writing anything.
-
-use std::time::Duration;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Outcome of an EtherNet/IP handshake probe.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct EnipProbe {
-    /// A TCP connection to the port was established.
-    pub reachable: bool,
-    /// The endpoint returned a valid EtherNet/IP encapsulation reply.
-    pub is_enip: bool,
-}
-
-/// Probe an EtherNet/IP endpoint with a ListIdentity request. Read-only.
-pub async fn probe(host: &str, port: u16, budget: Duration) -> EnipProbe {
-    let mut out = EnipProbe::default();
-    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
-        return out;
-    };
-    out.reachable = true;
-
-    // Encapsulation header (24 bytes): command(2) length(2) session(4) status(4)
-    // context(8) options(4). ListIdentity = command 0x0063, everything else zero.
-    let mut req = vec![0u8; 24];
-    req[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
-    if timeout(budget, stream.write_all(&req))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-
-    let mut hdr = [0u8; 24];
-    if timeout(budget, stream.read_exact(&mut hdr))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-    let command = u16::from_le_bytes([hdr[0], hdr[1]]);
-    let status = u32::from_le_bytes([hdr[8], hdr[9], hdr[10], hdr[11]]);
-    // Echoed command + success status = a valid EtherNet/IP encapsulation reply.
-    if command == 0x0063 && status == 0 {
-        out.is_enip = true;
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    async fn mock_server() -> std::net::SocketAddr {
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let addr = listener.local_addr().expect("addr");
-        tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.expect("accept");
-            let mut req = [0u8; 24];
-            if sock.read_exact(&mut req).await.is_err() {
-                return;
-            }
-            // Reply: echo command 0x0063, status 0, no data.
-            let mut hdr = vec![0u8; 24];
-            hdr[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
-            let _ = sock.write_all(&hdr).await;
-        });
-        addr
-    }
-
-    #[tokio::test]
-    async fn probe_detects_an_ethernetip_device() {
-        let addr = mock_server().await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.reachable && p.is_enip);
-    }
-
-    #[tokio::test]
-    async fn probe_reports_unreachable_for_a_closed_port() {
-        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
-        assert!(!p.reachable && !p.is_enip);
-    }
-}

compliance-agent/src/pipeline/ics/mod.rs

@@ -1,273 +0,0 @@
-//! Dynamic ICS (industrial control system) probing for PLC/SPS targets.
-//!
-//! Where the control-logic scanner is static (over ST / PLCopen XML), this probes
-//! the *running* device over industrial protocols and reports exposed /
-//! unauthenticated control interfaces. It is read-only: it never writes to a live
-//! process. Modbus/TCP and OPC UA are implemented; EtherNet-IP is a follow-on.
-
-pub mod ethernetip;
-pub mod modbus;
-pub mod opcua;
-pub mod portscan;
-
-use std::time::Duration;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-
-use crate::pipeline::dedup;
-
-/// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
-const MODBUS_PORT: u16 = 502;
-const OPCUA_PORT: u16 = 4840;
-const ENIP_PORT: u16 = 44818;
-
-/// Probe a PLC/SPS device's industrial-protocol surface and return findings.
-/// Read-only. Deep-probes Modbus/TCP, OPC UA and EtherNet/IP, plus a service
-/// discovery scan of the remaining OT / insecure-management ports. `endpoint` is
-/// the target's live-URL / host reference.
-pub async fn probe_target(endpoint: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let (host, modbus_port) = parse_endpoint(endpoint);
-    let mut findings = modbus_findings(&host, modbus_port, repo_id, budget).await;
-    findings.extend(opcua_findings(&host, OPCUA_PORT, repo_id, budget).await);
-    findings.extend(enip_findings(&host, ENIP_PORT, repo_id, budget).await);
-    findings.extend(portscan_findings(&host, repo_id, budget).await);
-    findings
-}
-
-/// Findings from probing the Modbus/TCP surface.
-async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let probe = modbus::probe(host, port, budget).await;
-    let mut findings = Vec::new();
-    if !probe.speaks_modbus {
-        // Not reachable, or the port does not speak Modbus — nothing to report.
-        return findings;
-    }
-    let target = format!("{host}:{port}");
-
-    // Reachable Modbus/TCP = unauthenticated, cleartext control access by design.
-    let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed", &target]);
-    let mut f = Finding::new(
-        repo_id.to_string(),
-        fp,
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "Modbus/TCP control interface exposed without authentication".to_string(),
-        format!(
-            "The device at {target} answers Modbus/TCP requests. Modbus/TCP has no \
-             authentication or encryption in the protocol, so any host that can reach this \
-             port can read and write process variables (coils/registers) and disrupt the \
-             controlled process."
-        ),
-        Severity::Critical,
-    );
-    f.rule_id = Some("ics-modbus-exposed".to_string());
-    f.cwe = Some("CWE-306".to_string());
-    f.remediation = Some(
-        "Restrict the Modbus/TCP port to a trusted control network (segmentation / \
-         firewall / VPN), never expose it to IT or the internet, and prefer an authenticated \
-         transport (e.g. Modbus/TLS) or a secure protocol gateway where available."
-            .to_string(),
-    );
-    findings.push(f);
-
-    if let Some(dev) = &probe.device {
-        let details = [
-            dev.vendor.as_deref(),
-            dev.product.as_deref(),
-            dev.revision.as_deref(),
-        ]
-        .into_iter()
-        .flatten()
-        .collect::<Vec<_>>()
-        .join(" / ");
-        let fp = dedup::compute_fingerprint(&[repo_id, "ics-device-disclosure", &target]);
-        let mut f = Finding::new(
-            repo_id.to_string(),
-            fp,
-            "ics-probe".to_string(),
-            ScanType::IcsProbe,
-            "PLC device identity disclosed over Modbus".to_string(),
-            format!(
-                "The device at {target} discloses its identity via Modbus Read Device \
-                 Identification: {details}. This aids fingerprinting and targeting of \
-                 known-vulnerable firmware/runtime versions."
-            ),
-            Severity::Low,
-        );
-        f.rule_id = Some("ics-device-disclosure".to_string());
-        f.cwe = Some("CWE-200".to_string());
-        f.remediation = Some(
-            "Limit network reach to the device; Modbus device identification cannot be \
-             disabled, so exposure is bounded by network segmentation."
-                .to_string(),
-        );
-        findings.push(f);
-    }
-    findings
-}
-
-/// Findings from probing the OPC UA surface (default port 4840). A reachability
-/// probe only: it flags an exposed OPC UA server for review of its security
-/// policy / authentication (deep SecurityPolicy analysis is a follow-on).
-async fn opcua_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let probe = opcua::probe(host, port, budget).await;
-    let mut findings = Vec::new();
-    if !probe.is_opcua {
-        return findings;
-    }
-    let target = format!("{host}:{port}");
-    let fp = dedup::compute_fingerprint(&[repo_id, "ics-opcua-exposed", &target]);
-    let mut f = Finding::new(
-        repo_id.to_string(),
-        fp,
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "OPC UA server exposed on the network".to_string(),
-        format!(
-            "An OPC UA server answers at {target}. Verify it enforces message security \
-             (a SecurityPolicy other than None) and rejects anonymous sessions — the common \
-             default of SecurityPolicy None + an Anonymous user token allows unauthenticated, \
-             unencrypted read/write of the server's address space."
-        ),
-        Severity::Medium,
-    );
-    f.rule_id = Some("ics-opcua-exposed".to_string());
-    f.cwe = Some("CWE-319".to_string());
-    f.remediation = Some(
-        "Restrict OPC UA (4840) to a trusted network; require a signed & encrypted \
-         SecurityPolicy (Basic256Sha256 or better) with certificate / username \
-         authentication, and disable the Anonymous user token."
-            .to_string(),
-    );
-    findings.push(f);
-    findings
-}
-
-/// Findings from probing the EtherNet/IP (CIP) surface (default port 44818).
-async fn enip_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let probe = ethernetip::probe(host, port, budget).await;
-    if !probe.is_enip {
-        return Vec::new();
-    }
-    let target = format!("{host}:{port}");
-    let fp = dedup::compute_fingerprint(&[repo_id, "ics-ethernetip-exposed", &target]);
-    let mut f = Finding::new(
-        repo_id.to_string(),
-        fp,
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "EtherNet/IP (CIP) interface exposed on the network".to_string(),
-        format!(
-            "The device at {target} answers EtherNet/IP (CIP) requests. EtherNet/IP has no \
-             authentication in the base protocol, so a host that can reach it can enumerate \
-             and interact with the device's control objects."
-        ),
-        Severity::High,
-    );
-    f.rule_id = Some("ics-ethernetip-exposed".to_string());
-    f.cwe = Some("CWE-306".to_string());
-    f.remediation = Some(
-        "Restrict EtherNet/IP (44818/2222) to a trusted control network; use CIP Security \
-         (encryption + authentication) on devices that support it."
-            .to_string(),
-    );
-    vec![f]
-}
-
-/// Findings from the service-discovery port scan of the remaining OT /
-/// insecure-management surface.
-async fn portscan_findings(host: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
-    let open = portscan::scan(host, portscan::KNOWN_PORTS, budget).await;
-    open.into_iter()
-        .map(|kp| {
-            let target = format!("{host}:{}", kp.port);
-            let (title, severity, cwe, description) = match kp.kind {
-                portscan::PortKind::Ics => (
-                    format!("ICS service exposed: {}", kp.service),
-                    Severity::High,
-                    "CWE-306",
-                    format!(
-                        "{target} exposes {} ({}). Industrial protocols are typically \
-                         unauthenticated, so network reach implies control access.",
-                        kp.service, kp.note
-                    ),
-                ),
-                portscan::PortKind::InsecureMgmt => (
-                    format!("Cleartext service exposed: {}", kp.service),
-                    Severity::Medium,
-                    "CWE-319",
-                    format!(
-                        "{target} exposes {} ({}), which transmits credentials and data in \
-                         cleartext.",
-                        kp.service, kp.note
-                    ),
-                ),
-            };
-            let fp = dedup::compute_fingerprint(&[repo_id, "ics-service-exposed", &target]);
-            let mut f = Finding::new(
-                repo_id.to_string(),
-                fp,
-                "ics-probe".to_string(),
-                ScanType::IcsProbe,
-                title,
-                description,
-                severity,
-            );
-            f.rule_id = Some("ics-service-exposed".to_string());
-            f.cwe = Some(cwe.to_string());
-            f.remediation = Some(
-                "Restrict the service to a trusted network segment; disable it if unused; \
-                 replace cleartext protocols (Telnet/FTP) with SSH/SFTP."
-                    .to_string(),
-            );
-            f
-        })
-        .collect()
-}
-
-/// Extract `(host, port)` from a target reference. Modbus lives on its own port
-/// (502 by default), independent of any HTTP/WebVisu URL, so unless the reference
-/// explicitly carries `modbus://host:port` or a bare `host:port`, we probe 502.
-fn parse_endpoint(endpoint: &str) -> (String, u16) {
-    let s = endpoint.trim();
-    let (scheme, rest) = match s.split_once("://") {
-        Some((sch, r)) => (Some(sch.to_ascii_lowercase()), r),
-        None => (None, s),
-    };
-    let hostport = rest.split(['/', '?']).next().unwrap_or(rest);
-    let (host, port) = match hostport.rsplit_once(':') {
-        Some((h, p)) => (h.to_string(), p.parse::<u16>().ok()),
-        None => (hostport.to_string(), None),
-    };
-    let port = match (scheme.as_deref(), port) {
-        // Explicit Modbus port, or a bare host:port the user chose.
-        (Some("modbus"), Some(p)) | (None, Some(p)) => p,
-        // An http(s)/WebVisu URL (or no port): Modbus is on its own port.
-        _ => MODBUS_PORT,
-    };
-    (host, port)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::parse_endpoint;
-
-    #[test]
-    fn endpoint_parsing_picks_the_modbus_port() {
-        assert_eq!(parse_endpoint("10.0.0.5"), ("10.0.0.5".into(), 502));
-        assert_eq!(parse_endpoint("10.0.0.5:1502"), ("10.0.0.5".into(), 1502));
-        assert_eq!(
-            parse_endpoint("modbus://plc.local:5020"),
-            ("plc.local".into(), 5020)
-        );
-        // A WebVisu URL: the http port is ignored; Modbus is on 502.
-        assert_eq!(
-            parse_endpoint("http://plc.local:8080/webvisu"),
-            ("plc.local".into(), 502)
-        );
-        assert_eq!(
-            parse_endpoint("https://plc.local/"),
-            ("plc.local".into(), 502)
-        );
-    }
-}

compliance-agent/src/pipeline/ics/modbus.rs

@@ -1,205 +0,0 @@
-//! Minimal Modbus/TCP client for dynamic ICS probing.
-//!
-//! Modbus/TCP (port 502) has no authentication or encryption in the protocol, so
-//! an endpoint that answers requests is, by design, open to any host that can
-//! reach it. The probe only *reads* — a Read Holding Registers request and a Read
-//! Device Identification request — and never writes to the live process.
-
-use std::time::Duration;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Outcome of probing a Modbus/TCP endpoint.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct ModbusProbe {
-    /// A TCP connection to the port was established.
-    pub reachable: bool,
-    /// The endpoint answered a Modbus request (a normal reply or a Modbus
-    /// exception) — i.e. it speaks Modbus, unauthenticated.
-    pub speaks_modbus: bool,
-    /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
-    pub device: Option<DeviceId>,
-}
-
-/// Vendor / product / revision from Read Device Identification.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct DeviceId {
-    pub vendor: Option<String>,
-    pub product: Option<String>,
-    pub revision: Option<String>,
-}
-
-/// Probe a Modbus/TCP endpoint. Read-only: issues a Read Holding Registers and a
-/// Read Device Identification request; never writes to the device.
-pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
-    let mut out = ModbusProbe::default();
-    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
-        return out; // unreachable
-    };
-    out.reachable = true;
-
-    // Read Holding Registers (FC 0x03), unit 1, addr 0, qty 1 — a benign read.
-    let rhr = [0x03u8, 0x00, 0x00, 0x00, 0x01];
-    if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
-        // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
-        if matches!(resp.first(), Some(0x03) | Some(0x83)) {
-            out.speaks_modbus = true;
-        }
-    }
-
-    // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
-    let rdi = [0x2Bu8, 0x0E, 0x01, 0x00];
-    if let Some(resp) = txn(&mut stream, 1, &rdi, budget).await {
-        if resp.first() == Some(&0x2B) {
-            out.speaks_modbus = true;
-            out.device = parse_device_id(&resp);
-        }
-    }
-    out
-}
-
-/// Send one Modbus PDU and return the response PDU (function code + data), or
-/// `None` on timeout / malformed reply.
-async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
-    // MBAP header: transaction id (2) + protocol id (2) = 0 + length (2) + unit (1),
-    // then the PDU. `length` counts the unit byte plus the PDU.
-    let len = (pdu.len() + 1) as u16;
-    let mut frame = Vec::with_capacity(7 + pdu.len());
-    frame.extend_from_slice(&[0x00, 0x01]); // transaction id
-    frame.extend_from_slice(&[0x00, 0x00]); // protocol id
-    frame.extend_from_slice(&len.to_be_bytes());
-    frame.push(unit);
-    frame.extend_from_slice(pdu);
-    timeout(budget, stream.write_all(&frame)).await.ok()?.ok()?;
-
-    let mut hdr = [0u8; 7];
-    timeout(budget, stream.read_exact(&mut hdr))
-        .await
-        .ok()?
-        .ok()?;
-    // Reject non-Modbus replies (protocol id must be 0).
-    if hdr[2] != 0 || hdr[3] != 0 {
-        return None;
-    }
-    let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
-    if !(2..=260).contains(&plen) {
-        return None;
-    }
-    let mut body = vec![0u8; plen - 1]; // minus the unit id already in hdr[6]
-    timeout(budget, stream.read_exact(&mut body))
-        .await
-        .ok()?
-        .ok()?;
-    Some(body)
-}
-
-/// Parse vendor / product / revision from a Read Device Identification PDU:
-/// `[0x2B, 0x0E, readDevIdCode, conformity, moreFollows, nextObjId, numObjects,
-/// (objId, len, bytes…)…]`.
-fn parse_device_id(pdu: &[u8]) -> Option<DeviceId> {
-    if pdu.len() < 7 {
-        return None;
-    }
-    let num = pdu[6] as usize;
-    let mut i = 7;
-    let mut dev = DeviceId::default();
-    for _ in 0..num {
-        if i + 2 > pdu.len() {
-            break;
-        }
-        let id = pdu[i];
-        let l = pdu[i + 1] as usize;
-        i += 2;
-        if i + l > pdu.len() {
-            break;
-        }
-        let val = String::from_utf8_lossy(&pdu[i..i + l]).trim().to_string();
-        i += l;
-        match id {
-            0x00 => dev.vendor = Some(val),
-            0x01 => dev.product = Some(val),
-            0x02 => dev.revision = Some(val),
-            _ => {}
-        }
-    }
-    if dev == DeviceId::default() {
-        None
-    } else {
-        Some(dev)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    /// A one-shot mock Modbus/TCP server that answers a Read Holding Registers
-    /// request and a Read Device Identification request on one connection.
-    async fn mock_server(with_device: bool) -> std::net::SocketAddr {
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let addr = listener.local_addr().expect("addr");
-        tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.expect("accept");
-            loop {
-                let mut hdr = [0u8; 7];
-                if sock.read_exact(&mut hdr).await.is_err() {
-                    break;
-                }
-                let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
-                let mut pdu = vec![0u8; plen - 1];
-                if sock.read_exact(&mut pdu).await.is_err() {
-                    break;
-                }
-                let reply_pdu: Vec<u8> = match pdu.first() {
-                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register = 0
-                    Some(0x2B) if with_device => vec![
-                        0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
-                        0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
-                        0x01, 0x03, b'P', b'L', b'C', // product
-                    ],
-                    _ => vec![pdu[0] | 0x80, 0x01], // exception
-                };
-                let len = (reply_pdu.len() + 1) as u16;
-                let mut frame = vec![hdr[0], hdr[1], 0x00, 0x00];
-                frame.extend_from_slice(&len.to_be_bytes());
-                frame.push(hdr[6]);
-                frame.extend_from_slice(&reply_pdu);
-                if sock.write_all(&frame).await.is_err() {
-                    break;
-                }
-            }
-        });
-        addr
-    }
-
-    #[tokio::test]
-    async fn probe_detects_a_modbus_endpoint_and_reads_device_id() {
-        let addr = mock_server(true).await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.reachable && p.speaks_modbus);
-        let dev = p.device.expect("device id");
-        assert_eq!(dev.vendor.as_deref(), Some("ACME"));
-        assert_eq!(dev.product.as_deref(), Some("PLC"));
-    }
-
-    #[tokio::test]
-    async fn probe_reports_unreachable_for_a_closed_port() {
-        // 127.0.0.1:1 is (almost certainly) closed.
-        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
-        assert!(!p.reachable && !p.speaks_modbus);
-    }
-
-    #[test]
-    fn parses_device_identification_objects() {
-        let pdu = [
-            0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x01, // 1 object
-            0x02, 0x05, b'v', b'1', b'.', b'2', b'3', // revision
-        ];
-        let dev = parse_device_id(&pdu).expect("device");
-        assert_eq!(dev.revision.as_deref(), Some("v1.23"));
-        assert!(dev.vendor.is_none());
-    }
-}

compliance-agent/src/pipeline/ics/opcua.rs

@@ -1,131 +0,0 @@
-//! Minimal OPC UA reachability probe.
-//!
-//! Speaks just the OPC UA Connection Protocol (UACP) handshake — a `HEL` (Hello)
-//! message, expecting an `ACK` (or `ERR`) reply — to confirm an OPC UA server is
-//! listening (default port 4840). It does **not** open a secure channel or make
-//! service calls; deep analysis of the server's SecurityPolicy / user-token
-//! policies (the common `None` + `Anonymous` misconfiguration) is a follow-on best
-//! done with a full OPC UA stack.
-
-use std::time::Duration;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Outcome of an OPC UA handshake probe.
-#[derive(Debug, Default, PartialEq, Eq)]
-pub struct OpcUaProbe {
-    /// A TCP connection to the port was established.
-    pub reachable: bool,
-    /// The endpoint replied to the UACP Hello (`ACK`) or rejected it (`ERR`) —
-    /// either way it speaks OPC UA.
-    pub is_opcua: bool,
-}
-
-/// Probe an OPC UA endpoint with a UACP Hello. Read-only handshake only.
-pub async fn probe(host: &str, port: u16, budget: Duration) -> OpcUaProbe {
-    let mut out = OpcUaProbe::default();
-    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
-        return out;
-    };
-    out.reachable = true;
-
-    let hello = hello_message(&format!("opc.tcp://{host}:{port}"));
-    if timeout(budget, stream.write_all(&hello))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-
-    // Read the 3-byte message type of the reply: ACK (accepted) or ERR (rejected
-    // our hello) both prove the peer speaks the OPC UA connection protocol.
-    let mut mt = [0u8; 3];
-    if timeout(budget, stream.read_exact(&mut mt))
-        .await
-        .ok()
-        .and_then(Result::ok)
-        .is_none()
-    {
-        return out;
-    }
-    if &mt == b"ACK" || &mt == b"ERR" {
-        out.is_opcua = true;
-    }
-    out
-}
-
-/// Build a UACP `HEL` (Hello) message advertising our buffer sizes + endpoint URL.
-fn hello_message(endpoint_url: &str) -> Vec<u8> {
-    let url = endpoint_url.as_bytes();
-    let mut m = Vec::with_capacity(32 + url.len());
-    m.extend_from_slice(b"HELF");
-    m.extend_from_slice(&0u32.to_le_bytes()); // message size — patched below
-    m.extend_from_slice(&0u32.to_le_bytes()); // ProtocolVersion
-    m.extend_from_slice(&65536u32.to_le_bytes()); // ReceiveBufferSize
-    m.extend_from_slice(&65536u32.to_le_bytes()); // SendBufferSize
-    m.extend_from_slice(&0u32.to_le_bytes()); // MaxMessageSize (0 = no limit)
-    m.extend_from_slice(&0u32.to_le_bytes()); // MaxChunkCount
-    m.extend_from_slice(&(url.len() as i32).to_le_bytes()); // EndpointUrl length
-    m.extend_from_slice(url);
-    let size = m.len() as u32;
-    m[4..8].copy_from_slice(&size.to_le_bytes());
-    m
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    /// A mock OPC UA server that reads the Hello and replies with an `ACK` frame.
-    async fn mock_server() -> std::net::SocketAddr {
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let addr = listener.local_addr().expect("addr");
-        tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.expect("accept");
-            // Read the Hello header (8 bytes) to learn the size, then drain it.
-            let mut hdr = [0u8; 8];
-            if sock.read_exact(&mut hdr).await.is_err() {
-                return;
-            }
-            let size = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
-            let mut rest = vec![0u8; size.saturating_sub(8)];
-            let _ = sock.read_exact(&mut rest).await;
-            // Reply: ACK + size + 5 u32 fields.
-            let mut ack = Vec::new();
-            ack.extend_from_slice(b"ACKF");
-            ack.extend_from_slice(&28u32.to_le_bytes());
-            for _ in 0..5 {
-                ack.extend_from_slice(&0u32.to_le_bytes());
-            }
-            let _ = sock.write_all(&ack).await;
-        });
-        addr
-    }
-
-    #[tokio::test]
-    async fn probe_detects_an_opcua_server() {
-        let addr = mock_server().await;
-        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
-        assert!(p.reachable && p.is_opcua);
-    }
-
-    #[tokio::test]
-    async fn probe_reports_unreachable_for_a_closed_port() {
-        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
-        assert!(!p.reachable && !p.is_opcua);
-    }
-
-    #[test]
-    fn hello_message_is_well_formed() {
-        let m = hello_message("opc.tcp://h:4840");
-        assert_eq!(&m[0..4], b"HELF");
-        // The embedded size equals the actual length.
-        let size = u32::from_le_bytes([m[4], m[5], m[6], m[7]]) as usize;
-        assert_eq!(size, m.len());
-    }
-}

compliance-agent/src/pipeline/ics/portscan.rs

@@ -1,137 +0,0 @@
-//! TCP service discovery for a device.
-//!
-//! Connect-scans a curated set of OT/ICS and insecure-management ports and reports
-//! the ones that are open. The deep protocol probes own Modbus (502), OPC UA
-//! (4840) and EtherNet/IP (44818); this surfaces the *rest* of the industrial and
-//! cleartext-management surface (Siemens S7, DNP3, CODESYS programming, Telnet, …).
-
-use std::time::Duration;
-
-use futures_util::future::join_all;
-use tokio::net::TcpStream;
-use tokio::time::timeout;
-
-/// Whether an open port is an industrial protocol or an insecure management service.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PortKind {
-    /// An industrial control protocol (typically unauthenticated).
-    Ics,
-    /// A cleartext management service (credentials/data in the clear).
-    InsecureMgmt,
-}
-
-/// A well-known port worth flagging when open.
-#[derive(Debug, Clone, Copy)]
-pub struct KnownPort {
-    pub port: u16,
-    pub service: &'static str,
-    pub kind: PortKind,
-    pub note: &'static str,
-}
-
-/// The curated scan list. Excludes 502 / 4840 / 44818 — those have dedicated deep
-/// probes (Modbus, OPC UA, EtherNet/IP) that report richer findings.
-pub const KNOWN_PORTS: &[KnownPort] = &[
-    KnownPort {
-        port: 102,
-        service: "S7comm / ISO-TSAP",
-        kind: PortKind::Ics,
-        note: "Siemens S7 PLC communication",
-    },
-    KnownPort {
-        port: 20000,
-        service: "DNP3",
-        kind: PortKind::Ics,
-        note: "SCADA / DNP3",
-    },
-    KnownPort {
-        port: 1911,
-        service: "Niagara Fox",
-        kind: PortKind::Ics,
-        note: "Tridium Niagara building automation",
-    },
-    KnownPort {
-        port: 11740,
-        service: "CODESYS",
-        kind: PortKind::Ics,
-        note: "CODESYS programming protocol",
-    },
-    KnownPort {
-        port: 1962,
-        service: "PCWorx",
-        kind: PortKind::Ics,
-        note: "Phoenix Contact PCWorx",
-    },
-    KnownPort {
-        port: 9600,
-        service: "OMRON FINS",
-        kind: PortKind::Ics,
-        note: "Omron FINS",
-    },
-    KnownPort {
-        port: 789,
-        service: "Red Lion Crimson",
-        kind: PortKind::Ics,
-        note: "Red Lion controllers",
-    },
-    KnownPort {
-        port: 23,
-        service: "Telnet",
-        kind: PortKind::InsecureMgmt,
-        note: "cleartext remote shell",
-    },
-    KnownPort {
-        port: 21,
-        service: "FTP",
-        kind: PortKind::InsecureMgmt,
-        note: "cleartext file transfer",
-    },
-];
-
-/// Connect-scan `ports` on `host` (concurrently) and return those that accept a
-/// TCP connection.
-pub async fn scan<'a>(host: &str, ports: &'a [KnownPort], budget: Duration) -> Vec<&'a KnownPort> {
-    let checks = ports.iter().map(|kp| async move {
-        let open = timeout(budget, TcpStream::connect((host, kp.port)))
-            .await
-            .map(|r| r.is_ok())
-            .unwrap_or(false);
-        (kp, open)
-    });
-    join_all(checks)
-        .await
-        .into_iter()
-        .filter_map(|(kp, open)| open.then_some(kp))
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::net::TcpListener;
-
-    #[tokio::test]
-    async fn scan_reports_only_open_ports() {
-        // Bind one port (open) and pick another that is closed.
-        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
-        let open_port = listener.local_addr().expect("addr").port();
-
-        let ports = [
-            KnownPort {
-                port: open_port,
-                service: "test-open",
-                kind: PortKind::Ics,
-                note: "",
-            },
-            KnownPort {
-                port: 1,
-                service: "test-closed",
-                kind: PortKind::InsecureMgmt,
-                note: "",
-            },
-        ];
-        let found = scan("127.0.0.1", &ports, Duration::from_millis(500)).await;
-        let services: Vec<&str> = found.iter().map(|p| p.service).collect();
-        assert_eq!(services, vec!["test-open"]);
-    }
-}

compliance-agent/src/pipeline/mod.rs

@@ -5,7 +5,6 @@ pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
-pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;

compliance-agent/src/pipeline/orchestrator.rs

@@ -259,12 +259,67 @@ impl PipelineOrchestrator {
                 .await?;
         }
 
-        // Persist CVE alerts and create notifications (shared with the PLC path).
-        let new_notif_count = self
-            .persist_cve_alerts(&repo_id, &repo.name, &cve_alerts)
-            .await?;
-        if new_notif_count > 0 {
-            tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
+        // Persist CVE alerts and create notifications
+        {
+            use compliance_core::models::notification::{parse_severity, CveNotification};
+
+            let repo_name = repo.name.clone();
+            let mut new_notif_count = 0u32;
+
+            for alert in &cve_alerts {
+                // Upsert the alert
+                let filter = doc! {
+                    "cve_id": &alert.cve_id,
+                    "repo_id": &alert.repo_id,
+                };
+                let update = mongodb::bson::to_document(alert)
+                    .map(|d| doc! { "$set": d })
+                    .unwrap_or_else(|_| doc! {});
+                self.db
+                    .cve_alerts()
+                    .update_one(filter, update)
+                    .upsert(true)
+                    .await?;
+
+                // Create notification (dedup by cve_id + repo + package + version)
+                let notif_filter = doc! {
+                    "cve_id": &alert.cve_id,
+                    "repo_id": &alert.repo_id,
+                    "package_name": &alert.affected_package,
+                    "package_version": &alert.affected_version,
+                };
+                let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
+                let mut notification = CveNotification::new(
+                    alert.cve_id.clone(),
+                    repo_id.clone(),
+                    repo_name.clone(),
+                    alert.affected_package.clone(),
+                    alert.affected_version.clone(),
+                    severity,
+                );
+                notification.cvss_score = alert.cvss_score;
+                notification.summary = alert.summary.clone();
+                notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
+
+                let notif_update = doc! {
+                    "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
+                };
+                if let Ok(result) = self
+                    .db
+                    .cve_notifications()
+                    .update_one(notif_filter, notif_update)
+                    .upsert(true)
+                    .await
+                {
+                    if result.upserted_id.is_some() {
+                        new_notif_count += 1;
+                    }
+                }
+            }
+
+            if new_notif_count > 0 {
+                tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
+            }
         }
 
         // Stage 6: Issue Creation
@@ -394,56 +449,38 @@ impl PipelineOrchestrator {
         // wizard-created targets, not just migrated ones.
         self.ensure_dast_target(target, &plan).await;
 
-        // PLC/SPS targets: the control-logic scan consumes the PLC source (an
-        // uploaded PlcProject *or* a git repo / source archive of PLCopen XML / ST
-        // exports), so it takes over the code artifact — we don't also run the
-        // SAST pipeline over it. A PLC device is reachable, so DAST still runs
-        // against a WebVisu / exposed endpoint when one is provisioned.
-        let mut new_count = 0u32;
-        let plc = plan.has(ScanType::PlcControlLogic);
-        let ics = plan.has(ScanType::IcsProbe);
-        if plc {
-            new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
-        }
-        if ics {
-            new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
-        }
-        if plc || ics {
-            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint. The
-            // control-logic scan already consumed the code artifact, so the SAST
-            // pipeline is not re-run.
-            self.update_phase(scan_run_id, "dast_scanning").await;
-            self.maybe_trigger_dast(&target_id, scan_run_id).await;
-            return Ok(new_count);
+        // PLC control-logic analysis for PLC/SPS targets (a PlcProject artifact).
+        if plan.has(ScanType::PlcControlLogic) {
+            return self.run_plc_scan(target, &target_id, scan_run_id).await;
         }
 
         match target.code_artifact() {
             Some(code) if code.kind == ArtifactKind::GitRepo => {
                 let repo = RepoView::from_target(target, code);
-                let n = self.run_pipeline(&repo, scan_run_id).await?;
-                self.finalize_target(target, &repo, n).await?;
-                new_count += n;
+                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
+                self.finalize_target(target, &repo, new_count).await?;
+                Ok(new_count)
             }
             Some(_) => {
                 tracing::warn!(
                     target_id = %target_id,
                     "Unified pipeline: source-archive scanning not yet wired; skipping"
                 );
+                Ok(0)
             }
             None => {
-                // No code to scan (a migrated DAST target). Firmware/mobile static
-                // scanners land in #128/#129; DAST for a running URL works when a
-                // DastTarget row exists (provisioned above from a LiveUrl, or from
-                // a migrated target).
+                // No code to scan. Firmware/PLC/mobile static scanners land in
+                // #128/#129/#130; DAST for a running URL still works when a
+                // DastTarget row exists (migrated targets).
                 tracing::info!(
                     target_id = %target_id,
-                    "Unified pipeline: no code artifact; attempting DAST"
+                    "Unified pipeline: no code artifact; attempting DAST only"
                 );
                 self.update_phase(scan_run_id, "dast_scanning").await;
                 self.maybe_trigger_dast(&target_id, scan_run_id).await;
+                Ok(0)
             }
         }
-        Ok(new_count)
     }
 
     /// Analyze a PLC/SPS project (Structured Text / PLCopen XML) for
@@ -459,104 +496,22 @@ impl PipelineOrchestrator {
 
         let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
         let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
-        // Every PLC-source artifact on the target: dedicated PLC projects plus any
-        // code artifacts (git repo / source archive) holding PLCopen XML / ST
-        // exports. A target can carry several (e.g. one POU export per file).
-        let sources: Vec<&Artifact> = target
-            .artifacts
-            .iter()
-            .filter(|a| {
-                matches!(
-                    a.kind,
-                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-                )
-            })
-            .collect();
-        if sources.is_empty() {
-            tracing::warn!(target_id, "PLC scan: no PLC source artifact");
+        let path = target
+            .first_of(ArtifactKind::PlcProject)
+            .and_then(|a| ingest_set.get(&a.id))
+            .and_then(|ia| ia.working_path.clone());
+        let Some(path) = path else {
+            tracing::warn!(target_id, "PLC scan: no ingested PLC project path");
             return Ok(0);
-        }
+        };
 
-        let mut all_findings = Vec::new();
-        let mut all_sbom: Vec<SbomEntry> = Vec::new();
-        let mut sbom_seen = std::collections::BTreeSet::new();
-        for a in &sources {
-            let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
-                continue;
-            };
-            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
-            // Control-application SBOM: CODESYS libraries + runtime from a
-            // `.projectarchive` (uploaded, or committed in the working tree).
-            let archive = a
-                .stored_path
-                .clone()
-                .unwrap_or_else(|| a.source_ref.clone());
-            for e in crate::pipeline::plc::sbom::collect_sbom(
-                std::path::Path::new(&archive),
-                &path,
-                target_id,
-            ) {
-                if sbom_seen.insert((e.name.clone(), e.version.clone())) {
-                    all_sbom.push(e);
-                }
-            }
-        }
+        let findings = crate::pipeline::plc::analyze_tree(&path, target_id);
         tracing::info!(
             target_id,
-            artifacts = sources.len(),
-            found = all_findings.len(),
+            found = findings.len(),
             "PLC control-logic analysis complete"
         );
 
-        let mut new_count = 0u32;
-        for mut finding in all_findings {
-            finding.scan_run_id = Some(scan_run_id.to_string());
-            if self
-                .db
-                .findings()
-                .find_one(doc! { "fingerprint": &finding.fingerprint })
-                .await?
-                .is_none()
-            {
-                self.db.findings().insert_one(&finding).await?;
-                new_count += 1;
-            }
-        }
-
-        if !all_sbom.is_empty() {
-            if let Err(e) = self
-                .persist_control_app_sbom(target_id, &target.name, all_sbom)
-                .await
-            {
-                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
-            }
-        }
-        Ok(new_count)
-    }
-
-    /// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
-    /// and persist findings for exposed / unauthenticated control access. The
-    /// probe is read-only; it targets the Modbus port of the target's live URL.
-    async fn run_ics_probe(
-        &self,
-        target: &OnboardedTarget,
-        target_id: &str,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
-        self.update_phase(scan_run_id, "ics_probe").await;
-        let Some(endpoint) = target.live_url().map(|a| a.source_ref.clone()) else {
-            tracing::warn!(target_id, "ICS probe: no live URL");
-            return Ok(0);
-        };
-        // Short per-request budget so an unreachable device doesn't stall the scan.
-        let budget = std::time::Duration::from_secs(5);
-        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
-        tracing::info!(
-            target_id,
-            endpoint = %endpoint,
-            found = findings.len(),
-            "ICS probe complete"
-        );
         let mut new_count = 0u32;
         for mut finding in findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
@@ -574,150 +529,6 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
-    /// Store a control-application SBOM (CODESYS libraries + runtime) for a target
-    /// and match it against known CVEs. Scoped to `package_manager = "codesys"` so
-    /// it refreshes on re-scan and coexists with any firmware/source SBOM. The
-    /// runtime `Cmp*` / `3SLicense` components carry real CODESYS advisories, so
-    /// this is where PLC-device CVE coverage comes from.
-    async fn persist_control_app_sbom(
-        &self,
-        target_id: &str,
-        target_name: &str,
-        mut entries: Vec<SbomEntry>,
-    ) -> Result<(), AgentError> {
-        if entries.is_empty() {
-            return Ok(());
-        }
-        self.db
-            .sbom_entries()
-            .delete_many(doc! { "repo_id": target_id, "package_manager": "codesys" })
-            .await?;
-
-        let cve_scanner = CveScanner::new(
-            self.http.clone(),
-            self.config.searxng_url.clone(),
-            self.config.nvd_api_key.as_ref().map(|k| {
-                use secrecy::ExposeSecret;
-                k.expose_secret().to_string()
-            }),
-        );
-        let mut alerts = match tokio::time::timeout(
-            std::time::Duration::from_secs(600),
-            cve_scanner.scan_dependencies(target_id, &mut entries),
-        )
-        .await
-        {
-            Ok(Ok(a)) => a,
-            Ok(Err(e)) => {
-                tracing::warn!(target_id, error = %e, "control-app CVE scan failed");
-                Vec::new()
-            }
-            Err(_) => {
-                tracing::warn!(target_id, "control-app CVE scan timed out");
-                Vec::new()
-            }
-        };
-        // OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
-        // live in NVD keyed by CPE + runtime version. Add those (best-effort).
-        if let Ok(codesys) = tokio::time::timeout(
-            std::time::Duration::from_secs(120),
-            cve_scanner.scan_codesys(target_id, &mut entries),
-        )
-        .await
-        {
-            alerts.extend(codesys);
-        } else {
-            tracing::warn!(target_id, "CODESYS CVE match timed out");
-        }
-
-        for entry in &entries {
-            let filter = doc! {
-                "repo_id": &entry.repo_id,
-                "name": &entry.name,
-                "version": &entry.version,
-            };
-            if let Ok(d) = mongodb::bson::to_document(entry) {
-                self.db
-                    .sbom_entries()
-                    .update_one(filter, doc! { "$set": d })
-                    .upsert(true)
-                    .await?;
-            }
-        }
-        let new_notifs = self
-            .persist_cve_alerts(target_id, target_name, &alerts)
-            .await?;
-        tracing::info!(
-            target_id,
-            components = entries.len(),
-            alerts = alerts.len(),
-            notifications = new_notifs,
-            "control-app SBOM stored"
-        );
-        Ok(())
-    }
-
-    /// Upsert CVE alerts for a target and create dedup'd CVE notifications;
-    /// returns the number of newly-created notifications. Shared by the SAST
-    /// pipeline and the PLC control-app SBOM path, so every SBOM source (source,
-    /// firmware, CODESYS libraries/runtime) raises the same notifications.
-    async fn persist_cve_alerts(
-        &self,
-        repo_id: &str,
-        repo_name: &str,
-        alerts: &[CveAlert],
-    ) -> Result<u32, AgentError> {
-        use compliance_core::models::notification::{parse_severity, CveNotification};
-
-        let mut new_notif = 0u32;
-        for alert in alerts {
-            let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
-            let update = mongodb::bson::to_document(alert)
-                .map(|d| doc! { "$set": d })
-                .unwrap_or_else(|_| doc! {});
-            self.db
-                .cve_alerts()
-                .update_one(filter, update)
-                .upsert(true)
-                .await?;
-
-            // Dedup notifications by cve + repo + package + version.
-            let notif_filter = doc! {
-                "cve_id": &alert.cve_id,
-                "repo_id": &alert.repo_id,
-                "package_name": &alert.affected_package,
-                "package_version": &alert.affected_version,
-            };
-            let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
-            let mut notification = CveNotification::new(
-                alert.cve_id.clone(),
-                repo_id.to_string(),
-                repo_name.to_string(),
-                alert.affected_package.clone(),
-                alert.affected_version.clone(),
-                severity,
-            );
-            notification.cvss_score = alert.cvss_score;
-            notification.summary = alert.summary.clone();
-            notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
-            let notif_update = doc! {
-                "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
-            };
-            if let Ok(result) = self
-                .db
-                .cve_notifications()
-                .update_one(notif_filter, notif_update)
-                .upsert(true)
-                .await
-            {
-                if result.upserted_id.is_some() {
-                    new_notif += 1;
-                }
-            }
-        }
-        Ok(new_notif)
-    }
-
     /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
     /// heuristics otherwise), and store the detected classification on the target.
     /// Best-effort — never fails the scan.

compliance-agent/src/pipeline/plan.rs

@@ -75,16 +75,10 @@ pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
 }
 
 /// Resolve the artifact a scan consumes. A "code" requirement (represented by
-/// `GitRepo`) is satisfied by a git repo *or* a source archive. The PLC
-/// control-logic requirement (represented by `PlcProject`) prefers an uploaded
-/// PLC project but also accepts a code artifact — a git repo / source archive
-/// holding PLCopen XML / ST exports.
+/// `GitRepo`) is satisfied by a git repo *or* a source archive.
 fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
     match required {
         Some(ArtifactKind::GitRepo) => target.code_artifact(),
-        Some(ArtifactKind::PlcProject) => target
-            .first_of(ArtifactKind::PlcProject)
-            .or_else(|| target.code_artifact()),
         Some(kind) => target.first_of(kind),
         None => target.code_artifact().or_else(|| target.artifacts.first()),
     }
@@ -106,7 +100,6 @@ fn phase_for(scan: ScanType) -> ScanPhase {
         ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
         ScanType::MobileStatic => ScanPhase::MobileStatic,
         ScanType::ContainerScan => ScanPhase::ContainerScan,
-        ScanType::IcsProbe => ScanPhase::IcsProbe,
     }
 }
 
@@ -181,18 +174,6 @@ mod tests {
         assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
     }
 
-    #[test]
-    fn plc_control_logic_binds_to_a_git_repo() {
-        // A CODESYS project in git (PLCopen XML / ST exports) with no uploaded
-        // PlcProject: control-logic still plans, bound to the git artifact.
-        let git = Artifact::git_repo("https://git/plc", "main");
-        let git_id = git.id.clone();
-        let t = target(TargetType::PlcSps, vec![git]);
-        let plan = build_scan_plan(&t);
-        let step = step_for(&plan, ScanType::PlcControlLogic).expect("control-logic planned");
-        assert_eq!(step.artifact_id, git_id, "PLC scan binds to the git repo");
-    }
-
     #[test]
     fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
         let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);

compliance-agent/src/pipeline/plc/mod.rs

@@ -9,7 +9,6 @@ pub mod lexer;
 pub mod parser;
 pub mod plcopen;
 pub mod rules;
-pub mod sbom;
 
 use std::path::Path;
 
@@ -198,37 +197,4 @@ mod tests {
             "the CASE state machine uses no JMP"
         );
     }
-
-    /// Graphical logic must be analysed too: an FBD POU (blocks + in/out
-    /// variables) is translated to synthetic ST, so the same rules fire on the
-    /// cleartext Modbus block, the hardcoded HMI password and the safety write.
-    #[test]
-    fn fbd_graphical_body_is_analysed() {
-        let all = analyze_tree(&demo_dir(), "demo-target");
-        let fbd: Vec<_> = all
-            .iter()
-            .filter(|f| {
-                f.file_path
-                    .as_deref()
-                    .is_some_and(|p| p.ends_with("pump_fbd.xml"))
-            })
-            .collect();
-        assert!(
-            !fbd.is_empty(),
-            "pump_fbd.xml (FBD) should produce findings"
-        );
-
-        let rules: HashSet<&str> = fbd.iter().filter_map(|f| f.rule_id.as_deref()).collect();
-        for r in [
-            "plc-insecure-comm",          // Modbus_TCP_Master(AUTH := FALSE)
-            "plc-insecure-protocol-port", // PORT := 502
-            "plc-hardcoded-credential",   // HmiPassword := 'admin123'
-            "plc-safety-bypass",          // Safety_Enable := FALSE
-        ] {
-            assert!(
-                rules.contains(r),
-                "expected rule {r} from FBD; got {rules:?}"
-            );
-        }
-    }
 }

compliance-agent/src/pipeline/plc/plcopen.rs

@@ -1,30 +1,17 @@
 //! PLCopen XML → Structured Text POUs.
 //!
 //! A PLCopen project stores each POU as `<pou name=".." pouType="..">` with an
-//! `<interface>` (typed variable sections) and a `<body>` in one of the IEC
-//! 61131-3 languages. We reconstruct an equivalent Structured-Text source for
-//! each POU (a `VAR` block from the interface + statements from the body) and run
-//! it through the ST parser, so raw `.st` files and PLCopen projects — textual or
-//! graphical — flow through one analysis path.
+//! `<interface>` (typed variable sections) and a `<body>`. We handle the
+//! Structured-Text body form (`<ST>…</ST>`); FBD/LD/SFC bodies are skipped.
 //!
-//! Body languages:
-//! - **ST** — taken verbatim.
-//! - **FBD / LD** — the graphical network is translated to synthetic ST: blocks
-//!   become calls (`TypeName(pin := arg, …)`), out-variables / coils become
-//!   assignments, with input pins resolved by tracing connections. This lets the
-//!   semantic rules see comm calls, hardcoded arguments and safety writes that
-//!   live in graphical logic, not just in text.
-//! - **SFC** — the step/transition graph itself is skipped; the ST/FBD/LD bodies
-//!   embedded in its actions and transitions are still translated.
-
-use std::collections::HashMap;
-
-use roxmltree::Node;
+//! For each ST POU we reconstruct an equivalent ST source (a `VAR` block built
+//! from the interface + the ST body) and run it through the ST parser, so both
+//! raw `.st` files and PLCopen projects flow through one analysis path.
 
 use super::ast::Pou;
 use super::parser;
 
-/// Parse every POU out of a PLCopen XML document (ST, FBD or LD bodies).
+/// Parse every Structured-Text POU out of a PLCopen XML document.
 pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
     let doc = match roxmltree::Document::parse(xml) {
         Ok(d) => d,
@@ -35,9 +22,14 @@ pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
         let name = pou.attribute("name").unwrap_or("pou").to_string();
         let pou_type = pou.attribute("pouType").unwrap_or("program");
 
-        let Some(body) = reconstruct_body(pou) else {
+        // ST body text (skip non-ST bodies).
+        let Some(st_node) = pou
+            .descendants()
+            .find(|n| n.has_tag_name("ST") && n.ancestors().any(|a| a.has_tag_name("body")))
+        else {
             continue;
         };
+        let body = collect_text(st_node);
         if body.trim().is_empty() {
             continue;
         }
@@ -54,195 +46,17 @@ pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
     pous
 }
 
-/// Case-insensitive tag match (PLCopen uses `FBD`/`LD`/`ST`, CODESYS may vary).
-fn tag_is(n: &Node, name: &str) -> bool {
-    n.tag_name().name().eq_ignore_ascii_case(name)
-}
-
-/// Reconstruct a POU's body as Structured Text, whatever language it is written
-/// in. Concatenates every language body found under `<body>` (SFC actions and
-/// transitions carry their own ST/FBD/LD sub-bodies).
-fn reconstruct_body(pou: Node) -> Option<String> {
-    let mut out = String::new();
-    for body in pou.descendants().filter(|n| tag_is(n, "body")) {
-        for lang in body.children().filter(|n| n.is_element()) {
-            let piece = match lang.tag_name().name().to_ascii_uppercase().as_str() {
-                "ST" | "IL" => collect_text(lang),
-                "FBD" | "LD" => translate_network(lang),
-                _ => continue,
-            };
-            if !piece.trim().is_empty() {
-                out.push_str(&piece);
-                if !piece.ends_with('\n') {
-                    out.push('\n');
-                }
-            }
-        }
-    }
-    if out.trim().is_empty() {
-        None
-    } else {
-        Some(out)
-    }
-}
-
-// ── graphical (FBD / LD) → synthetic ST ────────────────────────────────
-
-/// Translate one FBD/LD network into ST statements: blocks → calls,
-/// out-variables and coils → assignments.
-fn translate_network(net: Node) -> String {
-    let by_id = index_local_ids(net);
-    let mut out = String::new();
-    for el in net.children().filter(|n| n.is_element()) {
-        let stmt = match el.tag_name().name().to_ascii_lowercase().as_str() {
-            "block" => block_call(el, &by_id).map(|c| format!("{c};")),
-            "outvariable" => out_assignment(el, &by_id),
-            "coil" => coil_assignment(el, &by_id),
-            _ => None,
-        };
-        if let Some(s) = stmt {
-            out.push_str(&s);
-            out.push('\n');
-        }
-    }
-    out
-}
-
-/// Index every element in a network by its `localId` so connections resolve.
-fn index_local_ids<'a, 'input>(net: Node<'a, 'input>) -> HashMap<String, Node<'a, 'input>> {
-    net.descendants()
-        .filter(|n| n.is_element())
-        .filter_map(|n| n.attribute("localId").map(|id| (id.to_string(), n)))
-        .collect()
-}
-
-/// Build a call expression for a block: `TypeName(pin := arg, …)`.
-fn block_call(block: Node, by_id: &HashMap<String, Node>) -> Option<String> {
-    let ty = block.attribute("typeName")?;
-    let mut args = Vec::new();
-    if let Some(inputs) = block.children().find(|n| tag_is(n, "inputVariables")) {
-        for v in inputs.children().filter(|n| tag_is(n, "variable")) {
-            let Some(expr) = input_expr(v, by_id, 0) else {
-                continue;
-            };
-            match v.attribute("formalParameter") {
-                Some(pin) if !pin.is_empty() => args.push(format!("{pin} := {expr}")),
-                _ => args.push(expr),
-            }
-        }
-    }
-    Some(format!("{ty}({})", args.join(", ")))
-}
-
-/// `target := <traced expression>;` for an FBD out-variable.
-fn out_assignment(outvar: Node, by_id: &HashMap<String, Node>) -> Option<String> {
-    let target = expression_text(outvar)?;
-    let value = input_expr(outvar, by_id, 0).unwrap_or_else(|| "0".to_string());
-    Some(format!("{target} := {value};"))
-}
-
-/// `coil := <traced rung expression>;` for an LD coil (negated → `NOT (…)`).
-fn coil_assignment(coil: Node, by_id: &HashMap<String, Node>) -> Option<String> {
-    let target = child_text(coil, "variable")?;
-    let rung = input_expr(coil, by_id, 0).unwrap_or_else(|| "TRUE".to_string());
-    let negated = matches!(coil.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
-    let rhs = if negated {
-        format!("NOT ({rung})")
-    } else {
-        rung
-    };
-    Some(format!("{target} := {rhs};"))
-}
-
-/// Resolve the expression feeding `node`'s single input connection.
-fn input_expr(node: Node, by_id: &HashMap<String, Node>, depth: u8) -> Option<String> {
-    let refid = ref_local_id(node)?;
-    Some(expr_for(&refid, by_id, depth))
-}
-
-/// Build the ST expression produced by the element with this `localId`.
-fn expr_for(local_id: &str, by_id: &HashMap<String, Node>, depth: u8) -> String {
-    if depth > 24 {
-        return "0".to_string();
-    }
-    let Some(node) = by_id.get(local_id) else {
-        return format!("__net{local_id}");
-    };
-    match node.tag_name().name().to_ascii_lowercase().as_str() {
-        "invariable" | "inoutvariable" => {
-            expression_text(*node).unwrap_or_else(|| format!("__net{local_id}"))
-        }
-        // A block feeding another element: reference it by a synthetic result
-        // name; the block is emitted as its own call statement, so we neither
-        // duplicate the call nor lose it.
-        "block" => format!("__blk{local_id}"),
-        "contact" => {
-            let var = child_text(*node, "variable").unwrap_or_else(|| "TRUE".to_string());
-            let negated =
-                matches!(node.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
-            let term = if negated { format!("NOT {var}") } else { var };
-            match ref_local_id(*node) {
-                Some(up) => {
-                    let upstream = expr_for(&up, by_id, depth + 1);
-                    if upstream == "TRUE" {
-                        term
-                    } else {
-                        format!("({upstream} AND {term})")
-                    }
-                }
-                None => term,
-            }
-        }
-        "leftpowerrail" => "TRUE".to_string(),
-        _ => format!("__net{local_id}"),
-    }
-}
-
-/// The `refLocalId` of `node`'s first input connection, if any.
-fn ref_local_id(node: Node) -> Option<String> {
+/// Concatenate all descendant text of a node (ST bodies are often wrapped in
+/// `<xhtml>` and may contain multiple text runs).
+fn collect_text(node: roxmltree::Node) -> String {
     node.descendants()
-        .find(|n| tag_is(n, "connectionPointIn"))
-        .and_then(|cpi| cpi.descendants().find(|n| tag_is(n, "connection")))
-        .and_then(|c| c.attribute("refLocalId"))
-        .map(|s| s.to_string())
-}
-
-/// Text of a node's `<expression>` child (variable name or literal).
-fn expression_text(node: Node) -> Option<String> {
-    let e = node.children().find(|n| tag_is(n, "expression"))?;
-    let t = collect_text(e).trim().to_string();
-    if t.is_empty() {
-        None
-    } else {
-        Some(t)
-    }
-}
-
-/// Text of a named child element (e.g. `<variable>` of a contact/coil).
-fn child_text(node: Node, name: &str) -> Option<String> {
-    let c = node.children().find(|n| tag_is(n, name))?;
-    let t = collect_text(c).trim().to_string();
-    if t.is_empty() {
-        None
-    } else {
-        Some(t)
-    }
-}
-
-/// Concatenate the text of a node's descendant text nodes (bodies are often
-/// wrapped in `<xhtml>` and may contain multiple text runs). Only text nodes are
-/// gathered: an element's `.text()` would re-yield its first child's text, which
-/// (with the text node itself) would duplicate every value.
-fn collect_text(node: Node) -> String {
-    node.descendants()
-        .filter(|n| n.is_text())
         .filter_map(|n| n.text())
         .collect::<String>()
 }
 
 /// Build an ST `VAR … END_VAR` block from a POU's `<interface>` variable
 /// sections, so declarations (types, initial values) reach the rules.
-fn build_var_block(pou: Node) -> String {
+fn build_var_block(pou: roxmltree::Node) -> String {
     let Some(interface) = pou.children().find(|n| n.has_tag_name("interface")) else {
         return String::new();
     };
@@ -282,7 +96,7 @@ fn build_var_block(pou: Node) -> String {
 }
 
 /// Render a PLCopen `<type>` element as an ST type string.
-fn type_name(type_node: Node) -> String {
+fn type_name(type_node: roxmltree::Node) -> String {
     let Some(inner) = type_node.children().find(|n| n.is_element()) else {
         return "BOOL".to_string();
     };
@@ -313,7 +127,7 @@ fn type_name(type_node: Node) -> String {
 }
 
 /// Extract an initial value as an ST literal (quoting strings).
-fn initial_value(iv: Node) -> Option<String> {
+fn initial_value(iv: roxmltree::Node) -> Option<String> {
     let simple = iv.descendants().find(|n| n.has_tag_name("simpleValue"))?;
     let raw = simple.attribute("value")?.trim().to_string();
     if raw.is_empty() {
@@ -333,86 +147,3 @@ fn initial_value(iv: Node) -> Option<String> {
         Some(format!("'{}'", raw.replace('\'', "''")))
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::parse_plcopen;
-    use crate::pipeline::plc::rules;
-    use std::collections::HashSet;
-
-    fn rule_ids(xml: &str) -> HashSet<&'static str> {
-        parse_plcopen(xml)
-            .iter()
-            .flat_map(rules::analyze)
-            .map(|h| h.rule_id)
-            .collect()
-    }
-
-    /// A Ladder Diagram network: a rung (power rail → contact → coil) plus an
-    /// insecure comm block. Coils/contacts translate to assignments; the block
-    /// translates to a call so the port rule fires.
-    #[test]
-    fn ld_coil_and_block_translate_and_are_analysed() {
-        let xml = r#"<?xml version="1.0"?>
-<project xmlns="http://www.plcopen.org/xml/tc6_0201">
- <types><pous>
-  <pou name="Rung" pouType="program">
-   <interface><localVars>
-     <variable name="Motor"><type><BOOL/></type></variable>
-   </localVars></interface>
-   <body><LD>
-     <leftPowerRail localId="0"/>
-     <contact localId="1"><variable>Start</variable>
-       <connectionPointIn><connection refLocalId="0"/></connectionPointIn></contact>
-     <coil localId="2"><variable>Motor</variable>
-       <connectionPointIn><connection refLocalId="1"/></connectionPointIn></coil>
-     <inVariable localId="3"><expression>21</expression></inVariable>
-     <inVariable localId="4"><expression>FALSE</expression></inVariable>
-     <block localId="10" typeName="Ftp_Send">
-       <inputVariables>
-         <variable formalParameter="PORT">
-           <connectionPointIn><connection refLocalId="3"/></connectionPointIn></variable>
-         <variable formalParameter="ENCRYPT">
-           <connectionPointIn><connection refLocalId="4"/></connectionPointIn></variable>
-       </inputVariables>
-     </block>
-   </LD></body>
-  </pou>
- </pous></types>
-</project>"#;
-        let ids = rule_ids(xml);
-        // Ftp_Send(PORT := 21, ENCRYPT := FALSE) — port 21 is an insecure protocol.
-        assert!(
-            ids.contains("plc-insecure-protocol-port"),
-            "LD block should flag port 21; got {ids:?}"
-        );
-    }
-
-    /// Doubled-text regression: a graphical expression must be extracted once,
-    /// so literals like `502` and `FALSE` stay intact (not `502502`/`FALSEFALSE`).
-    #[test]
-    fn graphical_expression_text_is_not_duplicated() {
-        let xml = r#"<?xml version="1.0"?>
-<project xmlns="http://www.plcopen.org/xml/tc6_0201">
- <types><pous>
-  <pou name="Comm" pouType="program">
-   <body><FBD>
-     <inVariable localId="1"><expression>502</expression></inVariable>
-     <inVariable localId="2"><expression>FALSE</expression></inVariable>
-     <block localId="10" typeName="Modbus_TCP_Master">
-       <inputVariables>
-         <variable formalParameter="PORT">
-           <connectionPointIn><connection refLocalId="1"/></connectionPointIn></variable>
-         <variable formalParameter="AUTH">
-           <connectionPointIn><connection refLocalId="2"/></connectionPointIn></variable>
-       </inputVariables>
-     </block>
-   </FBD></body>
-  </pou>
- </pous></types>
-</project>"#;
-        let ids = rule_ids(xml);
-        assert!(ids.contains("plc-insecure-protocol-port")); // PORT := 502 (not 502502)
-        assert!(ids.contains("plc-insecure-comm")); // AUTH := FALSE (not FALSEFALSE)
-    }
-}

compliance-agent/src/pipeline/plc/sbom.rs

@@ -1,253 +0,0 @@
-//! Control-application dependency SBOM from a CODESYS `.projectarchive`.
-//!
-//! A `.projectarchive` is a ZIP that bundles the project plus its referenced
-//! libraries and the target runtime. Each referenced library is an entry whose
-//! path segment follows the CODESYS convention
-//! `Name, Major.Minor.Patch.Build (Company)` (e.g. `Standard, 3.5.18.0 (System)`,
-//! `CSV Utility SL, 1.9.0.0 (CODESYS)`); the runtime appears as a device-descriptor
-//! entry `CODESYS Control … <version> …`. We enumerate those entries — no binary
-//! parsing — and emit SBOM components tagged `pkg:codesys/…`, so the CVE pipeline
-//! can match them (the runtime `Cmp*` / `3SLicense` components carry real CODESYS
-//! CVEs).
-
-use std::collections::BTreeSet;
-use std::path::{Path, PathBuf};
-
-use compliance_core::models::SbomEntry;
-
-/// Collect the control-application SBOM from every `.projectarchive` reachable for
-/// a target: the ingested artifact file itself (an uploaded archive), plus any
-/// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
-/// extracted source archive that ships the archive alongside its PLCopen XML / ST
-/// exports. Deduplicated by (name, version).
-pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let mut archives: Vec<PathBuf> = Vec::new();
-    if artifact_file.is_file() {
-        archives.push(artifact_file.to_path_buf());
-    }
-    for entry in walkdir::WalkDir::new(working_path)
-        .max_depth(8)
-        .into_iter()
-        .filter_map(|e| e.ok())
-    {
-        let p = entry.path();
-        if entry.file_type().is_file()
-            && p.extension()
-                .and_then(|x| x.to_str())
-                .is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
-        {
-            archives.push(p.to_path_buf());
-        }
-    }
-    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
-    let mut out = Vec::new();
-    for a in archives {
-        for e in projectarchive_sbom(&a, repo_id) {
-            if seen.insert((e.name.clone(), e.version.clone())) {
-                out.push(e);
-            }
-        }
-    }
-    out
-}
-
-/// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
-/// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
-/// `.st`/`.xml` project, which carries no library manifest).
-pub fn projectarchive_sbom(archive: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let Ok(file) = std::fs::File::open(archive) else {
-        return Vec::new();
-    };
-    let Ok(mut zip) = zip::ZipArchive::new(file) else {
-        return Vec::new();
-    };
-    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
-    let mut entries = Vec::new();
-    for i in 0..zip.len() {
-        let Ok(entry) = zip.by_index(i) else {
-            continue;
-        };
-        // Entry paths use `\` (Windows-authored) and/or `/` separators; the
-        // component id is one path segment.
-        for seg in entry.name().split(['/', '\\']) {
-            if let Some((name, version)) = parse_library(seg).or_else(|| parse_runtime(seg)) {
-                if seen.insert((name.clone(), version.clone())) {
-                    let mut e = SbomEntry::new(
-                        repo_id.to_string(),
-                        name.clone(),
-                        version.clone(),
-                        "codesys".to_string(),
-                    );
-                    e.purl = Some(format!(
-                        "pkg:codesys/{}@{version}",
-                        name.replace(' ', "%20")
-                    ));
-                    entries.push(e);
-                }
-            }
-        }
-    }
-    entries
-}
-
-/// `Name, X.Y.Z.W (Company)` → (name, version).
-fn parse_library(seg: &str) -> Option<(String, String)> {
-    let seg = seg.trim();
-    // Company is the trailing "(…)".
-    let open = seg.rfind(" (")?;
-    let rest = &seg[open + 2..];
-    let close = rest.find(')')?;
-    if rest[..close].trim().is_empty() {
-        return None;
-    }
-    let head = seg[..open].trim(); // "Name, X.Y.Z.W"
-    let comma = head.rfind(", ")?;
-    let name = head[..comma].trim().to_string();
-    let version = head[comma + 2..].trim().to_string();
-    if name.is_empty() || !is_dotted_version(&version) {
-        return None;
-    }
-    Some((name, version))
-}
-
-/// Device-descriptor entry `CODESYS Control … X.Y.Z.W …` → (runtime name, version).
-fn parse_runtime(seg: &str) -> Option<(String, String)> {
-    let seg = seg.trim();
-    if !seg.starts_with("CODESYS Control") {
-        return None;
-    }
-    let version = seg
-        .split_whitespace()
-        .find(|t| is_dotted_version(t))?
-        .to_string();
-    // The runtime name is the first field, before the run of padding spaces that
-    // precede the descriptor's numeric columns.
-    let name = seg.split("  ").next().unwrap_or(seg).trim().to_string();
-    if name.is_empty() {
-        return None;
-    }
-    Some((name, version))
-}
-
-/// A dotted numeric version with at least 3 components (`3.5.18.0`, `4.17.0.0`).
-fn is_dotted_version(s: &str) -> bool {
-    let parts: Vec<&str> = s.split('.').collect();
-    parts.len() >= 3
-        && parts
-            .iter()
-            .all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashMap;
-    use std::io::Write;
-
-    /// Build a synthetic `.projectarchive` (zip) mirroring the real CODESYS entry
-    /// naming (verified against Proemion/codesys-examples): a native `.project`,
-    /// referenced libraries as `Name, Version (Company)` segments, and a runtime
-    /// device descriptor.
-    fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
-        let path = dir.join("App.projectarchive");
-        write_synthetic_archive(&path);
-        path
-    }
-
-    fn write_synthetic_archive(path: &Path) {
-        let file = std::fs::File::create(path).expect("create");
-        let mut zip = zip::ZipWriter::new(file);
-        let opts: zip::write::SimpleFileOptions = Default::default();
-        let names = [
-            "App.project",
-            r"{b0b5}\App.Device.Plc.compileinfo",
-            r"{e179}\Standard, 3.5.18.0 (System)   standard.compiled-library-v3",
-            r"{e179}\Util, 3.5.21.0 (System)   util.compiled-library-v3",
-            r"{e179}\CSV Utility SL, 1.9.0.0 (CODESYS)   csv utility sl.compiled-library-v3",
-            r"{e179}\3SLicense, 3.5.20.0 (CODESYS)   3slicense.compiled-library-v3",
-            r"{0c63}\CODESYS Control for Linux ARM SL     0000 0006     4.17.0.0     4096     .zip",
-        ];
-        for n in names {
-            zip.start_file(n, opts).expect("start");
-            zip.write_all(b"x").expect("write");
-        }
-        zip.finish().expect("finish");
-    }
-
-    #[test]
-    fn extracts_libraries_and_runtime_from_projectarchive() {
-        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&tmp).expect("mkdir");
-        let archive = synthetic_archive(&tmp);
-
-        let entries = projectarchive_sbom(&archive, "plc-target");
-        let by_name: HashMap<&str, &SbomEntry> =
-            entries.iter().map(|e| (e.name.as_str(), e)).collect();
-
-        // Libraries with their versions.
-        assert_eq!(
-            by_name.get("Standard").map(|e| e.version.as_str()),
-            Some("3.5.18.0")
-        );
-        assert_eq!(
-            by_name.get("Util").map(|e| e.version.as_str()),
-            Some("3.5.21.0")
-        );
-        assert_eq!(
-            by_name.get("CSV Utility SL").map(|e| e.version.as_str()),
-            Some("1.9.0.0"),
-            "multi-word library names must parse"
-        );
-        assert!(by_name.contains_key("3SLicense"));
-
-        // The runtime, from the device descriptor.
-        assert_eq!(
-            by_name
-                .get("CODESYS Control for Linux ARM SL")
-                .map(|e| e.version.as_str()),
-            Some("4.17.0.0")
-        );
-
-        // Every component is CODESYS-tagged with a purl the CVE pipeline can match,
-        // and the native `.project` / compileinfo are not mistaken for components.
-        for e in &entries {
-            assert_eq!(e.package_manager, "codesys");
-            assert!(e.purl.as_deref().unwrap_or("").starts_with("pkg:codesys/"));
-        }
-        assert!(!by_name.contains_key("App"));
-
-        let _ = std::fs::remove_dir_all(&tmp);
-    }
-
-    #[test]
-    fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
-        let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
-        let src = tmp.join("clone/src");
-        std::fs::create_dir_all(&src).expect("mkdir");
-        // Simulate a git clone that commits the archive alongside its exports.
-        write_synthetic_archive(&src.join("PumpStation.projectarchive"));
-
-        // The artifact "file" is a git URL (not a real file), so the SBOM must
-        // come from walking the cloned tree.
-        let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
-        let names: std::collections::HashSet<&str> =
-            entries.iter().map(|e| e.name.as_str()).collect();
-        assert!(
-            names.contains("Standard"),
-            "found libs in the committed archive"
-        );
-        assert!(names.contains("CODESYS Control for Linux ARM SL"));
-
-        let _ = std::fs::remove_dir_all(&tmp);
-    }
-
-    #[test]
-    fn non_zip_file_yields_no_sbom() {
-        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&tmp).expect("mkdir");
-        let st = tmp.join("prog.st");
-        std::fs::write(&st, "PROGRAM P\nVAR x : INT; END_VAR\nEND_PROGRAM\n").expect("write");
-        assert!(projectarchive_sbom(&st, "t").is_empty());
-        let _ = std::fs::remove_dir_all(&tmp);
-    }
-}

compliance-core/src/models/onboarding.rs

@@ -202,9 +202,6 @@ pub enum PlcFormat {
     PlcopenXml,
     /// IEC 61131-3 Structured Text source.
     StructuredText,
-    /// A CODESYS project archive (`.projectarchive` — a zip bundling the project
-    /// plus its referenced libraries and runtime; the source of the control-app SBOM).
-    ProjectArchive,
 }
 
 /// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.

compliance-core/src/models/scan.rs

@@ -24,9 +24,6 @@ pub enum ScanType {
     MobileStatic,
     /// Static analysis of a container image.
     ContainerScan,
-    /// Dynamic probing of a running PLC/SPS device over industrial protocols
-    /// (Modbus/TCP, OPC UA, …) for exposed/unauthenticated control access.
-    IcsProbe,
 }
 
 impl std::fmt::Display for ScanType {
@@ -46,7 +43,6 @@ impl std::fmt::Display for ScanType {
             Self::PlcControlLogic => write!(f, "plc_control_logic"),
             Self::MobileStatic => write!(f, "mobile_static"),
             Self::ContainerScan => write!(f, "container_scan"),
-            Self::IcsProbe => write!(f, "ics_probe"),
         }
     }
 }
@@ -80,7 +76,6 @@ pub enum ScanPhase {
     LlmTriage,
     IssueCreation,
     DastScanning,
-    IcsProbe,
     Completed,
 }
 

compliance-core/src/scan_matrix.rs

@@ -207,58 +207,12 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
             ));
             r
         }
-        TargetType::PlcSps => {
-            // A PLC/SPS device is a composite: the control application *and* the
-            // device it runs on (firmware/OS + reachable runtime services). The
-            // control-logic scan runs on the PLC project; the firmware and DAST
-            // scans light up only when a firmware image / running endpoint is
-            // attached (e.g. a CODESYS runtime on a Yocto image with WebVisu).
-            // Firmware-image SBOM/CVE *execution* is shared with the firmware
-            // families and tracked in #151/#128; DAST over a WebVisu/OPC-UA
-            // endpoint uses the existing DAST path.
-            vec![
-                ScanRule::new(
-                    ScanType::PlcControlLogic,
-                    true,
-                    "Control-logic security rules over the PLC program",
-                    Plc,
-                ),
-                // Device-level scans are offered but opt-in (default-off): they
-                // apply only when a firmware image is attached, and firmware-image
-                // SBOM/CVE *execution* is shared with the firmware families and
-                // still landing (#151/#128), so they must not silently auto-run.
-                ScanRule::new(
-                    ScanType::FirmwareStatic,
-                    false,
-                    "Static analysis of the device firmware image (OS + runtime)",
-                    Firmware,
-                ),
-                ScanRule::new(
-                    ScanType::Sbom,
-                    false,
-                    "SBOM from the device firmware image (OS packages + CODESYS runtime)",
-                    Firmware,
-                ),
-                ScanRule::new(
-                    ScanType::Cve,
-                    false,
-                    "Match device firmware components against known CVEs",
-                    Firmware,
-                ),
-                ScanRule::new(
-                    ScanType::Dast,
-                    false,
-                    "Dynamic scan of the running device (WebVisu / exposed services)",
-                    RunningUrl,
-                ),
-                ScanRule::new(
-                    ScanType::IcsProbe,
-                    false,
-                    "Probe the running device over industrial protocols (Modbus/TCP, …)",
-                    RunningUrl,
-                ),
-            ]
-        }
+        TargetType::PlcSps => vec![ScanRule::new(
+            ScanType::PlcControlLogic,
+            true,
+            "Control-logic security rules over the PLC program",
+            Plc,
+        )],
     }
 }
 
@@ -275,9 +229,6 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
             | TargetType::AndroidApp
             | TargetType::IosApp
             | TargetType::EmbeddedLinuxYocto
-            // A PLC/SPS device exposes reachable runtime services (WebVisu, OPC UA,
-            // the CODESYS programming protocol), so an active pentest applies.
-            | TargetType::PlcSps
     )
 }
 
@@ -300,12 +251,7 @@ fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) ->
         ArtifactRequirement::Code => target.code_artifact().is_some(),
         ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
         ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
-        // A PLC project artifact, or a code artifact (git repo / source archive)
-        // holding the control logic as PLCopen XML / ST exports — the common way
-        // CODESYS projects are version-controlled.
-        ArtifactRequirement::Plc => {
-            target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
-        }
+        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
         ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
         ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
         ArtifactRequirement::Any => true,
@@ -394,81 +340,22 @@ mod tests {
     }
 
     #[test]
-    fn plc_control_logic_is_default_on_and_device_scans_block_without_artifacts() {
-        // A PLC project alone: control-logic runs; the device-level scans are
-        // offered but blocked until a firmware image / running endpoint is added.
+    fn plc_offers_only_control_logic() {
         let t = target_with(
             TargetType::PlcSps,
             vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
         );
         let opts = applicable_scans(&t);
-        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
-        assert!(plc.default_on && plc.blocked_reason.is_none());
-        for scan in [ScanType::FirmwareStatic, ScanType::Sbom, ScanType::Cve] {
-            let o = option(&opts, scan).expect("device scan offered");
-            assert!(
-                !o.default_on,
-                "{scan} must not pre-select without a firmware image"
-            );
-            assert!(o.blocked_reason.is_some());
-        }
-        let dast = option(&opts, ScanType::Dast).expect("dast offered");
-        assert!(!dast.default_on);
-        assert!(dast.blocked_reason.is_some());
-    }
-
-    #[test]
-    fn plc_control_logic_is_satisfied_by_a_git_repo() {
-        // A CODESYS project version-controlled in git (PLCopen XML / ST exports),
-        // no uploaded PlcProject artifact.
-        let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
-        let opts = applicable_scans(&t);
-        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
-        assert!(
-            plc.default_on && plc.blocked_reason.is_none(),
-            "a git repo should satisfy PLC control-logic"
-        );
-    }
-
-    #[test]
-    fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
-        // A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.
-        let t = target_with(
-            TargetType::PlcSps,
-            vec![
-                Artifact::plc_project("p.xml", PlcFormat::PlcopenXml),
-                Artifact::firmware_image("device.img"),
-                Artifact::live_url("http://plc.local/webvisu"),
-            ],
-        );
-        let opts = applicable_scans(&t);
-        for scan in [
-            ScanType::PlcControlLogic,
-            ScanType::FirmwareStatic,
-            ScanType::Sbom,
-            ScanType::Cve,
-        ] {
-            let o = option(&opts, scan).expect("scan offered");
-            assert!(o.blocked_reason.is_none(), "{scan} should be unblocked");
-        }
-        // Control-logic auto-runs; the device-level scans are unblocked but opt-in
-        // (default-off) until firmware-image execution lands (#151/#128).
-        assert!(option(&opts, ScanType::PlcControlLogic).unwrap().default_on);
-        assert!(!option(&opts, ScanType::Sbom).unwrap().default_on);
-        assert!(!option(&opts, ScanType::Dast).unwrap().default_on);
-        assert!(option(&opts, ScanType::Dast)
-            .unwrap()
-            .blocked_reason
-            .is_none());
+        assert_eq!(opts.len(), 1);
+        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
+        assert!(opts[0].default_on);
     }
 
     #[test]
     fn pentest_support_matches_reachable_families() {
         assert!(supports_pentest(TargetType::WebApp));
         assert!(supports_pentest(TargetType::BackendService));
-        assert!(supports_pentest(TargetType::EmbeddedLinuxYocto));
-        // A PLC/SPS device is network-reachable (WebVisu / OPC UA / 11740).
-        assert!(supports_pentest(TargetType::PlcSps));
+        assert!(!supports_pentest(TargetType::PlcSps));
         assert!(!supports_pentest(TargetType::FirmwareBareMetal));
         assert!(!supports_pentest(TargetType::DesktopApp));
     }

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -78,16 +78,8 @@ pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
                 .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
         }
         "live_url" => {
-            // http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
-            // devices probed by the ICS probe (e.g. modbus://plc:502).
-            let ok = (s.starts_with("https://")
-                || s.starts_with("http://")
-                || s.starts_with("modbus://")
-                || s.starts_with("opc.tcp://"))
-                && no_space;
-            (!ok).then(|| {
-                "Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
-            })
+            let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
+            (!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
         }
         "container_image" => {
             (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
@@ -138,37 +130,6 @@ pub async fn create_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
-/// Upload a file artifact (PLC project, firmware image, source archive, mobile
-/// package) to a target — proxied to the agent as multipart.
-#[server]
-pub async fn upload_target_artifact(
-    id: String,
-    kind: String,
-    plc_format: Option<String>,
-    filename: String,
-    bytes: Vec<u8>,
-) -> Result<TargetResponse, ServerFnError> {
-    let mut form = reqwest::multipart::Form::new().text("kind", kind).part(
-        "file",
-        reqwest::multipart::Part::bytes(bytes).file_name(filename),
-    );
-    if let Some(pf) = plc_format {
-        form = form.text("plc_format", pf);
-    }
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/artifacts/upload"),
-    )
-    .await?
-    .multipart(form)
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
 /// Update a target's name / type / artifacts (dashboard editor).
 #[server]
 pub async fn update_target(
@@ -204,28 +165,6 @@ pub async fn update_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
-/// Enable specific opt-in scans on a target by setting `scan_config.enabled_scans`.
-/// `scans` are serde scan-type names (lowercase, no underscores — e.g. `icsprobe`).
-#[server]
-pub async fn enable_target_scans(
-    id: String,
-    scans: Vec<String>,
-) -> Result<TargetResponse, ServerFnError> {
-    let body = serde_json::json!({ "scan_config": { "enabled_scans": scans } });
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::PATCH,
-        &format!("/api/v1/targets/{id}"),
-    )
-    .await?
-    .json(&body)
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
 /// Run kind-based classification on a target.
 #[server]
 pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {

compliance-dashboard/src/infrastructure/server.rs

@@ -1,4 +1,3 @@
-use axum::extract::DefaultBodyLimit;
 use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
@@ -67,9 +66,6 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 // Webhook proxy: forward to agent (no auth required)
                 .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                 .serve_dioxus_application(ServeConfig::new(), app)
-                // Allow large artifact uploads through the upload server function
-                // (PLC .projectarchive, firmware, mobile) — default is 2 MiB.
-                .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
                 .layer(Extension(PendingOAuthStore::default()))
                 .layer(middleware::from_fn(require_auth))
                 .layer(Extension(server_state))

compliance-dashboard/src/pages/onboarding.rs

@@ -2,8 +2,8 @@ use dioxus::prelude::*;
 
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::onboarding::{
-    create_target, detect_target, enable_target_scans, fetch_applicable_scans, trigger_target_scan,
-    upload_target_artifact, validate_artifact_ref, validate_target_name, ArtifactInputDto,
+    create_target, detect_target, fetch_applicable_scans, trigger_target_scan,
+    validate_artifact_ref, validate_target_name, ArtifactInputDto,
 };
 
 /// (value, label, one-line description) for the 9 target families.
@@ -41,23 +41,6 @@ const ARTIFACT_KINDS: &[(&str, &str)] = &[
 
 const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
 
-/// Artifact kinds provided as an uploaded file (rather than a URL/text ref).
-fn is_file_kind(kind: &str) -> bool {
-    matches!(
-        kind,
-        "plc_project" | "firmware_image" | "source_archive" | "mobile_package"
-    )
-}
-
-/// A file artifact staged in the wizard, uploaded after the target is created.
-#[derive(Clone, PartialEq)]
-struct PendingFile {
-    kind: String,
-    plc_format: Option<String>,
-    filename: String,
-    bytes: Vec<u8>,
-}
-
 /// One row in the applicable-scans list on the success step.
 #[component]
 fn ScanRow(scan: serde_json::Value) -> Element {
@@ -125,10 +108,6 @@ pub fn OnboardingPage() -> Element {
     let mut new_kind = use_signal(|| "git_repo".to_string());
     let mut new_source = use_signal(String::new);
     let mut new_branch = use_signal(|| "main".to_string());
-    // File-upload artifacts (PLC project, firmware image, ...).
-    let mut new_plc_format = use_signal(|| "plcopen_xml".to_string());
-    let mut new_file = use_signal(|| Option::<(String, Vec<u8>)>::None);
-    let mut pending_files = use_signal(Vec::<PendingFile>::new);
 
     // Create + result state.
     let mut creating = use_signal(|| false);
@@ -137,35 +116,11 @@ pub fn OnboardingPage() -> Element {
     let mut suggested = use_signal(|| Option::<String>::None);
     let mut created_id = use_signal(|| Option::<String>::None);
     let mut scan_msg = use_signal(|| Option::<String>::None);
-    // Opt-in scans (default-off but unblocked) the user ticks to enable before
-    // running — stored as serde scan-type names (lowercase, no underscores).
-    let mut enabled_extra = use_signal(Vec::<String>::new);
 
     let step_now = step();
     let name_error = validate_target_name(&name());
     let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
-    let has_artifacts = !artifacts().is_empty() || !pending_files().is_empty();
-    // Opt-in scans: applicable + unblocked, but default-off (e.g. the ICS probe).
-    // The user ticks these to enable them before the first run. Each entry is
-    // (display name for the label, serde scan-type name for the enable call —
-    // lowercase, no underscores, matching ScanType's rename_all = "lowercase").
-    let optin_scans: Vec<(String, String)> = scans()
-        .iter()
-        .filter_map(|s| {
-            let unblocked = s.get("blocked_reason").and_then(|v| v.as_str()).is_none();
-            let default_on = s
-                .get("default_on")
-                .and_then(|v| v.as_bool())
-                .unwrap_or(false);
-            if unblocked && !default_on {
-                let display = s.get("scan").and_then(|v| v.as_str())?.to_string();
-                let serde_name = display.replace('_', "");
-                Some((display, serde_name))
-            } else {
-                None
-            }
-        })
-        .collect();
+    let has_artifacts = !artifacts().is_empty();
     // Live validation of the artifact reference being typed (empty = no error yet).
     let new_source_error = if new_source().is_empty() {
         None
@@ -238,36 +193,6 @@ pub fn OnboardingPage() -> Element {
             // ---- Step 1: artifacts ----
             if step_now == 1 {
                 div { class: "card-header", "Attach artifacts" }
-                if target_type() == "plc_sps" {
-                    div {
-                        style: "margin: 12px 16px 0; padding: 12px 14px; border-left: 3px solid var(--accent, #3b82f6); background: var(--surface-2, rgba(59,130,246,0.08)); font-size: 0.88em; line-height: 1.55;",
-                        div { style: "font-weight: 600; margin-bottom: 4px;", "CODESYS / PLC projects" }
-                        "Attach a "
-                        b { "PLC project" }
-                        " (PLCopen XML / ST, or a .projectarchive), or a "
-                        b { "Git repository" }
-                        " of exported source — every scan is then just a pull."
-                        ul { style: "margin: 6px 0 0; padding-left: 18px;",
-                            li {
-                                b { "Control-logic SAST" }
-                                " — commit "
-                                b { "PLCopen XML exports" }
-                                " (Project → Export PLCopenXML) or raw .st; ST and graphical FBD/LD are both analyzed."
-                            }
-                            li {
-                                b { "Library + runtime SBOM" }
-                                " — include the "
-                                b { ".projectarchive" }
-                                "; PLCopen XML alone carries no libraries."
-                            }
-                            li {
-                                "Avoid committing only the binary "
-                                code { ".project" }
-                                " — it can't be parsed and doesn't diff."
-                            }
-                        }
-                    }
-                }
                 div { style: "padding: 16px;",
                     div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
                         div { class: "form-group", style: "margin: 0;",
@@ -280,143 +205,49 @@ pub fn OnboardingPage() -> Element {
                                 }
                             }
                         }
-                        if is_file_kind(&new_kind()) {
-                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                                label { "File" }
-                                input {
-                                    r#type: "file",
-                                    onchange: move |evt| {
-                                        let Some(file) = evt.files().into_iter().next() else { return; };
-                                        let name = file.name();
-                                        // Auto-detect the PLC format from the file extension.
-                                        let lname = name.to_ascii_lowercase();
-                                        if lname.ends_with(".projectarchive") || lname.ends_with(".project") {
-                                            new_plc_format.set("project_archive".to_string());
-                                        } else if lname.ends_with(".xml") || lname.ends_with(".plcopen") {
-                                            new_plc_format.set("plcopen_xml".to_string());
-                                        } else if lname.ends_with(".st") || lname.ends_with(".exp") || lname.ends_with(".scl") {
-                                            new_plc_format.set("structured_text".to_string());
-                                        }
-                                        spawn(async move {
-                                            if let Ok(bytes) = file.read_bytes().await {
-                                                new_file.set(Some((name, bytes.to_vec())));
-                                            }
-                                        });
-                                    },
-                                }
+                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                            label { "Reference (URL / path / text)" }
+                            input {
+                                r#type: "text",
+                                placeholder: "https://git.example.com/acme.git",
+                                value: "{new_source}",
+                                oninput: move |e| new_source.set(e.value()),
                             }
-                            if new_kind() == "plc_project" {
-                                div { class: "form-group", style: "margin: 0;",
-                                    label { "Format" }
-                                    select {
-                                        value: "{new_plc_format}",
-                                        oninput: move |e| new_plc_format.set(e.value()),
-                                        option {
-                                            value: "plcopen_xml",
-                                            selected: new_plc_format() == "plcopen_xml",
-                                            "PLCopen XML",
-                                        }
-                                        option {
-                                            value: "structured_text",
-                                            selected: new_plc_format() == "structured_text",
-                                            "Structured Text",
-                                        }
-                                        option {
-                                            value: "project_archive",
-                                            selected: new_plc_format() == "project_archive",
-                                            "Project archive (.projectarchive)",
-                                        }
-                                    }
-                                }
-                            }
-                            button {
-                                class: "btn btn-secondary",
-                                disabled: new_file().is_none(),
-                                onclick: move |_| {
-                                    if let Some((fname, data)) = new_file() {
-                                        let kind = new_kind();
-                                        let plc_format = if kind == "plc_project" {
-                                            Some(new_plc_format())
-                                        } else {
-                                            None
-                                        };
-                                        pending_files.write().push(PendingFile {
-                                            kind,
-                                            plc_format,
-                                            filename: fname,
-                                            bytes: data,
-                                        });
-                                        new_file.set(None);
-                                    }
-                                },
-                                "+ Add file"
-                            }
-                        } else {
-                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                                label { "Reference (URL / path / text)" }
+                        }
+                        if new_kind() == "git_repo" {
+                            div { class: "form-group", style: "margin: 0;",
+                                label { "Branch" }
                                 input {
                                     r#type: "text",
-                                    placeholder: "https://git.example.com/acme.git",
-                                    value: "{new_source}",
-                                    oninput: move |e| new_source.set(e.value()),
+                                    value: "{new_branch}",
+                                    oninput: move |e| new_branch.set(e.value()),
                                 }
                             }
-                            if new_kind() == "git_repo" {
-                                div { class: "form-group", style: "margin: 0;",
-                                    label { "Branch" }
-                                    input {
-                                        r#type: "text",
-                                        value: "{new_branch}",
-                                        oninput: move |e| new_branch.set(e.value()),
-                                    }
+                        }
+                        button {
+                            class: "btn btn-secondary",
+                            disabled: new_source().trim().is_empty() || new_source_error.is_some(),
+                            onclick: move |_| {
+                                let kind = new_kind();
+                                if !new_source().trim().is_empty()
+                                    && validate_artifact_ref(&kind, &new_source()).is_none()
+                                {
+                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
+                                    artifacts.write().push(ArtifactInputDto {
+                                        kind,
+                                        source_ref: new_source(),
+                                        branch,
+                                        plc_format: None,
+                                    });
+                                    new_source.set(String::new());
                                 }
-                            }
-                            button {
-                                class: "btn btn-secondary",
-                                disabled: new_source().trim().is_empty() || new_source_error.is_some(),
-                                onclick: move |_| {
-                                    let kind = new_kind();
-                                    if !new_source().trim().is_empty()
-                                        && validate_artifact_ref(&kind, &new_source()).is_none()
-                                    {
-                                        let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
-                                        artifacts.write().push(ArtifactInputDto {
-                                            kind,
-                                            source_ref: new_source(),
-                                            branch,
-                                            plc_format: None,
-                                        });
-                                        new_source.set(String::new());
-                                    }
-                                },
-                                "+ Add"
-                            }
+                            },
+                            "+ Add"
                         }
                     }
-                    if is_file_kind(&new_kind()) {
-                        if let Some((fname, data)) = new_file() {
-                            div { style: "font-size: 0.85em; opacity: 0.7; margin-top: 6px;",
-                                "Selected: {fname} ({data.len()} bytes)"
-                            }
-                        }
-                    } else if let Some(err) = new_source_error.clone() {
+                    if let Some(err) = new_source_error.clone() {
                         div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
                     }
-                    // Staged file artifacts (uploaded after the target is created).
-                    for (i, pf) in pending_files().iter().enumerate() {
-                        div {
-                            style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-top: 6px;",
-                            span {
-                                span { style: "opacity: 0.7;", "{kind_label(&pf.kind)} (file): " }
-                                "{pf.filename} ({pf.bytes.len()} bytes)"
-                            }
-                            button {
-                                class: "btn btn-ghost-danger btn-sm",
-                                onclick: move |_| { pending_files.write().remove(i); },
-                                "Remove"
-                            }
-                        }
-                    }
 
                     div { style: "margin-top: 16px;",
                         if has_artifacts {
@@ -480,39 +311,6 @@ pub fn OnboardingPage() -> Element {
                             ScanRow { scan: s }
                         }
                     }
-                    if !optin_scans.is_empty() {
-                        div { style: "margin-top: 12px; padding: 10px; border: 1px dashed var(--border, #ccc); border-radius: 6px;",
-                            div { style: "font-weight: 600; margin-bottom: 6px;", "Enable opt-in scans" }
-                            div { style: "opacity: 0.7; font-size: 0.85em; margin-bottom: 8px;",
-                                "These are applicable but off by default (they touch a live device). Tick to enable before running."
-                            }
-                            for pair in optin_scans.clone() {
-                                {
-                                    let (display, serde_name) = pair;
-                                    let cb_name = serde_name.clone();
-                                    rsx! {
-                                        label {
-                                            style: "display: flex; gap: 6px; align-items: center; margin-top: 4px;",
-                                            input {
-                                                r#type: "checkbox",
-                                                checked: enabled_extra().contains(&serde_name),
-                                                onchange: move |_| {
-                                                    let mut v = enabled_extra();
-                                                    if let Some(p) = v.iter().position(|x| x == &cb_name) {
-                                                        v.remove(p);
-                                                    } else {
-                                                        v.push(cb_name.clone());
-                                                    }
-                                                    enabled_extra.set(v);
-                                                },
-                                            }
-                                            "Enable {display}"
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
                     if let Some(msg) = scan_msg() {
                         div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
                     }
@@ -521,21 +319,8 @@ pub fn OnboardingPage() -> Element {
                             class: "btn btn-primary",
                             onclick: move |_| {
                                 if let Some(id) = created_id() {
-                                    let extra = enabled_extra();
                                     scan_msg.set(Some("Scan triggered...".to_string()));
                                     spawn(async move {
-                                        // Persist any ticked opt-in scans first, so the
-                                        // agent's build_scan_plan includes them this run.
-                                        if !extra.is_empty() {
-                                            if let Err(e) =
-                                                enable_target_scans(id.clone(), extra).await
-                                            {
-                                                scan_msg.set(Some(format!(
-                                                    "Failed to enable opt-in scans: {e}"
-                                                )));
-                                                return;
-                                            }
-                                        }
                                         match trigger_target_scan(id).await {
                                             Ok(_) => scan_msg.set(Some(
                                                 "Scan started — findings will appear as it runs.".to_string(),
@@ -555,8 +340,6 @@ pub fn OnboardingPage() -> Element {
                                 target_type.set(String::new());
                                 description.set(String::new());
                                 artifacts.write().clear();
-                                pending_files.write().clear();
-                                new_file.set(None);
                                 scans.write().clear();
                                 suggested.set(None);
                                 created_id.set(None);
@@ -595,7 +378,6 @@ pub fn OnboardingPage() -> Element {
                             let tt = target_type();
                             let desc = description();
                             let arts = artifacts();
-                            let files = pending_files();
                             let d = if desc.trim().is_empty() { None } else { Some(desc) };
                             creating.set(true);
                             error.set(None);
@@ -610,23 +392,6 @@ pub fn OnboardingPage() -> Element {
                                             .map(String::from);
                                         if let Some(id) = id {
                                             created_id.set(Some(id.clone()));
-                                            // Upload staged file artifacts now that the target exists.
-                                            for pf in files {
-                                                let fname = pf.filename.clone();
-                                                if let Err(e) = upload_target_artifact(
-                                                    id.clone(),
-                                                    pf.kind,
-                                                    pf.plc_format,
-                                                    pf.filename,
-                                                    pf.bytes,
-                                                )
-                                                .await
-                                                {
-                                                    error.set(Some(format!(
-                                                        "Upload failed for {fname}: {e}"
-                                                    )));
-                                                }
-                                            }
                                             if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
                                                 scans.set(sc.data.scans);
                                             }

compliance-dashboard/src/pages/targets.rs

@@ -232,7 +232,7 @@ pub fn TargetsPage() -> Element {
                                 value: "{edit_type}",
                                 oninput: move |e| edit_type.set(e.value()),
                                 for (v, l) in TARGET_TYPES.iter().copied() {
-                                    option { value: "{v}", selected: edit_type() == v, "{l}" }
+                                    option { value: "{v}", "{l}" }
                                 }
                             }
                         }
@@ -257,7 +257,7 @@ pub fn TargetsPage() -> Element {
                                     value: "{e_kind}",
                                     oninput: move |e| e_kind.set(e.value()),
                                     for (v, l) in ARTIFACT_KINDS.iter().copied() {
-                                        option { value: "{v}", selected: e_kind() == v, "{l}" }
+                                        option { value: "{v}", "{l}" }
                                     }
                                 }
                             }

docs/.vitepress/config.mts

@@ -20,7 +20,6 @@ export default withMermaid(defineConfig({
           { text: 'Getting Started', link: '/guide/getting-started' },
           { text: 'Adding Repositories', link: '/guide/repositories' },
           { text: 'Running Scans', link: '/guide/scanning' },
-          { text: 'PLC / SPS (CODESYS)', link: '/guide/plc' },
           { text: 'Understanding Findings', link: '/guide/findings' },
           { text: 'SBOM & Licenses', link: '/guide/sbom' },
           { text: 'Issues & Tracking', link: '/guide/issues' },

docs/guide/plc.md

@@ -1,97 +0,0 @@
-# PLC / SPS Projects (CODESYS)
-
-Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such
-as CODESYS projects. A single PLC/SPS target is treated as a **composite device**:
-the control application *and* the device it runs on.
-
-| What you provide | What Certifai does |
-| --- | --- |
-| PLC project (PLCopen XML / ST, or a `.projectarchive`) | **Control-logic SAST** — semantic security rules over ST **and** graphical FBD/LD |
-| A `.projectarchive` | **Control-app SBOM** — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
-| A device firmware image | Firmware SBOM / CVE (opt-in) |
-| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
-
-## Two ways to deliver the project
-
-You can either **upload** the project when onboarding, or point Certifai at a
-**git repository** (recommended — every scan is just a `git pull`, no re-upload).
-
-### Option A — Upload
-
-On the onboarding wizard, choose target type **PLC / SPS**, then attach a **PLC
-project** artifact and pick its format:
-
-- **PLCopen XML** (`.xml`) — export from CODESYS via *Project → Export PLCopenXML*.
-- **Structured Text** (`.st`) — a raw ST file.
-- **Project archive** (`.projectarchive`) — *File → Project Archive → Save/Send
-  Archive…* with **"Referenced libraries"** ticked. This is the only form that
-  also yields the **library + runtime SBOM**.
-
-### Option B — Git repository (recommended)
-
-Attach a **Git repository** artifact to the PLC/SPS target. Certifai clones it and
-runs the control-logic scan over the exported source in the repo.
-
-## Best-case git repository layout
-
-Because the binary `.project` does not diff or merge in git, commit **textual
-exports** for review-friendly SAST, and include the **`.projectarchive`** so the
-library/runtime SBOM is available too:
-
-```text
-my-plc-project/
-├── src/
-│   ├── PLC_PRG.xml          # PLCopen XML export (ST or FBD/LD) — one per POU
-│   ├── PumpController.xml
-│   ├── SafetyInterlock.xml
-│   └── GVL.xml              # global variable lists, also as PLCopen XML
-├── PumpStation.projectarchive   # optional but recommended → library + runtime SBOM
-└── README.md
-```
-
-**Guidelines**
-
-- **Export to PLCopen XML** (`Project → Export PLCopenXML`), one file per POU, and
-  commit those. ST, **and graphical FBD/LD**, are both analyzed.
-- Alternatively commit raw `.st` / `.exp` / `.scl` files — also analyzed.
-- **Do not** commit only the binary `.project` — it cannot be parsed (and does not
-  diff). If you want the library SBOM, commit the **`.projectarchive`** as well.
-- CODESYS's built-in Git integration, which stores an exported representation,
-  works too — as long as the committed form is PLCopen XML / textual.
-
-::: tip What unlocks what
-- **Control-logic SAST** needs textual source in the repo (PLCopen XML or `.st`).
-- **Library + runtime SBOM** needs a **`.projectarchive`** — PLCopen XML exports do
-  **not** carry the referenced libraries.
-:::
-
-## What the scanner finds
-
-The control-logic rules are CWE-mapped and include: hardcoded credentials
-(CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass
-(CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369,
-guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports
-(CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
-
-The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
-the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
-surface real CODESYS advisories as CVE alerts.
-
-## Dynamic testing — ICS protocol probe
-
-Beyond the static analysis, Certifai can **probe the running device** over
-industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
-URL) to the PLC/SPS target and enable the **ICS Probe** scan.
-
-The probe is **read-only** — it never writes to the live process. It currently
-speaks **Modbus/TCP** (port 502): it confirms whether the device answers
-unauthenticated Modbus requests and reads its device identity (vendor / product /
-revision). Because Modbus/TCP has no authentication or encryption in the protocol,
-a reachable endpoint that answers is reported as an exposed control interface
-(CWE-306). OPC UA and EtherNet/IP probes are planned.
-
-::: warning
-The ICS probe connects to the live device. It is **opt-in** (off by default) and
-should only be run against targets you are authorized to test. It performs reads
-only, never writes.
-:::

examples/plc-demo/pump_fbd.xml

@@ -1,56 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Function Block Diagram (FBD) POU in PLCopen TC6 XML form. Demonstrates that
-     the scanner analyses graphical logic, not just Structured Text: the same
-     defects (cleartext Modbus master on 502, a hardcoded HMI password, a safety
-     enable driven FALSE) are here wired as blocks and in/out variables. -->
-<project xmlns="http://www.plcopen.org/xml/tc6_0201">
-  <types>
-    <pous>
-      <pou name="PumpFbdCtrl" pouType="functionBlock">
-        <interface>
-          <inputVars>
-            <variable name="HmiPassword"><type><string/></type></variable>
-            <variable name="Safety_Enable"><type><BOOL/></type></variable>
-            <variable name="ServerIp"><type><string/></type></variable>
-          </inputVars>
-        </interface>
-        <body>
-          <FBD>
-            <!-- Modbus/TCP master: cleartext (AUTH := FALSE) on port 502 -->
-            <inVariable localId="1"><expression>'10.20.0.5'</expression><connectionPointOut/></inVariable>
-            <inVariable localId="2"><expression>502</expression><connectionPointOut/></inVariable>
-            <inVariable localId="3"><expression>FALSE</expression><connectionPointOut/></inVariable>
-            <block localId="10" typeName="Modbus_TCP_Master">
-              <inputVariables>
-                <variable formalParameter="IP">
-                  <connectionPointIn><connection refLocalId="1"/></connectionPointIn>
-                </variable>
-                <variable formalParameter="PORT">
-                  <connectionPointIn><connection refLocalId="2"/></connectionPointIn>
-                </variable>
-                <variable formalParameter="AUTH">
-                  <connectionPointIn><connection refLocalId="3"/></connectionPointIn>
-                </variable>
-              </inputVariables>
-              <outputVariables/>
-            </block>
-
-            <!-- Hardcoded HMI password wired into an output -->
-            <inVariable localId="20"><expression>'admin123'</expression><connectionPointOut/></inVariable>
-            <outVariable localId="21">
-              <expression>HmiPassword</expression>
-              <connectionPointIn><connection refLocalId="20"/></connectionPointIn>
-            </outVariable>
-
-            <!-- Safety enable driven FALSE in logic -->
-            <inVariable localId="30"><expression>FALSE</expression><connectionPointOut/></inVariable>
-            <outVariable localId="31">
-              <expression>Safety_Enable</expression>
-              <connectionPointIn><connection refLocalId="30"/></connectionPointIn>
-            </outVariable>
-          </FBD>
-        </body>
-      </pou>
-    </pous>
-  </types>
-</project>