fix(dashboard): Findings/SBOM filter by onboarded targets; accurate target findings_count

The Findings and SBOM pages populated their target dropdown from the legacy
`repositories` collection, so onboarded targets never appeared and their
findings/SBOM couldn't be filtered by name (the data was there, keyed by the
target id). Point both dropdowns at `onboarded_targets` via `fetch_targets`.

Also refresh `OnboardedTarget.findings_count` at the end of `run_target`: the
shared pipeline (Stage 7) increments the legacy `repositories` doc, which the
unified path has none of, so the Targets page always showed 0. Set the accurate
total (count of findings keyed by the target id) on the target itself.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -9,15 +9,33 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
-  # sccache caches compilation artifacts within a job so that compiling
-  # both --features server and --features web shares common crate work.
+  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
+  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
+  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
+  # and HETZNER_S3_SECRET_KEY.
   RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_DIR: /tmp/sccache
+  SCCACHE_BUCKET: breakpilot-sccache
+  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
+  SCCACHE_REGION: auto
+  SCCACHE_S3_USE_SSL: "true"
+  SCCACHE_S3_KEY_PREFIX: compliance-scanner
+  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
+  # compliance-agent depends on tramiton-core via git; use the system git so the
+  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
+  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
+  CARGO_NET_RETRY: "10"
+  CARGO_HTTP_MULTIPLEXING: "false"
 
-# Cancel in-progress runs for the same branch/PR
+# Cancel superseded PR runs, but NEVER cancel main-branch runs — those build and
+# deploy per-service images, and cancelling one merge's deploy when the next
+# merge lands leaves a service un-deployed (as happened between two back-to-back
+# merges). So cancel-in-progress only for pull_request events.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -36,16 +54,44 @@ jobs:
           git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}"
           git checkout FETCH_HEAD
+      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
+      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
+      # replacement only applies to crates.io-sourced crates.
+      - name: Use Kellnr crates.io mirror
+        run: |
+          : "${CARGO_HOME:=/usr/local/cargo}"
+          mkdir -p "$CARGO_HOME"
+          {
+            echo '[source.crates-io]'
+            echo 'replace-with = "kellnr"'
+            echo '[registries.kellnr]'
+            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
+          } >> "$CARGO_HOME/config.toml"
+        env:
+          RUSTC_WRAPPER: ""
       - name: Install tools
         run: |
           rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
           chmod +x /usr/local/bin/sccache
           cargo install cargo-audit --locked
         env:
           RUSTC_WRAPPER: ""
 
+      # compliance-agent has a git dependency on tramiton-core (a private repo on
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
+      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
+      # with read:repository, owned by a user with access to sharang/tramiton).
+      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
+      - name: Configure git auth for private tramiton dependency
+        run: |
+          git config --global \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            "ssh://git@gitea.meghsakha.com:22222/"
+        env:
+          RUSTC_WRAPPER: ""
+
       # Format (no compilation needed)
       - name: Format
         run: cargo fmt --all --check
@@ -148,13 +194,18 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
+        env:
+          # PAT for fetching the private tramiton-core git dependency during the
+          # image build (injected as a BuildKit secret, never baked into a layer).
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-agent
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -169,13 +220,16 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
+        env:
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-dashboard
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -211,13 +265,16 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
+        env:
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-mcp
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')

Cargo.lock

@@ -692,6 +692,7 @@ dependencies = [
  "tower-http",
  "tracing",
  "tracing-subscriber",
+ "tramiton-core",
  "urlencoding",
  "uuid",
  "walkdir",
@@ -4197,7 +4198,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit",
+ "toml_edit 0.23.10+spec-1.0.0",
 ]
 
 [[package]]
@@ -4996,6 +4997,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5810,6 +5820,27 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5819,6 +5850,20 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap 2.13.0",
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5826,7 +5871,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
  "indexmap 2.13.0",
- "toml_datetime",
+ "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "winnow",
 ]
@@ -5840,6 +5885,12 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6086,6 +6137,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "tramiton-core"
+version = "0.4.0"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
+dependencies = [
+ "serde",
+ "tempfile",
+ "thiserror 1.0.69",
+ "toml",
+ "walkdir",
+]
+
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"

Dockerfile.agent

@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-agent
+# compliance-agent depends on the private tramiton-core git repo. Authenticate
+# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
+# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*

Dockerfile.dashboard

@@ -7,7 +7,16 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-RUN dx build --release --package compliance-dashboard
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the dashboard.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

Dockerfile.mcp

@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-mcp
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the mcp binary.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

compliance-agent/Cargo.toml

@@ -10,6 +10,11 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
+# Native firmware build/target detection for bare-metal & RTOS artifacts.
+# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
+# available to the onboarding classifier. NOTE: CI must be able to fetch this
+# private repo (see the git-auth step in .gitea/workflows/ci.yml).
+tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }

compliance-agent/src/agent.rs

@@ -63,7 +63,31 @@ impl ComplianceAgent {
         let db = self.db_pool.for_tenant_id(tenant_id).await?;
         let orchestrator =
             PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run(repo_id, trigger).await
+        if self.config.unified_pipeline {
+            orchestrator.run_target(repo_id, trigger).await
+        } else {
+            orchestrator.run(repo_id, trigger).await
+        }
+    }
+
+    /// Run a scan for an onboarded target through the unified pipeline,
+    /// unconditionally.
+    ///
+    /// Unlike [`Self::run_scan`], this does *not* consult the
+    /// `unified_pipeline` transition flag: the caller (the `/targets/{id}/scan`
+    /// endpoint) operates on `onboarded_targets` by construction, so it must
+    /// always dispatch to `run_target` regardless of how the legacy paths
+    /// (scheduler, webhooks, `/repositories/{id}/scan`) are configured.
+    pub async fn run_target_scan(
+        &self,
+        tenant_id: &str,
+        target_id: &str,
+        trigger: compliance_core::models::ScanTrigger,
+    ) -> Result<(), crate::error::AgentError> {
+        let db = self.db_pool.for_tenant_id(tenant_id).await?;
+        let orchestrator =
+            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+        orchestrator.run_target(target_id, trigger).await
     }
 
     /// Run a PR review: scan the diff and post review comments.

compliance-agent/src/api/handlers/mod.rs

@@ -9,6 +9,7 @@ pub mod help_chat;
 pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod repos;

compliance-agent/src/api/handlers/onboarding.rs

@@ -0,0 +1,393 @@
+//! Onboarding API — CRUD for unified targets, artifact add, classification, and
+//! the scan-applicability matrix. The wizard (and future integrations) drive
+//! onboarding through these endpoints.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use axum::extract::{Extension, Path, Query};
+use axum::http::StatusCode;
+use axum::Json;
+use mongodb::bson::{doc, oid::ObjectId, to_bson};
+use serde::{Deserialize, Serialize};
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
+    TargetType,
+};
+use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
+use compliance_core::tenant_ctx::TenantCtx;
+
+use crate::agent::ComplianceAgent;
+use crate::classify::{classify_target, MockFirmwareDetector};
+
+use super::dto::tenant_db;
+use super::{collect_cursor_async, ApiResponse, PaginationParams};
+
+type AgentExt = Extension<Arc<ComplianceAgent>>;
+
+/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
+/// id) from it, so clients never set internal fields.
+#[derive(Deserialize)]
+pub struct ArtifactInput {
+    pub kind: ArtifactKind,
+    pub source_ref: String,
+    #[serde(default)]
+    pub branch: Option<String>,
+    #[serde(default)]
+    pub plc_format: Option<PlcFormat>,
+}
+
+impl ArtifactInput {
+    fn build(&self) -> Artifact {
+        let s = self.source_ref.clone();
+        match self.kind {
+            ArtifactKind::GitRepo => {
+                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
+            }
+            ArtifactKind::LiveUrl => Artifact::live_url(s),
+            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
+            ArtifactKind::SourceArchive => Artifact::source_archive(s),
+            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
+            ArtifactKind::ContainerImage => Artifact::container_image(s),
+            ArtifactKind::PlcProject => {
+                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
+            }
+            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub struct CreateTargetRequest {
+    pub name: String,
+    pub target_type: TargetType,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub artifacts: Vec<ArtifactInput>,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateTargetRequest {
+    pub name: Option<String>,
+    pub target_type: Option<TargetType>,
+    pub scan_config: Option<TargetScanConfig>,
+    pub compliance_profile: Option<ComplianceProfile>,
+    pub scan_schedule: Option<String>,
+}
+
+/// One applicable-scan option, serialized for the wizard.
+#[derive(Serialize)]
+pub struct ScanOptionDto {
+    pub scan: String,
+    pub default_on: bool,
+    pub rationale: String,
+    pub required_artifact: Option<String>,
+    pub blocked_reason: Option<String>,
+}
+
+#[derive(Serialize)]
+pub struct ApplicableScansResponse {
+    pub scans: Vec<ScanOptionDto>,
+    pub pentest_supported: bool,
+}
+
+fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
+    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+/// GET /api/v1/targets — list onboarded targets (paginated).
+#[tracing::instrument(skip_all)]
+pub async fn list_targets(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
+    let db = tenant_db(&agent, &tenant).await?;
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = db
+        .onboarded_targets()
+        .count_documents(doc! {})
+        .await
+        .unwrap_or(0);
+    let targets = match db
+        .onboarded_targets()
+        .find(doc! {})
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch onboarded targets: {e}");
+            Vec::new()
+        }
+    };
+    Ok(Json(ApiResponse {
+        data: targets,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+/// POST /api/v1/targets — create an onboarded target.
+#[tracing::instrument(skip_all)]
+pub async fn create_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<CreateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let mut target = OnboardedTarget::new(req.name, req.target_type);
+    target.description = req.description;
+    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
+
+    let db = tenant_db(&agent, &tenant).await?;
+    let res = db
+        .onboarded_targets()
+        .insert_one(&target)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.id = res.inserted_id.as_object_id();
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/targets/{id} — fetch one target.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn get_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// PATCH /api/v1/targets/{id} — update mutable fields.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn update_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+
+    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
+    if let Some(name) = req.name {
+        set.insert("name", name);
+    }
+    if let Some(tt) = req.target_type {
+        set.insert(
+            "target_type",
+            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(sc) = req.scan_config {
+        set.insert(
+            "scan_config",
+            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(cp) = req.compliance_profile {
+        set.insert(
+            "compliance_profile",
+            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(ss) = req.scan_schedule {
+        set.insert("scan_schedule", ss);
+    }
+
+    db.onboarded_targets()
+        .update_one(doc! { "_id": oid }, doc! { "$set": set })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn delete_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    db.onboarded_targets()
+        .delete_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    // Cascade the collections keyed by repo_id == target id (best-effort).
+    let by_repo = doc! { "repo_id": &id };
+    let _ = db.findings().delete_many(by_repo.clone()).await;
+    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
+    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
+    let _ = db.cve_alerts().delete_many(by_repo).await;
+    Ok(Json(serde_json::json!({ "status": "deleted" })))
+}
+
+/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn add_artifact(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(input): Json<ArtifactInput>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn applicable_scans_for_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    let scans = applicable_scans(&target)
+        .into_iter()
+        .map(|o| ScanOptionDto {
+            scan: o.scan.to_string(),
+            default_on: o.default_on,
+            rationale: o.rationale,
+            required_artifact: o.required_artifact.map(|k| k.to_string()),
+            blocked_reason: o.blocked_reason,
+        })
+        .collect();
+
+    Ok(Json(ApiResponse {
+        data: ApplicableScansResponse {
+            scans,
+            pentest_supported: supports_pentest(target.target_type),
+        },
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
+///
+/// This is the lightweight pass: it classifies from artifact kinds without
+/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
+/// ingest, with tramiton firmware analysis) is a follow-up background step.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn detect_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let mut target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // No ingested working paths here → kind-based classification only; the mock
+    // firmware detector is never invoked (no firmware working path present).
+    let empty = HashMap::new();
+    let detector = MockFirmwareDetector { detection: None };
+    let classification = classify_target(&target, &empty, &detector)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let classification_bson =
+        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.classification = Some(classification);
+
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
+///
+/// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
+/// legacy path). Runs in the background and returns immediately.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn trigger_target_scan(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    // 404 if the target doesn't exist for this tenant.
+    if db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .is_none()
+    {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let agent_clone = (*agent).clone();
+    let tenant_id = tenant.0.tenant_id.clone();
+    tokio::spawn(async move {
+        // Always the unified target pipeline — this endpoint is about an
+        // onboarded target by construction, independent of the global
+        // `unified_pipeline` transition flag used by the legacy paths.
+        if let Err(e) = agent_clone
+            .run_target_scan(
+                &tenant_id,
+                &id,
+                compliance_core::models::ScanTrigger::Manual,
+            )
+            .await
+        {
+            tracing::error!("Manual target scan failed for {id}: {e}");
+        }
+    });
+    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
+}

compliance-agent/src/api/routes.rs

@@ -25,6 +25,33 @@ pub fn build_router() -> Router {
             "/api/v1/repositories/{id}/webhook-config",
             get(handlers::get_webhook_config),
         )
+        // Unified onboarding targets (#131).
+        .route(
+            "/api/v1/targets",
+            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
+        )
+        .route(
+            "/api/v1/targets/{id}",
+            get(handlers::onboarding::get_target)
+                .patch(handlers::onboarding::update_target)
+                .delete(handlers::onboarding::delete_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/artifacts",
+            post(handlers::onboarding::add_artifact),
+        )
+        .route(
+            "/api/v1/targets/{id}/applicable-scans",
+            get(handlers::onboarding::applicable_scans_for_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/detect",
+            post(handlers::onboarding::detect_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/scan",
+            post(handlers::onboarding::trigger_target_scan),
+        )
         .route("/api/v1/findings", get(handlers::list_findings))
         .route("/api/v1/findings/{id}", get(handlers::get_finding))
         .route(

compliance-agent/src/classify/firmware.rs

@@ -0,0 +1,217 @@
+//! Firmware classification via tramiton.
+//!
+//! tramiton is the company's firmware build/repro engine; we do not re-implement
+//! its detection. We depend on `tramiton-core` directly (same-company IP) and run
+//! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
+//! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
+//! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
+//! tramiton sources nor a real firmware tree.
+
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{DetectedFact, TargetType};
+use compliance_core::traits::ClassifierVerdict;
+
+/// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
+/// Kept small and tramiton-independent so the classifier and the test mock don't
+/// need to construct a full tramiton plan.
+#[derive(Debug, Clone, Default)]
+pub struct FirmwareDetection {
+    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
+    pub provider: String,
+    /// Detection confidence: `low` | `medium` | `high`.
+    pub confidence: String,
+    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
+    pub build_system: String,
+    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
+    pub framework: Option<String>,
+    /// Target board / MCU / arch.
+    pub target: FirmwareTarget,
+    /// Unresolved gaps in the plan.
+    pub gaps: Vec<String>,
+}
+
+/// The detected firmware target (board / MCU / arch).
+#[derive(Debug, Clone, Default)]
+pub struct FirmwareTarget {
+    /// Board name.
+    pub board: Option<String>,
+    /// MCU part.
+    pub mcu: Option<String>,
+    /// Architecture.
+    pub arch: Option<String>,
+}
+
+/// A source of tramiton firmware detection.
+#[allow(async_fn_in_trait)]
+pub trait FirmwareDetector: Send + Sync {
+    /// Run detection over a path, returning a firmware detection if tramiton
+    /// could form a build plan.
+    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
+}
+
+/// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
+/// so it runs on a blocking thread to avoid stalling the async runtime. A path
+/// with no recognizable build system yields `Ok(None)`.
+pub struct TramitonNative;
+
+impl FirmwareDetector for TramitonNative {
+    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
+        let path = path.to_path_buf();
+        let plan = tokio::task::spawn_blocking(move || {
+            let repo = tramiton_core::Repo::new(&path);
+            tramiton_core::provider::analyze(&repo)
+        })
+        .await
+        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
+        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
+        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
+    }
+}
+
+/// Map tramiton's `BuildPlan` onto our minimal detection summary.
+fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
+    FirmwareDetection {
+        provider: bp.provider.clone(),
+        confidence: bp.confidence.to_string(),
+        build_system: bp.build_system.label().to_string(),
+        framework: bp.framework.clone(),
+        target: FirmwareTarget {
+            board: bp.target.board.clone(),
+            mcu: bp.target.mcu.clone(),
+            arch: bp.target.arch.clone(),
+        },
+        gaps: bp.gaps.clone(),
+    }
+}
+
+/// Map a firmware detection to a target type. Framework/build-system signals
+/// distinguish RTOS from bare-metal from Yocto.
+pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
+    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
+    let build_system = det.build_system.to_lowercase();
+    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
+
+    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
+    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
+        TargetType::EmbeddedLinuxYocto
+    } else if RTOS.iter().any(|k| signal.contains(k)) {
+        TargetType::FirmwareRtos
+    } else {
+        TargetType::FirmwareBareMetal
+    }
+}
+
+/// Map tramiton's confidence label to a `[0,1]` score.
+fn confidence_score(label: &str) -> f32 {
+    match label.to_lowercase().as_str() {
+        "high" => 0.9,
+        "medium" => 0.6,
+        "low" => 0.3,
+        _ => 0.4,
+    }
+}
+
+/// Turn a firmware detection into a classifier verdict, carrying the MCU / board
+/// / build-system as facts.
+pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
+    let target_type = detection_to_target_type(det);
+    let mut facts = vec![DetectedFact::new(
+        "build_system",
+        det.build_system.clone(),
+        "tramiton",
+    )];
+    if let Some(fw) = &det.framework {
+        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
+    }
+    if let Some(mcu) = &det.target.mcu {
+        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
+    }
+    if let Some(board) = &det.target.board {
+        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
+    }
+    if let Some(arch) = &det.target.arch {
+        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
+    }
+    ClassifierVerdict {
+        target_type,
+        confidence: confidence_score(&det.confidence),
+        facts,
+        rationale: format!(
+            "tramiton detected build system '{}'{}",
+            det.build_system,
+            det.framework
+                .as_ref()
+                .map(|f| format!(" (framework {f})"))
+                .unwrap_or_default()
+        ),
+    }
+}
+
+/// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
+pub struct MockFirmwareDetector {
+    /// The detection to return (or `None` for "no detection").
+    pub detection: Option<FirmwareDetection>,
+}
+
+impl FirmwareDetector for MockFirmwareDetector {
+    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
+        Ok(self.detection.clone())
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
+        FirmwareDetection {
+            provider: build_system.to_string(),
+            confidence: "high".to_string(),
+            build_system: build_system.to_string(),
+            framework: framework.map(|s| s.to_string()),
+            target: FirmwareTarget {
+                mcu: Some("stm32f429".to_string()),
+                ..Default::default()
+            },
+            gaps: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn zephyr_maps_to_rtos() {
+        assert_eq!(
+            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
+            TargetType::FirmwareRtos
+        );
+    }
+
+    #[test]
+    fn bare_cmake_maps_to_bare_metal() {
+        assert_eq!(
+            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
+            TargetType::FirmwareBareMetal
+        );
+    }
+
+    #[test]
+    fn bitbake_maps_to_yocto() {
+        assert_eq!(
+            detection_to_target_type(&detection("bitbake", None)),
+            TargetType::EmbeddedLinuxYocto
+        );
+    }
+
+    #[test]
+    fn verdict_carries_mcu_fact_and_confidence() {
+        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
+        assert_eq!(v.target_type, TargetType::FirmwareRtos);
+        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
+        assert!(v
+            .facts
+            .iter()
+            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
+    }
+}

compliance-agent/src/classify/language.rs

@@ -0,0 +1,357 @@
+//! Heuristic target-type classification from artifact kinds and source markers.
+//!
+//! Complements the tramiton firmware detector: this handles web / backend /
+//! mobile / desktop / PLC by sniffing manifest files and file extensions in the
+//! ingested code trees, plus strong priors from the artifact kinds themselves
+//! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
+
+use std::collections::HashSet;
+use std::fs;
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
+use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+
+/// Max directory depth scanned for marker files.
+const SCAN_DEPTH: usize = 2;
+
+/// Markers collected from a code tree.
+#[derive(Default)]
+struct Markers {
+    files: HashSet<String>,
+    dirs: HashSet<String>,
+    exts: HashSet<String>,
+}
+
+impl Markers {
+    fn has_file(&self, name: &str) -> bool {
+        self.files.contains(name)
+    }
+    fn has_ext(&self, ext: &str) -> bool {
+        self.exts.contains(ext)
+    }
+    fn any_dir_ends_with(&self, suffix: &str) -> bool {
+        self.dirs.iter().any(|d| d.ends_with(suffix))
+    }
+}
+
+/// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
+fn collect_markers(root: &Path) -> Markers {
+    let mut m = Markers::default();
+    scan_dir(root, 0, &mut m);
+    m
+}
+
+fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        let name = entry.file_name().to_string_lossy().to_lowercase();
+        if path.is_dir() {
+            m.dirs.insert(name);
+            if depth < SCAN_DEPTH {
+                scan_dir(&path, depth + 1, m);
+            }
+        } else {
+            if let Some(ext) = path.extension() {
+                m.exts.insert(ext.to_string_lossy().to_lowercase());
+            }
+            m.files.insert(name);
+        }
+    }
+}
+
+/// Whether a `package.json` at `root` looks like a front-end app.
+fn package_json_is_frontend(root: &Path) -> bool {
+    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
+        return false;
+    };
+    let c = content.to_lowercase();
+    ["react", "next", "vue", "@angular", "svelte", "vite"]
+        .iter()
+        .any(|f| c.contains(f))
+}
+
+/// The heuristic classifier: artifact-kind priors + source-tree markers.
+pub struct HeuristicClassifier;
+
+impl HeuristicClassifier {
+    /// Verdicts from the artifact kinds alone (no filesystem needed).
+    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
+        let mut out = Vec::new();
+        for a in input.artifacts {
+            let lower = a.source_ref.to_lowercase();
+            match a.kind {
+                ArtifactKind::PlcProject => out.push(verdict(
+                    TargetType::PlcSps,
+                    0.85,
+                    "PLC project artifact",
+                    vec![],
+                )),
+                ArtifactKind::MobilePackage => {
+                    let (tt, why) = if lower.ends_with(".ipa") {
+                        (TargetType::IosApp, "iOS package (.ipa)")
+                    } else {
+                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
+                    };
+                    out.push(verdict(tt, 0.85, why, vec![]));
+                }
+                ArtifactKind::ContainerImage => out.push(verdict(
+                    TargetType::BackendService,
+                    0.4,
+                    "container image",
+                    vec![],
+                )),
+                ArtifactKind::FirmwareImage => out.push(verdict(
+                    TargetType::FirmwareBareMetal,
+                    0.35,
+                    "firmware image (pending tramiton detection)",
+                    vec![],
+                )),
+                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
+                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
+                }
+                _ => {}
+            }
+        }
+        out
+    }
+
+    /// Verdicts from scanning the ingested code trees for manifest markers.
+    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
+        let mut out = Vec::new();
+        for a in input.artifacts {
+            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
+                continue;
+            }
+            let Some(path) = input.working_paths.get(&a.id) else {
+                continue;
+            };
+            let m = collect_markers(path);
+
+            // Mobile (checked first — strongest signal).
+            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
+                out.push(verdict(
+                    TargetType::AndroidApp,
+                    0.8,
+                    "Android manifest / gradle",
+                    facts_lang("kotlin/java"),
+                ));
+            }
+            if m.any_dir_ends_with(".xcodeproj")
+                || m.has_file("info.plist")
+                || m.has_file("podfile")
+                || m.has_ext("ipa")
+            {
+                out.push(verdict(
+                    TargetType::IosApp,
+                    0.8,
+                    "Xcode project / Info.plist",
+                    facts_lang("swift/objc"),
+                ));
+            }
+            // Desktop.
+            if m.has_ext("sln")
+                || m.has_ext("csproj")
+                || m.has_ext("vcxproj")
+                || m.has_ext("desktop")
+            {
+                out.push(verdict(
+                    TargetType::DesktopApp,
+                    0.7,
+                    "desktop project files",
+                    facts_lang("dotnet/native"),
+                ));
+            }
+            // PLC.
+            if m.has_ext("st") {
+                out.push(verdict(
+                    TargetType::PlcSps,
+                    0.8,
+                    "Structured Text sources",
+                    facts_lang("iec-61131-3"),
+                ));
+            }
+            // Web vs backend from package.json.
+            if m.has_file("package.json") {
+                if package_json_is_frontend(path) {
+                    out.push(verdict(
+                        TargetType::WebApp,
+                        0.65,
+                        "package.json with a front-end framework",
+                        facts_lang("javascript"),
+                    ));
+                } else {
+                    out.push(verdict(
+                        TargetType::BackendService,
+                        0.55,
+                        "package.json (no front-end framework)",
+                        facts_lang("javascript"),
+                    ));
+                }
+            }
+            // Backend languages.
+            for (file, lang) in [
+                ("cargo.toml", "rust"),
+                ("go.mod", "go"),
+                ("pom.xml", "java"),
+                ("requirements.txt", "python"),
+                ("pyproject.toml", "python"),
+            ] {
+                if m.has_file(file) {
+                    out.push(verdict(
+                        TargetType::BackendService,
+                        0.6,
+                        "backend build manifest",
+                        facts_lang(lang),
+                    ));
+                }
+            }
+            // Container-only.
+            if m.has_file("dockerfile") && out.is_empty() {
+                out.push(verdict(
+                    TargetType::BackendService,
+                    0.4,
+                    "Dockerfile",
+                    facts_lang("container"),
+                ));
+            }
+        }
+        out
+    }
+}
+
+impl TargetClassifier for HeuristicClassifier {
+    fn name(&self) -> &str {
+        "heuristic"
+    }
+
+    async fn classify(
+        &self,
+        input: &ClassificationInput<'_>,
+    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
+        let mut out = self.kind_priors(input);
+        out.extend(self.source_verdicts(input));
+        Ok(out)
+    }
+}
+
+fn verdict(
+    target_type: TargetType,
+    confidence: f32,
+    rationale: &str,
+    facts: Vec<DetectedFact>,
+) -> ClassifierVerdict {
+    ClassifierVerdict {
+        target_type,
+        confidence,
+        facts,
+        rationale: rationale.to_string(),
+    }
+}
+
+fn facts_lang(lang: &str) -> Vec<DetectedFact> {
+    vec![DetectedFact::new("language", lang, "heuristic")]
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::Artifact;
+    use std::collections::HashMap;
+    use std::path::PathBuf;
+
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
+        let scratch = Scratch::new();
+        setup(&scratch.0);
+        let artifact = Artifact::git_repo("https://git/x", "main");
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let artifacts = vec![artifact];
+        let input = ClassificationInput {
+            artifacts: &artifacts,
+            working_paths: &wp,
+            description: None,
+        };
+        HeuristicClassifier
+            .classify(&input)
+            .await
+            .expect("classify")
+    }
+
+    #[tokio::test]
+    async fn frontend_package_json_is_webapp() {
+        let v = classify_tree(|root| {
+            fs::write(
+                root.join("package.json"),
+                r#"{"dependencies":{"react":"18"}}"#,
+            )
+            .unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
+    }
+
+    #[tokio::test]
+    async fn cargo_toml_is_backend() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
+        })
+        .await;
+        assert!(v
+            .iter()
+            .any(|x| x.target_type == TargetType::BackendService));
+    }
+
+    #[tokio::test]
+    async fn android_manifest_is_android() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
+    }
+
+    #[tokio::test]
+    async fn structured_text_is_plc() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
+    }
+
+    #[tokio::test]
+    async fn ipa_artifact_prior_is_ios() {
+        let artifacts = vec![Artifact::mobile_package("app.ipa")];
+        let wp = HashMap::new();
+        let input = ClassificationInput {
+            artifacts: &artifacts,
+            working_paths: &wp,
+            description: None,
+        };
+        let v = HeuristicClassifier
+            .classify(&input)
+            .await
+            .expect("classify");
+        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
+    }
+}

compliance-agent/src/classify/mod.rs

@@ -0,0 +1,226 @@
+//! Target classification.
+//!
+//! Runs the classifier registry over a target's artifacts and their ingested
+//! working paths, then merges and ranks the verdicts into a [`Classification`].
+//! The registry is the heuristic classifier (artifact kinds + source markers)
+//! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
+
+mod firmware;
+mod language;
+
+pub use firmware::{
+    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
+};
+pub use language::HeuristicClassifier;
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{
+    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
+};
+use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+
+use firmware::detection_to_verdict;
+
+/// Classify a target from its artifacts and their ingested working paths, using
+/// the heuristic classifier plus the tramiton firmware detector. Verdicts are
+/// merged (max confidence per target type) and ranked into a [`Classification`].
+pub async fn classify_target<D: FirmwareDetector>(
+    target: &OnboardedTarget,
+    working_paths: &HashMap<String, PathBuf>,
+    firmware_detector: &D,
+) -> Result<Classification, CoreError> {
+    let input = ClassificationInput {
+        artifacts: &target.artifacts,
+        working_paths,
+        description: target.description.as_deref(),
+    };
+
+    let mut verdicts = Vec::new();
+    let mut detected_by = Vec::new();
+
+    let heuristic = HeuristicClassifier.classify(&input).await?;
+    if !heuristic.is_empty() {
+        detected_by.push("heuristic".to_string());
+    }
+    verdicts.extend(heuristic);
+
+    // Tramiton firmware detection over firmware / code working paths.
+    let mut tramiton_used = false;
+    for artifact in &target.artifacts {
+        if !matches!(
+            artifact.kind,
+            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+        ) {
+            continue;
+        }
+        let Some(path) = working_paths.get(&artifact.id) else {
+            continue;
+        };
+        if let Some(detection) = firmware_detector.detect(path).await? {
+            verdicts.push(detection_to_verdict(&detection));
+            tramiton_used = true;
+        }
+    }
+    if tramiton_used {
+        detected_by.push("tramiton".to_string());
+    }
+
+    Ok(rank(verdicts, detected_by, target.target_type))
+}
+
+/// Merge verdicts by target type (keeping the max confidence and its rationale),
+/// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
+/// Falls back to the declared type when no verdict is produced.
+fn rank(
+    verdicts: Vec<ClassifierVerdict>,
+    detected_by: Vec<String>,
+    fallback: TargetType,
+) -> Classification {
+    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
+    let mut facts: Vec<DetectedFact> = Vec::new();
+    for verdict in verdicts {
+        for fact in verdict.facts {
+            if !facts
+                .iter()
+                .any(|e| e.key == fact.key && e.value == fact.value)
+            {
+                facts.push(fact);
+            }
+        }
+        let entry = best
+            .entry(verdict.target_type)
+            .or_insert((0.0, String::new()));
+        if verdict.confidence > entry.0 {
+            *entry = (verdict.confidence, verdict.rationale);
+        }
+    }
+
+    let mut candidates: Vec<TargetTypeCandidate> = best
+        .into_iter()
+        .map(
+            |(target_type, (confidence, rationale))| TargetTypeCandidate {
+                target_type,
+                confidence,
+                rationale,
+            },
+        )
+        .collect();
+    // Descending confidence; ties broken by type name for deterministic ordering.
+    candidates.sort_by(|a, b| {
+        b.confidence
+            .partial_cmp(&a.confidence)
+            .unwrap_or(std::cmp::Ordering::Equal)
+            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
+    });
+
+    let suggested = candidates
+        .first()
+        .map(|c| c.target_type)
+        .unwrap_or(fallback);
+
+    Classification {
+        suggested,
+        candidates,
+        facts,
+        detected_by,
+        detected_at: chrono::Utc::now(),
+        confirmed: false,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::Artifact;
+    use std::fs;
+    use std::path::Path;
+
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn no_firmware() -> MockFirmwareDetector {
+        MockFirmwareDetector { detection: None }
+    }
+
+    #[tokio::test]
+    async fn backend_repo_classifies_as_backend() {
+        let scratch = Scratch::new();
+        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
+
+        let artifact = Artifact::git_repo("https://git/x", "main");
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
+        target.artifacts.push(artifact);
+
+        let c = classify_target(&target, &wp, &no_firmware())
+            .await
+            .expect("classify");
+        assert_eq!(c.suggested, TargetType::BackendService);
+        assert!(c.detected_by.contains(&"heuristic".to_string()));
+        assert!(!c.confirmed);
+    }
+
+    #[tokio::test]
+    async fn firmware_detector_verdict_ranks_top() {
+        let scratch = Scratch::new();
+        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
+
+        let artifact =
+            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
+        target.artifacts.push(artifact);
+
+        let detector = MockFirmwareDetector {
+            detection: Some(FirmwareDetection {
+                provider: "zephyr".to_string(),
+                confidence: "high".to_string(),
+                build_system: "zephyr".to_string(),
+                framework: Some("zephyr".to_string()),
+                target: FirmwareTarget {
+                    mcu: Some("nrf52840".to_string()),
+                    ..Default::default()
+                },
+                gaps: vec![],
+            }),
+        };
+
+        let c = classify_target(&target, &wp, &detector)
+            .await
+            .expect("classify");
+        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
+        assert_eq!(c.suggested, TargetType::FirmwareRtos);
+        assert!(c.detected_by.contains(&"tramiton".to_string()));
+        assert!(c.facts.iter().any(|f| f.key == "mcu"));
+    }
+
+    #[tokio::test]
+    async fn no_signal_falls_back_to_declared_type() {
+        let scratch = Scratch::new();
+        let _ = Path::new(&scratch.0);
+        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
+        let wp = HashMap::new();
+        let c = classify_target(&target, &wp, &no_firmware())
+            .await
+            .expect("classify");
+        assert_eq!(c.suggested, TargetType::DesktopApp);
+        assert!(c.candidates.is_empty());
+    }
+}

compliance-agent/src/config.rs

@@ -45,6 +45,14 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or_else(|| "0 0 * * * *".to_string()),
         git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
             .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
+        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
+            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
+        // Defaults ON: the unified onboarded-target pipeline is now the primary
+        // path (no legacy `repositories` data in production). Set
+        // `UNIFIED_PIPELINE=0` to fall back to the legacy repository pipeline.
+        unified_pipeline: env_var_opt("UNIFIED_PIPELINE")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(true),
         ssh_key_path: env_var_opt("SSH_KEY_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),

compliance-agent/src/database.rs

@@ -179,6 +179,23 @@ impl DatabasePool {
             .collect())
     }
 
+    /// Tenant ids for every provisioned tenant database, derived by stripping
+    /// the `<prefix>_` from the database names. Skips the admin database
+    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
+    /// at the cluster level and cannot be recovered here — in practice tenant
+    /// ids are UUIDs and never hit that path. Used by the migration CLI's
+    /// `--all` mode.
+    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
+        let prefix = format!("{}_", self.db_prefix);
+        Ok(self
+            .list_tenant_db_names()
+            .await?
+            .into_iter()
+            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
+            .filter(|id| !id.starts_with('_'))
+            .collect())
+    }
+
     /// Drop the database for a specific tenant. Used by GDPR delete
     /// and tenant offboarding. Idempotent — dropping a non-existent
     /// database is a no-op at the driver level.
@@ -521,6 +538,13 @@ impl Database {
         self.inner.collection("onboarded_targets")
     }
 
+    /// A typed handle to an arbitrary collection by name. For bookkeeping
+    /// collections without a dedicated model (e.g. `schema_migrations`,
+    /// `onboarding_migration_log`).
+    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
+        self.inner.collection(name)
+    }
+
     pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
         self.inner.collection("dast_scan_runs")
     }

compliance-agent/src/ingest/blob.rs

@@ -0,0 +1,154 @@
+//! Content-addressed blob storage and archive extraction for ingest.
+//!
+//! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
+//! digest; per-run working directories live under `<base>/work/`.
+
+use std::fs::{self, File};
+use std::io::{self, Read};
+use std::path::{Path, PathBuf};
+
+use sha2::{Digest, Sha256};
+
+use crate::error::AgentError;
+
+/// Read buffer size for streaming hashes/copies (64 KiB).
+const BUF_LEN: usize = 64 * 1024;
+
+/// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
+/// byte length. Streams so large firmware images never load fully into memory.
+pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
+    let mut file = File::open(path)?;
+    let mut hasher = Sha256::new();
+    let mut buf = [0u8; BUF_LEN];
+    let mut total: u64 = 0;
+    loop {
+        let n = file.read(&mut buf)?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buf[..n]);
+        total += n as u64;
+    }
+    Ok((hex::encode(hasher.finalize()), total))
+}
+
+/// Copy `src` into the content-addressed blob store under `base`, returning the
+/// stored path. Idempotent: an already-present blob is not rewritten.
+pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
+    if sha.len() < 2 {
+        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
+    }
+    let dir = base.join("blobs").join(&sha[0..2]);
+    fs::create_dir_all(&dir)?;
+    let dest = dir.join(sha);
+    if !dest.exists() {
+        fs::copy(src, &dest)?;
+    }
+    Ok(dest)
+}
+
+/// Extract a zip archive into `dest` (created if needed). `enclosed_name`
+/// sanitizes each entry path, so this is safe against zip-slip traversal.
+pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
+    let file = File::open(archive)?;
+    let mut zip =
+        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
+    fs::create_dir_all(dest)?;
+    for i in 0..zip.len() {
+        let mut entry = zip
+            .by_index(i)
+            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
+        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
+        let Some(rel) = entry.enclosed_name() else {
+            continue;
+        };
+        let out = dest.join(rel);
+        if entry.is_dir() {
+            fs::create_dir_all(&out)?;
+        } else {
+            if let Some(parent) = out.parent() {
+                fs::create_dir_all(parent)?;
+            }
+            let mut outfile = File::create(&out)?;
+            io::copy(&mut entry, &mut outfile)?;
+        }
+    }
+    Ok(())
+}
+
+/// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
+pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
+    base.join("work").join(target_id).join(artifact_id)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    /// A unique scratch directory, removed on drop.
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir scratch");
+            Self(p)
+        }
+        fn path(&self) -> &Path {
+            &self.0
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn hash_is_stable_and_reports_size() {
+        let dir = Scratch::new();
+        let f = dir.path().join("a.bin");
+        fs::write(&f, b"hello world").expect("write");
+        let (sha, size) = hash_file(&f).expect("hash");
+        assert_eq!(size, 11);
+        // Known SHA-256 of "hello world".
+        assert_eq!(
+            sha,
+            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
+        );
+    }
+
+    #[test]
+    fn store_is_content_addressed_and_idempotent() {
+        let base = Scratch::new();
+        let src = base.path().join("src.bin");
+        fs::write(&src, b"payload").expect("write");
+        let (sha, _) = hash_file(&src).expect("hash");
+        let p1 = store_file(base.path(), &src, &sha).expect("store");
+        let p2 = store_file(base.path(), &src, &sha).expect("store again");
+        assert_eq!(p1, p2);
+        assert!(p1.ends_with(&sha));
+        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
+        assert_eq!(fs::read(&p1).expect("read"), b"payload");
+    }
+
+    #[test]
+    fn extract_zip_writes_entries() {
+        let base = Scratch::new();
+        let archive = base.path().join("a.zip");
+        {
+            let file = File::create(&archive).expect("create");
+            let mut w = zip::ZipWriter::new(file);
+            let opts: zip::write::SimpleFileOptions = Default::default();
+            w.start_file("dir/hello.txt", opts).expect("start");
+            io::Write::write_all(&mut w, b"hi").expect("write");
+            w.finish().expect("finish");
+        }
+        let dest = base.path().join("out");
+        extract_zip(&archive, &dest).expect("extract");
+        assert_eq!(
+            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
+            "hi"
+        );
+    }
+}

compliance-agent/src/ingest/mod.rs

@@ -0,0 +1,334 @@
+//! Artifact ingest.
+//!
+//! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
+//! path plus recorded metadata (content hash, size, discovered facts) that the
+//! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
+//! is also the reconciliation key against sibling products (a firmware sha256
+//! matches tramiton's `Artifact.sha256`).
+
+mod blob;
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
+use compliance_core::AgentConfig;
+
+use crate::error::AgentError;
+use crate::pipeline::git::{GitOps, RepoCredentials};
+
+/// The paths and identifiers an ingest needs. Decoupled from the full
+/// [`AgentConfig`] so ingest is testable without a complete config.
+pub struct IngestContext<'a> {
+    /// Base directory for content-addressed blobs and working dirs.
+    pub artifact_store_base: &'a Path,
+    /// Base directory for git clones.
+    pub git_clone_base: &'a str,
+    /// Default SSH key path (used when an artifact provides none).
+    pub ssh_key_path: &'a str,
+    /// The id of the target these artifacts belong to (namespaces working dirs).
+    pub target_id: &'a str,
+}
+
+impl<'a> IngestContext<'a> {
+    /// Build an ingest context from the agent config for a given target.
+    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
+        Self {
+            artifact_store_base: Path::new(&config.artifact_store_base_path),
+            git_clone_base: &config.git_clone_base_path,
+            ssh_key_path: &config.ssh_key_path,
+            target_id,
+        }
+    }
+}
+
+/// The result of ingesting one artifact.
+pub struct IngestedArtifact {
+    /// The artifact this corresponds to ([`Artifact::id`]).
+    pub artifact_id: String,
+    /// The artifact kind.
+    pub kind: ArtifactKind,
+    /// Local working path (clone dir, extracted dir, or blob file). `None` for
+    /// artifacts with no on-disk form (live URL, plaintext, container ref).
+    pub working_path: Option<PathBuf>,
+    /// SHA-256 of the content (blobs) or git head SHA (git repos).
+    pub content_hash: Option<String>,
+    /// Stored blob size in bytes, when applicable.
+    pub size_bytes: Option<u64>,
+    /// Facts discovered during ingest.
+    pub facts: Vec<DetectedFact>,
+}
+
+/// All ingested artifacts for a target, keyed by artifact id.
+pub struct IngestSet {
+    /// The ingested artifacts, keyed by [`Artifact::id`].
+    pub by_artifact: HashMap<String, IngestedArtifact>,
+}
+
+impl IngestSet {
+    /// The working paths of every ingested artifact that has one — the input the
+    /// classifier expects.
+    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
+        self.by_artifact
+            .iter()
+            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
+            .collect()
+    }
+
+    /// The ingest result for a specific artifact.
+    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
+        self.by_artifact.get(artifact_id)
+    }
+}
+
+/// Ingest every artifact on a target.
+pub fn ingest_all(
+    target: &OnboardedTarget,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestSet, AgentError> {
+    let mut by_artifact = HashMap::new();
+    for artifact in &target.artifacts {
+        let ingested = ingest_artifact(artifact, ctx)?;
+        by_artifact.insert(artifact.id.clone(), ingested);
+    }
+    Ok(IngestSet { by_artifact })
+}
+
+/// Ingest a single artifact, dispatching on its kind.
+pub fn ingest_artifact(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestedArtifact, AgentError> {
+    match artifact.kind {
+        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
+        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
+            ingest_blob(artifact, ctx, true)
+        }
+        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
+        ArtifactKind::ContainerImage => Ok(metadata_only(
+            artifact,
+            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
+        )),
+        ArtifactKind::LiveUrl => Ok(metadata_only(
+            artifact,
+            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
+        )),
+        ArtifactKind::PlaintextDescription => Ok(metadata_only(
+            artifact,
+            DetectedFact::new(
+                "description_len",
+                artifact.source_ref.len().to_string(),
+                "ingest",
+            ),
+        )),
+    }
+}
+
+/// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
+fn ingest_git(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestedArtifact, AgentError> {
+    let creds = credentials_for(artifact, ctx.ssh_key_path);
+    let git_ops = GitOps::new(ctx.git_clone_base, creds);
+    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
+    let head = GitOps::get_head_sha(&repo_path).ok();
+    Ok(IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: Some(repo_path),
+        content_hash: head,
+        size_bytes: None,
+        facts: Vec::new(),
+    })
+}
+
+/// Store a blob artifact content-addressed. When `extract` is set and the blob
+/// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
+/// working directory; otherwise the working path is the stored blob.
+fn ingest_blob(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+    extract: bool,
+) -> Result<IngestedArtifact, AgentError> {
+    let base = ctx.artifact_store_base;
+    let src = local_source(artifact)?;
+    let (sha, size) = blob::hash_file(&src)?;
+    let stored = blob::store_file(base, &src, &sha)?;
+
+    let mut facts = Vec::new();
+    let working_path = if extract {
+        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
+        match blob::extract_zip(&stored, &dest) {
+            Ok(()) => dest,
+            Err(e) => {
+                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
+                // note it so later stages can decide what to do.
+                facts.push(DetectedFact::new(
+                    "archive_unextracted",
+                    e.to_string(),
+                    "ingest",
+                ));
+                stored.clone()
+            }
+        }
+    } else {
+        stored.clone()
+    };
+
+    Ok(IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: Some(working_path),
+        content_hash: Some(sha),
+        size_bytes: Some(size),
+        facts,
+    })
+}
+
+/// An artifact with no on-disk form: record a single fact, no hash/path.
+fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
+    IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: None,
+        content_hash: None,
+        size_bytes: None,
+        facts: vec![fact],
+    }
+}
+
+/// The local file backing a blob artifact: its `stored_path` if already
+/// uploaded, else its `source_ref` interpreted as a filesystem path.
+fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
+    let path = artifact
+        .stored_path
+        .as_deref()
+        .unwrap_or(artifact.source_ref.as_str());
+    let path = PathBuf::from(path);
+    if !path.exists() {
+        return Err(AgentError::Other(format!(
+            "artifact {} source not found at {}",
+            artifact.id,
+            path.display()
+        )));
+    }
+    Ok(path)
+}
+
+/// Build git credentials from an artifact's auth plus a default SSH key path.
+fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
+    let auth = artifact.auth.as_ref();
+    RepoCredentials {
+        ssh_key_path: auth
+            .and_then(|a| a.ssh_key_path.clone())
+            .or_else(|| Some(default_ssh_key_path.to_string())),
+        auth_token: auth.and_then(|a| a.secret.clone()),
+        auth_username: auth.and_then(|a| a.username.clone()),
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{ArtifactAuth, TargetType};
+
+    /// A unique scratch directory, removed on drop.
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
+            std::fs::create_dir_all(&p).expect("mkdir scratch");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
+        IngestContext {
+            artifact_store_base: store,
+            git_clone_base: "/tmp/cs-ingest-test-repos",
+            ssh_key_path: "/tmp/cs-ingest-test-ssh",
+            target_id,
+        }
+    }
+
+    #[test]
+    fn firmware_blob_is_hashed_and_stored() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let fw = scratch.0.join("fw.bin");
+        std::fs::write(&fw, b"firmware-bytes").expect("write");
+
+        let ctx = ctx_for(&store, "t1");
+        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+
+        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
+        assert_eq!(out.size_bytes, Some(14));
+        let sha = out.content_hash.expect("hash");
+        assert_eq!(sha.len(), 64);
+        // working path is the content-addressed blob
+        let wp = out.working_path.expect("working path");
+        assert!(wp.starts_with(store.join("blobs")));
+    }
+
+    #[test]
+    fn live_url_has_no_blob() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let ctx = ctx_for(&store, "t1");
+        let artifact = Artifact::live_url("https://example.com");
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+        assert!(out.working_path.is_none());
+        assert!(out.content_hash.is_none());
+        assert!(out.facts.iter().any(|f| f.key == "live_url"));
+    }
+
+    #[test]
+    fn ingest_all_collects_working_paths() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let fw = scratch.0.join("fw.bin");
+        std::fs::write(&fw, b"abc").expect("write");
+        let ctx = ctx_for(&store, "t1");
+
+        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
+        target
+            .artifacts
+            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
+        target.artifacts.push(Artifact::live_url("https://x"));
+
+        let set = ingest_all(&target, &ctx).expect("ingest all");
+        assert_eq!(set.by_artifact.len(), 2);
+        // Only the firmware artifact yields a working path.
+        assert_eq!(set.working_paths().len(), 1);
+    }
+
+    #[test]
+    fn credentials_prefer_artifact_auth() {
+        let mut artifact = Artifact::git_repo("https://git/x", "main");
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        let creds = credentials_for(&artifact, "/default/ssh/key");
+        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
+        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
+    }
+
+    #[test]
+    fn credentials_fall_back_to_default_ssh_key() {
+        let artifact = Artifact::git_repo("git@host:x.git", "main");
+        let creds = credentials_for(&artifact, "/default/ssh/key");
+        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
+        assert!(creds.auth_token.is_none());
+    }
+}

compliance-agent/src/lib.rs

@@ -2,10 +2,13 @@
 
 pub mod agent;
 pub mod api;
+pub mod classify;
 pub mod config;
 pub mod database;
 pub mod error;
+pub mod ingest;
 pub mod llm;
+pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;

compliance-agent/src/main.rs

@@ -1,4 +1,50 @@
-use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
+use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
+
+/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
+/// unified `onboarded_targets` collection per tenant.
+///
+/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
+async fn run_migration(
+    args: &[String],
+    pool: &database::DatabasePool,
+) -> Result<(), compliance_agent::error::AgentError> {
+    if args.get(2).map(String::as_str) != Some("onboarding") {
+        eprintln!(
+            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
+        );
+        std::process::exit(2);
+    }
+    let has = |flag: &str| args.iter().any(|a| a == flag);
+    let dry_run = has("--dry-run");
+    let revert = has("--revert");
+    let tenant = args
+        .iter()
+        .position(|a| a == "--tenant")
+        .and_then(|i| args.get(i + 1))
+        .cloned();
+
+    let tenants: Vec<String> = if has("--all") {
+        pool.list_tenant_ids().await?
+    } else if let Some(t) = tenant {
+        vec![t]
+    } else {
+        eprintln!("specify --all or --tenant <id>");
+        std::process::exit(2);
+    };
+
+    for tenant_id in tenants {
+        let db = pool.for_tenant_id(&tenant_id).await?;
+        if revert {
+            migrate::onboarding::revert(&db).await?;
+            println!("[{tenant_id}] reverted onboarding backfill");
+        } else {
+            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
+            let prefix = if dry_run { "(dry-run) " } else { "" };
+            println!("[{tenant_id}] {prefix}{report:?}");
+        }
+    }
+    Ok(())
+}
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -31,6 +77,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let db_pool =
         database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
+    // One-shot subcommands run and exit without starting the servers.
+    let args: Vec<String> = std::env::args().collect();
+    if args.get(1).map(String::as_str) == Some("migrate") {
+        run_migration(&args, &db_pool).await?;
+        return Ok(());
+    }
+
     let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
 
     tracing::info!("Starting scheduler...");

compliance-agent/src/migrate/mod.rs

@@ -0,0 +1,8 @@
+//! One-time data migrations.
+//!
+//! Currently just the onboarding backfill ([`onboarding`]), which folds the
+//! legacy `repositories` and `dast_targets` collections into the unified
+//! `onboarded_targets` collection, preserving `_id` so every downstream record
+//! keyed by `repo_id` / `target_id` keeps resolving.
+
+pub mod onboarding;

compliance-agent/src/migrate/onboarding.rs

@@ -0,0 +1,406 @@
+//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
+//!
+//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
+//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
+//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
+//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
+//! existing webhook URLs keep working. The mapping functions are pure and unit
+//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
+//! thin driver over them.
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
+    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
+};
+use futures_util::TryStreamExt;
+use mongodb::bson::{doc, Document};
+
+use crate::database::Database;
+use crate::error::AgentError;
+
+/// Marker id in `schema_migrations` recording that the backfill has run.
+const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
+
+/// Summary of a backfill run.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct MigrationReport {
+    /// Repositories turned into onboarded targets.
+    pub repos_migrated: u64,
+    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
+    pub dast_targets_folded: u64,
+    /// DAST targets with no repo link, migrated as standalone targets.
+    pub dast_targets_standalone: u64,
+    /// Records skipped because a target with that `_id` already existed.
+    pub skipped_existing: u64,
+}
+
+/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
+/// are backend services; a browser app is a web app.
+fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
+    match kind {
+        DastTargetType::WebApp => TargetType::WebApp,
+        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
+    }
+}
+
+/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
+/// auth). Shared by fold-in and standalone migration.
+pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
+    let mut artifact = Artifact::live_url(dast.base_url.clone());
+    artifact.web = Some(WebArtifactConfig {
+        target_kind: dast.target_type.clone(),
+        excluded_paths: dast.excluded_paths.clone(),
+        max_crawl_depth: dast.max_crawl_depth,
+        rate_limit: dast.rate_limit,
+        allow_destructive: dast.allow_destructive,
+    });
+    artifact.auth = dast.auth_config.clone().map(Into::into);
+    artifact
+}
+
+/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
+/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
+/// and auth; tracker config folds into `scan_config`.
+///
+/// `target_type` is a safe default (`BackendService`) — the classifier can
+/// refine it later; `classification` is left `None` (unconfirmed).
+pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
+    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
+    target.id = repo.id;
+
+    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
+    artifact.git = Some(GitArtifactConfig {
+        default_branch: repo.default_branch.clone(),
+        last_scanned_commit: repo.last_scanned_commit.clone(),
+        local_path: repo.local_path.clone(),
+    });
+    if repo.auth_token.is_some() || repo.auth_username.is_some() {
+        artifact.auth = Some(compliance_core::models::ArtifactAuth {
+            method: "token".to_string(),
+            username: repo.auth_username.clone(),
+            secret: repo.auth_token.clone(),
+            ..Default::default()
+        });
+    }
+    target.artifacts.push(artifact);
+
+    if repo.tracker_type.is_some() {
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: repo.tracker_type.clone(),
+            owner: repo.tracker_owner.clone(),
+            repo: repo.tracker_repo.clone(),
+            token: repo.tracker_token.clone(),
+        });
+    }
+
+    target.scan_schedule = repo.scan_schedule.clone();
+    target.webhook_enabled = repo.webhook_enabled;
+    target.webhook_secret = repo.webhook_secret.clone();
+    target.findings_count = repo.findings_count;
+    target.created_at = repo.created_at;
+    target.updated_at = repo.updated_at;
+    target
+}
+
+/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
+/// target. If the repo default was `BackendService` but the DAST target is a
+/// browser web app, promote the type to `WebApp`.
+pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
+    if matches!(dast.target_type, DastTargetType::WebApp)
+        && target.target_type == TargetType::BackendService
+    {
+        target.target_type = TargetType::WebApp;
+    }
+    if !target.has(ArtifactKind::LiveUrl) {
+        target.artifacts.push(dast_to_artifact(dast));
+    }
+}
+
+/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
+pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
+    let mut target =
+        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
+    target.id = dast.id;
+    target.artifacts.push(dast_to_artifact(dast));
+    target.created_at = dast.created_at;
+    target.updated_at = dast.updated_at;
+    target
+}
+
+/// Whether the onboarding backfill has already been applied to this database.
+pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
+    let found = db
+        .collection_named::<Document>("schema_migrations")
+        .find_one(doc! { "_id": MIGRATION_MARKER })
+        .await?;
+    Ok(found.is_some())
+}
+
+/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
+/// tenant database.
+///
+/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
+/// skipped, so re-running is safe. With `dry_run`, computes the report without
+/// writing. The legacy collections are never deleted; the only mutation outside
+/// `onboarded_targets` is the history relink of folded DAST targets, which is
+/// logged so [`revert`] can undo it.
+pub async fn backfill_onboarded_targets(
+    db: &Database,
+    dry_run: bool,
+) -> Result<MigrationReport, AgentError> {
+    let mut report = MigrationReport::default();
+
+    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
+    let mut repos = db.repositories().find(doc! {}).await?;
+    while let Some(repo) = repos.try_next().await? {
+        let Some(id) = repo.id else { continue };
+        if db
+            .onboarded_targets()
+            .find_one(doc! { "_id": id })
+            .await?
+            .is_some()
+        {
+            report.skipped_existing += 1;
+            continue;
+        }
+        if !dry_run {
+            db.onboarded_targets()
+                .insert_one(repo_to_target(&repo))
+                .await?;
+        }
+        report.repos_migrated += 1;
+    }
+
+    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
+    let mut dasts = db.dast_targets().find(doc! {}).await?;
+    while let Some(dast) = dasts.try_next().await? {
+        let Some(dast_id) = dast.id else { continue };
+        let repo_oid = dast
+            .repo_id
+            .as_deref()
+            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
+        let linked = match repo_oid {
+            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
+            None => None,
+        };
+
+        match (linked, repo_oid) {
+            // Fold into an existing repo-derived target.
+            (Some(mut target), Some(oid)) => {
+                if target.has(ArtifactKind::LiveUrl) {
+                    report.skipped_existing += 1; // already folded on a prior run
+                    continue;
+                }
+                fold_dast_into_target(&mut target, &dast);
+                if !dry_run {
+                    db.onboarded_targets()
+                        .replace_one(doc! { "_id": oid }, &target)
+                        .await?;
+                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
+                }
+                report.dast_targets_folded += 1;
+            }
+            // No linked repo target: migrate as a standalone target (keeps _id).
+            _ => {
+                if db
+                    .onboarded_targets()
+                    .find_one(doc! { "_id": dast_id })
+                    .await?
+                    .is_some()
+                {
+                    report.skipped_existing += 1;
+                    continue;
+                }
+                if !dry_run {
+                    db.onboarded_targets()
+                        .insert_one(dast_to_standalone_target(&dast))
+                        .await?;
+                }
+                report.dast_targets_standalone += 1;
+            }
+        }
+    }
+
+    if !dry_run {
+        db.collection_named::<Document>("schema_migrations")
+            .update_one(
+                doc! { "_id": MIGRATION_MARKER },
+                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
+            )
+            .upsert(true)
+            .await?;
+    }
+    Ok(report)
+}
+
+/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
+/// unified target id, logging each move so [`revert`] can undo it.
+///
+/// Note: if multiple DAST targets fold into the same repo target, revert
+/// restores only the last-logged mapping — a rare edge. The source collections
+/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
+async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
+    db.dast_scan_runs()
+        .update_many(
+            doc! { "target_id": old_id },
+            doc! { "$set": { "target_id": new_id } },
+        )
+        .await?;
+    db.pentest_sessions()
+        .update_many(
+            doc! { "target_id": old_id },
+            doc! { "$set": { "target_id": new_id } },
+        )
+        .await?;
+    db.collection_named::<Document>("onboarding_migration_log")
+        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
+        .await?;
+    Ok(())
+}
+
+/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
+/// and the log, and clear the marker. The legacy collections are untouched, so
+/// this restores the pre-migration state.
+pub async fn revert(db: &Database) -> Result<(), AgentError> {
+    let log = db.collection_named::<Document>("onboarding_migration_log");
+    let mut cursor = log.find(doc! {}).await?;
+    while let Some(entry) = cursor.try_next().await? {
+        if let (Ok(old), Ok(new)) = (
+            entry.get_str("old_target_id"),
+            entry.get_str("new_target_id"),
+        ) {
+            db.dast_scan_runs()
+                .update_many(
+                    doc! { "target_id": new },
+                    doc! { "$set": { "target_id": old } },
+                )
+                .await?;
+            db.pentest_sessions()
+                .update_many(
+                    doc! { "target_id": new },
+                    doc! { "$set": { "target_id": old } },
+                )
+                .await?;
+        }
+    }
+    db.onboarded_targets().drop().await?;
+    log.drop().await?;
+    db.collection_named::<Document>("schema_migrations")
+        .delete_one(doc! { "_id": MIGRATION_MARKER })
+        .await?;
+    Ok(())
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{DastAuthConfig, TrackerType};
+
+    fn repo() -> TrackedRepository {
+        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
+        r.id = Some(mongodb::bson::oid::ObjectId::new());
+        r.default_branch = "develop".to_string();
+        r.last_scanned_commit = Some("abc123".to_string());
+        r.auth_token = Some("pat".to_string());
+        r.auth_username = Some("bob".to_string());
+        r.tracker_type = Some(TrackerType::Gitea);
+        r.tracker_owner = Some("acme".to_string());
+        r.findings_count = 7;
+        r
+    }
+
+    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
+        let mut d = DastTarget::new(
+            "acme-web".to_string(),
+            "https://acme.example.com".to_string(),
+            kind,
+        );
+        d.id = Some(mongodb::bson::oid::ObjectId::new());
+        d.repo_id = repo_id;
+        d.max_crawl_depth = 5;
+        d.auth_config = Some(DastAuthConfig {
+            method: "bearer".to_string(),
+            login_url: None,
+            username: None,
+            password: None,
+            token: Some("tok".to_string()),
+            headers: None,
+        });
+        d
+    }
+
+    #[test]
+    fn repo_maps_preserving_id_and_git_artifact() {
+        let r = repo();
+        let t = repo_to_target(&r);
+        assert_eq!(t.id, r.id); // id preserved
+        assert_eq!(t.findings_count, 7);
+        assert_eq!(t.scan_schedule, r.scan_schedule);
+        let git = t.code_artifact().expect("git artifact");
+        assert_eq!(git.kind, ArtifactKind::GitRepo);
+        assert_eq!(git.source_ref, "https://git/acme.git");
+        let gc = git.git.as_ref().expect("git config");
+        assert_eq!(gc.default_branch, "develop");
+        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
+        let auth = git.auth.as_ref().expect("auth");
+        assert_eq!(auth.secret.as_deref(), Some("pat"));
+        assert_eq!(auth.username.as_deref(), Some("bob"));
+        assert_eq!(
+            t.scan_config
+                .issue_tracker
+                .as_ref()
+                .and_then(|it| it.tracker_type.clone()),
+            Some(TrackerType::Gitea)
+        );
+    }
+
+    #[test]
+    fn standalone_dast_maps_preserving_id_and_live_url() {
+        let d = dast(None, DastTargetType::WebApp);
+        let t = dast_to_standalone_target(&d);
+        assert_eq!(t.id, d.id);
+        assert_eq!(t.target_type, TargetType::WebApp);
+        let url = t.live_url().expect("live url");
+        assert_eq!(url.source_ref, "https://acme.example.com");
+        let web = url.web.as_ref().expect("web config");
+        assert_eq!(web.max_crawl_depth, 5);
+        assert_eq!(
+            url.auth.as_ref().and_then(|a| a.secret.clone()),
+            Some("tok".to_string())
+        );
+    }
+
+    #[test]
+    fn rest_api_dast_maps_to_backend_service() {
+        let d = dast(None, DastTargetType::RestApi);
+        assert_eq!(
+            dast_to_standalone_target(&d).target_type,
+            TargetType::BackendService
+        );
+    }
+
+    #[test]
+    fn fold_adds_live_url_and_promotes_webapp() {
+        let mut t = repo_to_target(&repo());
+        assert_eq!(t.target_type, TargetType::BackendService);
+        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
+        assert_eq!(t.target_type, TargetType::WebApp); // promoted
+        assert!(t.has(ArtifactKind::LiveUrl));
+        assert!(t.has(ArtifactKind::GitRepo));
+    }
+
+    #[test]
+    fn fold_is_idempotent_on_live_url() {
+        let mut t = repo_to_target(&repo());
+        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
+        fold_dast_into_target(&mut t, &d);
+        fold_dast_into_target(&mut t, &d);
+        let live_urls = t
+            .artifacts
+            .iter()
+            .filter(|a| a.kind == ArtifactKind::LiveUrl)
+            .count();
+        assert_eq!(live_urls, 1);
+    }
+}

compliance-agent/src/pentest/cleanup.rs

@@ -328,6 +328,7 @@ mod tests {
             scan_schedule: String::new(),
             cve_monitor_schedule: String::new(),
             git_clone_base_path: String::new(),
+            artifact_store_base_path: String::new(),
             ssh_key_path: String::new(),
             keycloak_url: None,
             keycloak_realm: None,
@@ -341,6 +342,7 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            unified_pipeline: false,
         }
     }
 

compliance-agent/src/pipeline/mod.rs

@@ -8,6 +8,7 @@ mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
+pub mod plan;
 mod pr_review;
 pub mod sbom;
 pub mod semgrep;

compliance-agent/src/pipeline/orchestrator.rs

@@ -15,6 +15,7 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
+use crate::pipeline::plan::build_scan_plan;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
 
@@ -419,6 +420,279 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
+    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
+    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
+    /// `onboarded_targets` and dispatches by the scan plan.
+    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
+    pub async fn run_target(
+        &self,
+        target_id: &str,
+        trigger: ScanTrigger,
+    ) -> Result<(), AgentError> {
+        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
+            .map_err(|e| AgentError::Other(e.to_string()))?;
+        let target = self
+            .db
+            .onboarded_targets()
+            .find_one(doc! { "_id": oid })
+            .await?
+            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
+
+        let scan_run = ScanRun::new(target_id.to_string(), trigger);
+        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
+        let scan_run_id = insert
+            .inserted_id
+            .as_object_id()
+            .map(|id| id.to_hex())
+            .unwrap_or_default();
+
+        let result = self.run_target_pipeline(&target, &scan_run_id).await;
+        match &result {
+            Ok(count) => {
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "completed",
+                            "current_phase": "completed",
+                            "new_findings_count": *count as i64,
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+                // Refresh the target's cached findings count. The shared pipeline
+                // (Stage 7) increments `repositories`, which the unified path does
+                // not use, so set the accurate total on the target itself.
+                let total = self
+                    .db
+                    .findings()
+                    .count_documents(doc! { "repo_id": target_id })
+                    .await
+                    .unwrap_or(*count as u64);
+                self.db
+                    .onboarded_targets()
+                    .update_one(
+                        doc! { "_id": oid },
+                        doc! { "$set": {
+                            "findings_count": total as i64,
+                            "updated_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+            Err(e) => {
+                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "failed",
+                            "error_message": e.to_string(),
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+        }
+        result.map(|_| ())
+    }
+
+    /// Run the applicable scans for a target. For a code target this reuses the
+    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
+    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
+    /// follow-ups (#128/#129/#130). Returns the number of new findings.
+    async fn run_target_pipeline(
+        &self,
+        target: &OnboardedTarget,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
+        let plan = build_scan_plan(target);
+        tracing::info!(
+            target_id = %target_id,
+            target_type = %target.target_type,
+            planned_steps = plan.steps.len(),
+            "Unified pipeline: scan plan built"
+        );
+
+        // Ingest + classify (tramiton for firmware) and store the detected type.
+        self.classify_and_store(target, &target_id, scan_run_id)
+            .await;
+        // Provision a DAST target from a LiveUrl artifact so DAST fires for
+        // wizard-created targets, not just migrated ones.
+        self.ensure_dast_target(target, &plan).await;
+
+        match target.code_artifact() {
+            Some(code) if code.kind == ArtifactKind::GitRepo => {
+                let repo = repo_view_from_target(target, code);
+                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
+                self.finalize_target(target, &repo, new_count).await?;
+                Ok(new_count)
+            }
+            Some(_) => {
+                tracing::warn!(
+                    target_id = %target_id,
+                    "Unified pipeline: source-archive scanning not yet wired; skipping"
+                );
+                Ok(0)
+            }
+            None => {
+                // No code to scan. Firmware/PLC/mobile static scanners land in
+                // #128/#129/#130; DAST for a running URL still works when a
+                // DastTarget row exists (migrated targets).
+                tracing::info!(
+                    target_id = %target_id,
+                    "Unified pipeline: no code artifact; attempting DAST only"
+                );
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+                Ok(0)
+            }
+        }
+    }
+
+    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
+    /// heuristics otherwise), and store the detected classification on the target.
+    /// Best-effort — never fails the scan.
+    async fn classify_and_store(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) {
+        self.update_phase(scan_run_id, "classification").await;
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = match crate::ingest::ingest_all(target, &ctx) {
+            Ok(set) => set,
+            Err(e) => {
+                tracing::warn!(target_id, error = %e, "Unified pipeline: ingest for classification failed");
+                return;
+            }
+        };
+        let working_paths = ingest_set.working_paths();
+        match crate::classify::classify_target(
+            target,
+            &working_paths,
+            &crate::classify::TramitonNative,
+        )
+        .await
+        {
+            Ok(classification) => {
+                tracing::info!(
+                    target_id,
+                    suggested = %classification.suggested,
+                    "Unified pipeline: classified target"
+                );
+                if let (Some(oid), Ok(bson)) = (target.id, mongodb::bson::to_bson(&classification))
+                {
+                    let _ = self
+                        .db
+                        .onboarded_targets()
+                        .update_one(
+                            doc! { "_id": oid },
+                            doc! { "$set": { "classification": bson } },
+                        )
+                        .await;
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
+            }
+        }
+    }
+
+    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
+    /// `DastTarget` (keyed by `repo_id` = target id) so the existing DAST trigger
+    /// fires for wizard-created targets. Idempotent.
+    async fn ensure_dast_target(
+        &self,
+        target: &OnboardedTarget,
+        plan: &crate::pipeline::plan::ScanPlan,
+    ) {
+        if !plan.has(ScanType::Dast) {
+            return;
+        }
+        let (Some(url), Some(oid)) = (target.live_url(), target.id) else {
+            return;
+        };
+        let target_id = oid.to_hex();
+        if self
+            .db
+            .dast_targets()
+            .find_one(doc! { "repo_id": &target_id })
+            .await
+            .ok()
+            .flatten()
+            .is_some()
+        {
+            return; // already provisioned
+        }
+        let kind = url
+            .web
+            .as_ref()
+            .map(|w| w.target_kind.clone())
+            .unwrap_or(DastTargetType::WebApp);
+        let mut dast = DastTarget::new(target.name.clone(), url.source_ref.clone(), kind);
+        dast.repo_id = Some(target_id);
+        if let Some(web) = &url.web {
+            dast.excluded_paths = web.excluded_paths.clone();
+            dast.max_crawl_depth = web.max_crawl_depth;
+            dast.rate_limit = web.rate_limit;
+            dast.allow_destructive = web.allow_destructive;
+        }
+        if let Some(auth) = &url.auth {
+            dast.auth_config = Some(DastAuthConfig {
+                method: auth.method.clone(),
+                login_url: auth.login_url.clone(),
+                username: auth.username.clone(),
+                password: None,
+                token: auth.secret.clone(),
+                headers: auth.headers.clone(),
+            });
+        }
+        if let Err(e) = self.db.dast_targets().insert_one(&dast).await {
+            tracing::warn!(error = %e, "Unified pipeline: failed to provision DAST target");
+        }
+    }
+
+    /// Sync the onboarded-target document after a scan: bump `findings_count`
+    /// and advance the git artifact's `last_scanned_commit` watermark.
+    async fn finalize_target(
+        &self,
+        target: &OnboardedTarget,
+        repo: &TrackedRepository,
+        new_count: u32,
+    ) -> Result<(), AgentError> {
+        let oid = match target.id {
+            Some(id) => id,
+            None => return Ok(()),
+        };
+        self.db
+            .onboarded_targets()
+            .update_one(
+                doc! { "_id": oid },
+                doc! {
+                    "$inc": { "findings_count": new_count as i64 },
+                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
+                },
+            )
+            .await?;
+
+        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
+        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
+            self.db
+                .onboarded_targets()
+                .update_one(
+                    doc! { "_id": oid, "artifacts.id": &code.id },
+                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
+                )
+                .await?;
+        }
+        Ok(())
+    }
+
     pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
             let _ = self
@@ -436,6 +710,37 @@ impl PipelineOrchestrator {
     }
 }
 
+/// Build a legacy `TrackedRepository` view from an onboarded target's code
+/// artifact, so the unified pipeline can reuse the existing repo pipeline. The
+/// inverse of the migration's `repo_to_target`. `_id` is preserved so findings
+/// and DAST lookups resolve against the same key.
+fn repo_view_from_target(target: &OnboardedTarget, code: &Artifact) -> TrackedRepository {
+    let mut repo = TrackedRepository::new(target.name.clone(), code.source_ref.clone());
+    repo.id = target.id;
+    if let Some(git) = &code.git {
+        repo.default_branch = git.default_branch.clone();
+        repo.last_scanned_commit = git.last_scanned_commit.clone();
+        repo.local_path = git.local_path.clone();
+    }
+    if let Some(auth) = &code.auth {
+        repo.auth_token = auth.secret.clone();
+        repo.auth_username = auth.username.clone();
+    }
+    if let Some(it) = &target.scan_config.issue_tracker {
+        repo.tracker_type = it.tracker_type.clone();
+        repo.tracker_owner = it.owner.clone();
+        repo.tracker_repo = it.repo.clone();
+        repo.tracker_token = it.token.clone();
+    }
+    repo.scan_schedule = target.scan_schedule.clone();
+    repo.webhook_enabled = target.webhook_enabled;
+    repo.webhook_secret = target.webhook_secret.clone();
+    repo.findings_count = target.findings_count;
+    repo.created_at = target.created_at;
+    repo.updated_at = target.updated_at;
+    repo
+}
+
 /// Extract the scheme + host from a git URL.
 /// e.g. "https://gitea.example.com/owner/repo.git" -> "https://gitea.example.com"
 /// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" -> "https://gitea.example.com"
@@ -460,3 +765,50 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
         None
     }
 }
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{
+        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
+    };
+
+    #[test]
+    fn repo_view_preserves_id_git_auth_and_tracker() {
+        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
+        target.id = Some(mongodb::bson::oid::ObjectId::new());
+        target.findings_count = 3;
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: Some(TrackerType::Gitea),
+            owner: Some("acme".to_string()),
+            repo: Some("web".to_string()),
+            token: Some("tt".to_string()),
+        });
+
+        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
+        if let Some(git) = artifact.git.as_mut() {
+            git.last_scanned_commit = Some("abc123".to_string());
+        }
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        target.artifacts.push(artifact);
+
+        let code = target.code_artifact().expect("code artifact");
+        let repo = repo_view_from_target(&target, code);
+
+        assert_eq!(repo.id, target.id); // preserved
+        assert_eq!(repo.git_url, "https://git/acme.git");
+        assert_eq!(repo.default_branch, "develop");
+        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
+        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
+        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
+        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
+        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
+        assert_eq!(repo.findings_count, 3);
+    }
+}

compliance-agent/src/pipeline/plan.rs

@@ -0,0 +1,195 @@
+//! The scan plan.
+//!
+//! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
+//! list of scans to run, each bound to the artifact it consumes. It intersects
+//! the scan-applicability matrix ([`applicable_scans`]) with the target's
+//! `scan_config` overrides: a scan runs when its required artifact is present and
+//! it is either on by default or explicitly enabled, and is not explicitly
+//! disabled. This is the decision engine the unified pipeline (`run_target`)
+//! executes.
+
+use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
+use compliance_core::scan_matrix::applicable_scans;
+
+/// One scan to run, bound to the artifact it operates on.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ScanStep {
+    /// The scan to run.
+    pub scan_type: ScanType,
+    /// The pipeline phase to report while it runs.
+    pub phase: ScanPhase,
+    /// The id of the artifact this scan consumes ([`Artifact::id`]).
+    pub artifact_id: String,
+}
+
+/// The ordered set of scans to run for a target.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct ScanPlan {
+    /// The scans, in matrix order.
+    pub steps: Vec<ScanStep>,
+}
+
+impl ScanPlan {
+    /// Whether the plan contains a step for the given scan type.
+    pub fn has(&self, scan: ScanType) -> bool {
+        self.steps.iter().any(|s| s.scan_type == scan)
+    }
+
+    /// Whether the plan is empty (nothing to run).
+    pub fn is_empty(&self) -> bool {
+        self.steps.is_empty()
+    }
+}
+
+/// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
+/// bound to the artifact it consumes. Scans whose required artifact is absent, or
+/// that are disabled, or off-by-default and not explicitly enabled, are dropped.
+pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
+    let enabled = &target.scan_config.enabled_scans;
+    let disabled = &target.scan_config.disabled_scans;
+
+    let mut steps = Vec::new();
+    for option in applicable_scans(target) {
+        // Required artifact missing → not runnable.
+        if option.blocked_reason.is_some() {
+            continue;
+        }
+        // Explicit opt-out wins.
+        if disabled.contains(&option.scan) {
+            continue;
+        }
+        // Run if on by default, or explicitly enabled.
+        if !option.default_on && !enabled.contains(&option.scan) {
+            continue;
+        }
+        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
+            continue;
+        };
+        steps.push(ScanStep {
+            scan_type: option.scan,
+            phase: phase_for(option.scan),
+            artifact_id: artifact.id.clone(),
+        });
+    }
+    ScanPlan { steps }
+}
+
+/// Resolve the artifact a scan consumes. A "code" requirement (represented by
+/// `GitRepo`) is satisfied by a git repo *or* a source archive.
+fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
+    match required {
+        Some(ArtifactKind::GitRepo) => target.code_artifact(),
+        Some(kind) => target.first_of(kind),
+        None => target.code_artifact().or_else(|| target.artifacts.first()),
+    }
+}
+
+/// The pipeline phase reported while a given scan runs.
+fn phase_for(scan: ScanType) -> ScanPhase {
+    match scan {
+        ScanType::Sast => ScanPhase::Sast,
+        ScanType::Sbom => ScanPhase::SbomGeneration,
+        ScanType::Cve => ScanPhase::CveScanning,
+        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
+        ScanType::SecretDetection => ScanPhase::SecretDetection,
+        ScanType::Lint => ScanPhase::LintScanning,
+        ScanType::CodeReview => ScanPhase::CodeReview,
+        ScanType::Graph => ScanPhase::GraphBuilding,
+        ScanType::Dast => ScanPhase::DastScanning,
+        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
+        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
+        ScanType::MobileStatic => ScanPhase::MobileStatic,
+        ScanType::ContainerScan => ScanPhase::ContainerScan,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{PlcFormat, TargetType};
+
+    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("t".to_string(), target_type);
+        t.artifacts = artifacts;
+        t
+    }
+
+    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
+        plan.steps.iter().find(|s| s.scan_type == scan)
+    }
+
+    #[test]
+    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
+        let code = Artifact::git_repo("https://git/x", "main");
+        let url = Artifact::live_url("https://x");
+        let (code_id, url_id) = (code.id.clone(), url.id.clone());
+        let t = target(TargetType::WebApp, vec![code, url]);
+
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, code_id);
+        assert_eq!(sast.phase, ScanPhase::Sast);
+        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
+        assert_eq!(dast.artifact_id, url_id);
+    }
+
+    #[test]
+    fn webapp_without_url_omits_dast() {
+        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.has(ScanType::Sast));
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn code_scan_binds_to_source_archive_when_no_git_repo() {
+        let arc = Artifact::source_archive("src.zip");
+        let arc_id = arc.id.clone();
+        let t = target(TargetType::BackendService, vec![arc]);
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, arc_id);
+    }
+
+    #[test]
+    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
+        let fw = Artifact::firmware_image("fw.bin");
+        let fw_id = fw.id.clone();
+        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
+        let plan = build_scan_plan(&t);
+        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
+        assert_eq!(sbom.artifact_id, fw_id);
+        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn plc_plans_only_control_logic() {
+        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
+        let t = target(TargetType::PlcSps, vec![plc]);
+        let plan = build_scan_plan(&t);
+        assert_eq!(plan.steps.len(), 1);
+        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
+        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
+    }
+
+    #[test]
+    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
+        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        t.scan_config.disabled_scans = vec![ScanType::Lint];
+        // CodeReview is off by default for web; enable it explicitly.
+        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
+        let plan = build_scan_plan(&t);
+        assert!(!plan.has(ScanType::Lint));
+        assert!(plan.has(ScanType::CodeReview));
+        assert!(plan.has(ScanType::Sast));
+    }
+
+    #[test]
+    fn no_code_artifact_yields_empty_plan_for_web() {
+        let t = target(TargetType::WebApp, vec![]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.is_empty());
+    }
+}

compliance-agent/src/scheduler.rs

@@ -288,25 +288,25 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
         None => return,
     };
 
-    let cursor = match db.repositories().find(doc! {}).await {
+    let cursor = match db.onboarded_targets().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list targets for tenant '{tenant_id}': {e}");
             return;
         }
     };
 
-    let repos: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+    let targets: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
 
-    for repo in repos {
-        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+    for target in targets {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
         if let Err(e) = agent
-            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
+            .run_target_scan(tenant_id, &target_id, ScanTrigger::Scheduled)
             .await
         {
             tracing::error!(
                 "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                repo.name
+                target.name
             );
         }
     }

compliance-agent/tests/common/mod.rs

@@ -25,8 +25,9 @@ impl TestServer {
         let mongodb_uri = std::env::var("TEST_MONGODB_URI")
             .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
 
-        // Unique database name per test run to avoid collisions
-        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
+        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
 
         let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await
@@ -44,6 +45,7 @@ impl TestServer {
             scan_schedule: String::new(),
             cve_monitor_schedule: String::new(),
             git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
             ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
             github_token: None,
             github_webhook_secret: None,
@@ -68,6 +70,7 @@ impl TestServer {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            unified_pipeline: false,
         };
 
         let agent = ComplianceAgent::new(config, db_pool);

compliance-agent/tests/integration/api/mod.rs

@@ -2,5 +2,6 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
+mod onboarding;
 mod repositories;
 mod stats;

compliance-agent/tests/integration/api/onboarding.rs

@@ -0,0 +1,115 @@
+use crate::common::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn create_list_and_applicable_scans() {
+    let server = TestServer::start().await;
+
+    // Initially empty.
+    let resp = server.get("/api/v1/targets").await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Create a web-app target with a git repo + a live URL.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "acme-web",
+                "target_type": "web_app",
+                "artifacts": [
+                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
+                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
+                ]
+            }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    assert!(!id.is_empty());
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
+
+    // List returns it.
+    let resp = server.get("/api/v1/targets").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 1);
+
+    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
+    let resp = server
+        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let scans = body["data"]["scans"].as_array().unwrap();
+    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
+    assert!(names.contains(&"sast"));
+    assert!(names.contains(&"dast"));
+    assert_eq!(body["data"]["pentest_supported"], true);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn detect_classifies_a_plc_target() {
+    let server = TestServer::start().await;
+
+    // A PLC project artifact is a strong kind-based signal.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "line-controller",
+                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
+                "artifacts": [
+                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
+                ]
+            }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    let resp = server
+        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn add_artifact_and_delete_target() {
+    let server = TestServer::start().await;
+
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({ "name": "svc", "target_type": "backend_service" }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    // Attach a git repo.
+    let resp = server
+        .post(
+            &format!("/api/v1/targets/{id}/artifacts"),
+            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
+
+    // Delete it.
+    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 200);
+    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 404);
+
+    server.cleanup().await;
+}

compliance-agent/tests/integration/migration.rs

@@ -0,0 +1,156 @@
+// Integration tests for the onboarding backfill migration.
+//
+// Requires MongoDB (set TEST_MONGODB_URI if not at the default).
+// Not run in CI (which is `--lib` only) — run locally:
+//   cargo test -p compliance-agent --test e2e migration
+
+use compliance_agent::database::{Database, DatabasePool};
+use compliance_agent::migrate::onboarding;
+use compliance_core::models::{
+    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
+};
+use mongodb::bson::{doc, Document};
+
+async fn fresh_db() -> (DatabasePool, String, Database) {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
+    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
+    let pool = DatabasePool::connect(&uri, &prefix)
+        .await
+        .expect("connect mongo");
+    let db = pool.for_tenant_id("t1").await.expect("tenant db");
+    (pool, prefix, db)
+}
+
+async fn cleanup(pool: &DatabasePool, prefix: &str) {
+    if let Ok(names) = pool.client().list_database_names().await {
+        for n in names {
+            if n.starts_with(prefix) {
+                pool.client().database(&n).drop().await.ok();
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn backfill_folds_relinks_is_idempotent_and_reversible() {
+    let (pool, prefix, db) = fresh_db().await;
+
+    // Seed a repo.
+    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
+    let repo_id = db
+        .repositories()
+        .insert_one(repo)
+        .await
+        .expect("insert repo")
+        .inserted_id
+        .as_object_id()
+        .expect("repo oid");
+
+    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
+    let mut linked = DastTarget::new(
+        "acme-web".into(),
+        "https://acme.example.com".into(),
+        DastTargetType::WebApp,
+    );
+    linked.repo_id = Some(repo_id.to_hex());
+    let linked_id = db
+        .dast_targets()
+        .insert_one(linked)
+        .await
+        .expect("insert linked dast")
+        .inserted_id
+        .as_object_id()
+        .expect("linked oid");
+
+    // A repo-less DAST target (standalone).
+    let standalone = DastTarget::new(
+        "acme-api".into(),
+        "https://api.acme.com".into(),
+        DastTargetType::RestApi,
+    );
+    let standalone_id = db
+        .dast_targets()
+        .insert_one(standalone)
+        .await
+        .expect("insert standalone dast")
+        .inserted_id
+        .as_object_id()
+        .expect("standalone oid");
+
+    // A DAST scan run pointing at the linked target — should be relinked to the repo.
+    db.collection_named::<Document>("dast_scan_runs")
+        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
+        .await
+        .expect("insert dast run");
+
+    // --- Backfill ---
+    assert!(!onboarding::already_applied(&db).await.unwrap());
+    let report = onboarding::backfill_onboarded_targets(&db, false)
+        .await
+        .expect("backfill");
+    assert_eq!(report.repos_migrated, 1);
+    assert_eq!(report.dast_targets_folded, 1);
+    assert_eq!(report.dast_targets_standalone, 1);
+    assert!(onboarding::already_applied(&db).await.unwrap());
+
+    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
+    let repo_target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": repo_id })
+        .await
+        .unwrap()
+        .expect("repo target");
+    assert!(repo_target.has(ArtifactKind::GitRepo));
+    assert!(repo_target.has(ArtifactKind::LiveUrl));
+    assert_eq!(repo_target.target_type, TargetType::WebApp);
+
+    // Standalone target: preserved _id, live-url, backend service.
+    let standalone_target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": standalone_id })
+        .await
+        .unwrap()
+        .expect("standalone target");
+    assert!(standalone_target.has(ArtifactKind::LiveUrl));
+    assert_eq!(standalone_target.target_type, TargetType::BackendService);
+
+    // The DAST run was relinked from the old dast id to the repo (unified) id.
+    let run = db
+        .collection_named::<Document>("dast_scan_runs")
+        .find_one(doc! {})
+        .await
+        .unwrap()
+        .expect("run");
+    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
+
+    // --- Idempotent: re-run migrates nothing new ---
+    let again = onboarding::backfill_onboarded_targets(&db, false)
+        .await
+        .expect("backfill again");
+    assert_eq!(again.repos_migrated, 0);
+    assert_eq!(again.dast_targets_folded, 0);
+    assert_eq!(again.dast_targets_standalone, 0);
+    assert!(again.skipped_existing >= 2);
+
+    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
+    onboarding::revert(&db).await.expect("revert");
+    assert_eq!(
+        db.onboarded_targets()
+            .count_documents(doc! {})
+            .await
+            .unwrap(),
+        0
+    );
+    let run_after = db
+        .collection_named::<Document>("dast_scan_runs")
+        .find_one(doc! {})
+        .await
+        .unwrap()
+        .expect("run");
+    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
+    assert!(!onboarding::already_applied(&db).await.unwrap());
+
+    cleanup(&pool, &prefix).await;
+}

compliance-agent/tests/integration/mod.rs

@@ -7,3 +7,4 @@
 // Or nightly: (via CI with MongoDB service container)
 
 mod api;
+mod migration;

compliance-core/src/config.rs

@@ -24,6 +24,9 @@ pub struct AgentConfig {
     pub scan_schedule: String,
     pub cve_monitor_schedule: String,
     pub git_clone_base_path: String,
+    /// Base directory for content-addressed artifact blobs and per-run working
+    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
+    pub artifact_store_base_path: String,
     pub ssh_key_path: String,
     pub keycloak_url: Option<String>,
     pub keycloak_realm: Option<String>,
@@ -46,6 +49,11 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
+    /// When true, `run_scan` dispatches to the unified `run_target` pipeline
+    /// (reads `onboarded_targets`) instead of the legacy repository pipeline.
+    /// Env `UNIFIED_PIPELINE`. Defaults on; set `UNIFIED_PIPELINE=0` to use the
+    /// legacy repository pipeline.
+    pub unified_pipeline: bool,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/models/mod.rs

@@ -33,9 +33,10 @@ pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
 pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
 pub use onboarding::{
-    Artifact, ArtifactAuth, ArtifactKind, Classification, DetectedFact, GitArtifactConfig,
-    IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat, TargetScanConfig,
-    TargetType, TargetTypeCandidate, WebArtifactConfig,
+    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
+    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
+    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
+    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,

compliance-core/src/models/onboarding.rs

@@ -22,7 +22,7 @@ use super::scan::ScanType;
 /// Targets look endlessly varied but fall into a small enumerable set classified
 /// by where the analyzable signal lives. This drives the scan-applicability
 /// matrix and the onboarding wizard's type selection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum TargetType {
     /// Browser-facing web application (front end + server).
@@ -411,6 +411,134 @@ pub struct TargetScanConfig {
     pub issue_tracker: Option<IssueTrackerConfig>,
 }
 
+/// A sibling product in the company suite that may already hold authoritative
+/// data for a target. compliance-scanner reconciles with these rather than
+/// recomputing what they already know.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ExternalSystem {
+    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
+    /// attestation).
+    Tramiton,
+    /// Code assistant (downstream remediation consumer).
+    Werkpilot,
+    /// Compliance-controls RAG (atomic controls derived from laws).
+    BreakpilotCompliance,
+}
+
+impl std::fmt::Display for ExternalSystem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Tramiton => write!(f, "tramiton"),
+            Self::Werkpilot => write!(f, "werkpilot"),
+            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
+        }
+    }
+}
+
+/// A link from this target to a record in a sibling product, used to reconcile
+/// existing evidence instead of recomputing it.
+///
+/// For tramiton, `project_id` is the shared cross-product key and
+/// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
+/// (which equals tramiton's `Artifact.sha256`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExternalRef {
+    /// Which sibling product this reference points at.
+    pub system: ExternalSystem,
+    /// The sibling product's project identifier, if known.
+    pub project_id: Option<String>,
+    /// Content digest of the subject artifact (firmware sha256), if known.
+    pub subject_sha256: Option<String>,
+    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
+    #[serde(default)]
+    pub status: String,
+    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
+    /// `LicenseGrant`), if the tenant provided one.
+    pub license_grant: Option<String>,
+    /// When evidence was last reconciled from this system.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_reconciled_at: Option<DateTime<Utc>>,
+}
+
+impl ExternalRef {
+    /// A freshly linked (not yet reconciled) reference to a sibling system.
+    pub fn linked(system: ExternalSystem) -> Self {
+        Self {
+            system,
+            project_id: None,
+            subject_sha256: None,
+            status: "linked".to_string(),
+            license_grant: None,
+            last_reconciled_at: None,
+        }
+    }
+}
+
+/// A regulatory / standards framework a target must comply with. Drives which
+/// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ComplianceFramework {
+    /// EU Cyber Resilience Act.
+    Cra,
+    /// IEC 62443 (industrial automation & control systems security).
+    Iec62443,
+    /// EU General Data Protection Regulation.
+    Gdpr,
+    /// SOC 2.
+    Soc2,
+    /// ISO/IEC 27001.
+    Iso27001,
+    /// EU Radio Equipment Directive (RED) cybersecurity articles.
+    RedDirective,
+}
+
+impl std::fmt::Display for ComplianceFramework {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Cra => write!(f, "cra"),
+            Self::Iec62443 => write!(f, "iec_62443"),
+            Self::Gdpr => write!(f, "gdpr"),
+            Self::Soc2 => write!(f, "soc2"),
+            Self::Iso27001 => write!(f, "iso_27001"),
+            Self::RedDirective => write!(f, "red_directive"),
+        }
+    }
+}
+
+/// The compliance scope of a target: which frameworks apply and, optionally, the
+/// jurisdiction. Captured at onboarding (with per-target-type defaults from
+/// [`default_compliance_profile`]).
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ComplianceProfile {
+    /// Applicable frameworks.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
+    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
+    pub jurisdiction: Option<String>,
+}
+
+/// The sensible default compliance scope for a target type. Firmware / PLC /
+/// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
+pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
+    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
+    let frameworks = match target_type {
+        TargetType::PlcSps
+        | TargetType::FirmwareBareMetal
+        | TargetType::FirmwareRtos
+        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
+        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
+        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
+            vec![Gdpr, Cra]
+        }
+    };
+    ComplianceProfile {
+        frameworks,
+        jurisdiction: None,
+    }
+}
+
 /// A target onboarded for scanning: the unified replacement for the legacy
 /// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -434,6 +562,12 @@ pub struct OnboardedTarget {
     /// How this target should be scanned.
     #[serde(default)]
     pub scan_config: TargetScanConfig,
+    /// The compliance scope (applicable frameworks / jurisdiction).
+    #[serde(default)]
+    pub compliance_profile: ComplianceProfile,
+    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
+    #[serde(default)]
+    pub external_refs: Vec<ExternalRef>,
     /// Cron schedule for recurring scans, if any.
     pub scan_schedule: Option<String>,
     /// Whether inbound webhooks are enabled for this target.
@@ -472,6 +606,8 @@ impl OnboardedTarget {
             artifacts: Vec::new(),
             classification: None,
             scan_config: TargetScanConfig::default(),
+            compliance_profile: default_compliance_profile(target_type),
+            external_refs: Vec::new(),
             scan_schedule: None,
             webhook_enabled: false,
             webhook_secret: Some(webhook_secret),
@@ -584,4 +720,34 @@ mod tests {
         let b = Artifact::firmware_image("fw.bin");
         assert_ne!(a.id, b.id);
     }
+
+    #[test]
+    fn firmware_default_profile_is_cra_and_62443() {
+        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
+        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
+        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
+    }
+
+    #[test]
+    fn webapp_default_profile_is_gdpr_and_soc2() {
+        let p = default_compliance_profile(TargetType::WebApp);
+        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
+        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
+    }
+
+    #[test]
+    fn new_target_gets_default_profile_and_no_external_refs() {
+        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
+        assert!(!t.compliance_profile.frameworks.is_empty());
+        assert!(t.external_refs.is_empty());
+    }
+
+    #[test]
+    fn external_ref_linked_defaults() {
+        let r = ExternalRef::linked(ExternalSystem::Tramiton);
+        assert_eq!(r.system, ExternalSystem::Tramiton);
+        assert_eq!(r.status, "linked");
+        assert!(r.project_id.is_none());
+        assert!(r.last_reconciled_at.is_none());
+    }
 }

compliance-core/src/traits/controls.rs

@@ -0,0 +1,45 @@
+//! The compliance-controls provider port.
+//!
+//! The mapping engine turns findings into compliance status against a corpus of
+//! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
+//! a tenant-owned RAG of atomic controls derived from laws
+//! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
+//! source so the mapping engine does not hardcode a catalog.
+
+use crate::error::CoreError;
+use crate::models::ComplianceFramework;
+
+/// A control retrieved from a controls corpus.
+#[derive(Debug, Clone)]
+pub struct Control {
+    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
+    pub id: String,
+    /// The framework this control belongs to.
+    pub framework: ComplianceFramework,
+    /// Short human-readable title.
+    pub title: String,
+    /// The control text / requirement.
+    pub text: String,
+    /// Free-form source reference (catalog name, law citation, ...).
+    pub source: Option<String>,
+}
+
+/// A query for relevant controls.
+pub struct ControlQuery<'a> {
+    /// Frameworks in scope for the target.
+    pub frameworks: &'a [ComplianceFramework],
+    /// Free-text describing what to map (a finding summary, a component, ...).
+    pub context: &'a str,
+    /// Maximum number of controls to return.
+    pub limit: usize,
+}
+
+/// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
+#[allow(async_fn_in_trait)]
+pub trait ControlsProvider: Send + Sync {
+    /// Stable identifier for this provider.
+    fn name(&self) -> &str;
+
+    /// Retrieve the controls most relevant to the query.
+    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
+}

compliance-core/src/traits/evidence.rs

@@ -0,0 +1,58 @@
+//! The external-evidence provider port.
+//!
+//! A sibling product (tramiton, for firmware) may already hold authoritative
+//! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
+//! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
+//! reproducible-build lock, an attestation — instead of recomputing it. The key
+//! used to match is the artifact content digest (a firmware sha256, which equals
+//! [`crate::models::Artifact::content_hash`]).
+//!
+//! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
+//! client later) plus a deterministic mock for tests, so nothing here depends on
+//! an external binary.
+
+use std::path::Path;
+
+use crate::error::CoreError;
+use crate::models::{Artifact, ExternalSystem};
+
+/// A single reconcilable evidence document fetched from a sibling product.
+#[derive(Debug, Clone)]
+pub struct EvidenceDocument {
+    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
+    pub kind: String,
+    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
+    pub format: String,
+    /// The raw document payload.
+    pub content: String,
+}
+
+/// The evidence a provider could return for a target's artifact.
+#[derive(Debug, Clone, Default)]
+pub struct ReconciledEvidence {
+    /// The sibling's project identifier, if resolved.
+    pub project_id: Option<String>,
+    /// The subject content digest the evidence pertains to.
+    pub subject_sha256: Option<String>,
+    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
+    pub documents: Vec<EvidenceDocument>,
+}
+
+/// A source of externally-held, reconcilable evidence for an artifact.
+#[allow(async_fn_in_trait)]
+pub trait EvidenceProvider: Send + Sync {
+    /// Which sibling product this provider integrates.
+    fn system(&self) -> ExternalSystem;
+
+    /// Whether this provider can handle the given artifact + working path
+    /// (e.g. tramiton handles firmware images / embedded source trees).
+    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
+
+    /// Reconcile existing evidence for the artifact, keyed by its content digest.
+    /// Returns `Ok(None)` when the provider has nothing for this artifact.
+    async fn reconcile(
+        &self,
+        artifact: &Artifact,
+        working_path: Option<&Path>,
+    ) -> Result<Option<ReconciledEvidence>, CoreError>;
+}

compliance-core/src/traits/mod.rs

@@ -1,12 +1,16 @@
 pub mod classifier;
+pub mod controls;
 pub mod dast_agent;
+pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;
 
 pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
+pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};

compliance-dashboard/src/app.rs

@@ -12,6 +12,10 @@ pub enum Route {
         OverviewPage {},
         #[route("/repositories")]
         RepositoriesPage {},
+        #[route("/targets")]
+        TargetsPage {},
+        #[route("/onboard")]
+        OnboardingPage {},
         #[route("/findings")]
         FindingsPage {},
         #[route("/findings/:id")]

compliance-dashboard/src/components/sidebar.rs

@@ -24,10 +24,15 @@ pub fn Sidebar() -> Element {
             icon: rsx! { Icon { icon: BsSpeedometer2, width: 18, height: 18 } },
         },
         NavItem {
-            label: "Repositories",
-            route: Route::RepositoriesPage {},
+            label: "Targets",
+            route: Route::TargetsPage {},
             icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
         },
+        NavItem {
+            label: "Onboard",
+            route: Route::OnboardingPage {},
+            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
+        },
         NavItem {
             label: "Findings",
             route: Route::FindingsPage {},

compliance-dashboard/src/infrastructure/mod.rs

@@ -10,6 +10,7 @@ pub mod issues;
 pub mod mcp;
 pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -0,0 +1,139 @@
+//! Server functions for the onboarding wizard — proxy to the agent's
+//! `/api/v1/targets` endpoints.
+
+use dioxus::prelude::*;
+use serde::{Deserialize, Serialize};
+
+/// One artifact the wizard collects for a target.
+#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
+pub struct ArtifactInputDto {
+    pub kind: String,
+    pub source_ref: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plc_format: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TargetsResponse {
+    pub data: Vec<serde_json::Value>,
+    pub total: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TargetResponse {
+    pub data: serde_json::Value,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ApplicableScansData {
+    #[serde(default)]
+    pub scans: Vec<serde_json::Value>,
+    #[serde(default)]
+    pub pentest_supported: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ApplicableScansResponse {
+    pub data: ApplicableScansData,
+}
+
+/// List onboarded targets.
+#[server]
+pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get("/api/v1/targets")
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Create a target with the collected artifacts.
+#[server]
+pub async fn create_target(
+    name: String,
+    target_type: String,
+    description: Option<String>,
+    artifacts: Vec<ArtifactInputDto>,
+) -> Result<TargetResponse, ServerFnError> {
+    let body = serde_json::json!({
+        "name": name,
+        "target_type": target_type,
+        "description": description,
+        "artifacts": artifacts,
+    });
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
+        .await?
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Run kind-based classification on a target.
+#[server]
+pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/detect"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Fetch the scan-applicability matrix for a target.
+#[server]
+pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Delete a target (and cascade its findings / SBOM / scan runs / CVE alerts).
+#[server]
+pub async fn delete_target(id: String) -> Result<serde_json::Value, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::DELETE,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Trigger a scan for a target.
+#[server]
+pub async fn trigger_target_scan(id: String) -> Result<serde_json::Value, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/scan"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}

compliance-dashboard/src/pages/findings.rs

@@ -20,7 +20,7 @@ pub fn FindingsPage() -> Element {
     let mut selected_ids = use_signal(Vec::<String>::new);
 
     let repos = use_resource(|| async {
-        crate::infrastructure::repositories::fetch_repositories(1)
+        crate::infrastructure::onboarding::fetch_targets()
             .await
             .ok()
     });
@@ -86,14 +86,14 @@ pub fn FindingsPage() -> Element {
             }
             select {
                 onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                option { value: "", "All Repositories" }
+                option { value: "", "All Targets" }
                 {
                     match &*repos.read() {
                         Some(Some(resp)) => rsx! {
-                            for repo in &resp.data {
+                            for t in &resp.data {
                                 {
-                                    let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
+                                    let id = t.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = t.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                     rsx! {
                                         option { value: "{id}", "{name}" }
                                     }

compliance-dashboard/src/pages/mod.rs

@@ -12,11 +12,13 @@ pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
 pub mod mcp_tokens;
+pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
 pub mod repositories;
 pub mod sbom;
+pub mod targets;
 
 pub use chat::ChatPage;
 pub use chat_index::ChatIndexPage;
@@ -32,8 +34,10 @@ pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
 pub use mcp_tokens::McpTokensPage;
+pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
 pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
+pub use targets::TargetsPage;

compliance-dashboard/src/pages/onboarding.rs

@@ -0,0 +1,402 @@
+use dioxus::prelude::*;
+
+use crate::components::page_header::PageHeader;
+use crate::infrastructure::onboarding::{
+    create_target, detect_target, fetch_applicable_scans, trigger_target_scan, ArtifactInputDto,
+};
+
+/// (value, label, one-line description) for the 9 target families.
+const TARGET_TYPES: &[(&str, &str, &str)] = &[
+    ("web_app", "Web Application", "Front end + server"),
+    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
+    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
+    ("android_app", "Android App", "APK / AAB"),
+    ("ios_app", "iOS App", "IPA"),
+    (
+        "firmware_bare_metal",
+        "Firmware — bare metal",
+        "No operating system",
+    ),
+    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
+    (
+        "embedded_linux_yocto",
+        "Embedded Linux / Yocto",
+        "BSP + image",
+    ),
+    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
+];
+
+/// (value, label) for the artifact kinds a user can attach.
+const ARTIFACT_KINDS: &[(&str, &str)] = &[
+    ("git_repo", "Git repository"),
+    ("source_archive", "Source archive (zip)"),
+    ("firmware_image", "Firmware image"),
+    ("mobile_package", "Mobile package (APK/IPA)"),
+    ("container_image", "Container image"),
+    ("live_url", "Live URL"),
+    ("plc_project", "PLC project"),
+    ("plaintext_description", "Description (text)"),
+];
+
+const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
+
+/// One row in the applicable-scans list on the success step.
+#[component]
+fn ScanRow(scan: serde_json::Value) -> Element {
+    let name = scan
+        .get("scan")
+        .and_then(|v| v.as_str())
+        .unwrap_or("?")
+        .to_string();
+    let rationale = scan
+        .get("rationale")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+    let blocked = scan
+        .get("blocked_reason")
+        .and_then(|v| v.as_str())
+        .map(String::from);
+    let default_on = scan
+        .get("default_on")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let badge_class = if blocked.is_some() {
+        "badge badge-info"
+    } else if default_on {
+        "badge badge-success"
+    } else {
+        "badge"
+    };
+    rsx! {
+        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
+            span { class: "{badge_class}", "{name}" }
+            span { style: "opacity: 0.8;", "{rationale}" }
+            if let Some(b) = blocked {
+                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
+            }
+        }
+    }
+}
+
+fn kind_label(kind: &str) -> &str {
+    ARTIFACT_KINDS
+        .iter()
+        .find(|(v, _)| *v == kind)
+        .map(|(_, l)| *l)
+        .unwrap_or(kind)
+}
+
+fn type_label(value: &str) -> &str {
+    TARGET_TYPES
+        .iter()
+        .find(|(v, _, _)| *v == value)
+        .map(|(_, l, _)| *l)
+        .unwrap_or(value)
+}
+
+#[component]
+pub fn OnboardingPage() -> Element {
+    let mut step = use_signal(|| 0usize);
+    let mut name = use_signal(String::new);
+    let mut target_type = use_signal(String::new);
+    let mut description = use_signal(String::new);
+    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
+
+    // "Add artifact" mini-form.
+    let mut new_kind = use_signal(|| "git_repo".to_string());
+    let mut new_source = use_signal(String::new);
+    let mut new_branch = use_signal(|| "main".to_string());
+
+    // Create + result state.
+    let mut creating = use_signal(|| false);
+    let mut error = use_signal(|| Option::<String>::None);
+    let mut scans = use_signal(Vec::<serde_json::Value>::new);
+    let mut suggested = use_signal(|| Option::<String>::None);
+    let mut created_id = use_signal(|| Option::<String>::None);
+    let mut scan_msg = use_signal(|| Option::<String>::None);
+
+    let step_now = step();
+    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
+    let has_artifacts = !artifacts().is_empty();
+
+    rsx! {
+        PageHeader {
+            title: "Onboard a target",
+            description: "Add a target, attach its artifacts, and see which scans apply.",
+        }
+
+        // Stepper.
+        div { class: "wizard-steps",
+            for (i, label) in STEP_LABELS.iter().enumerate() {
+                div {
+                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
+                    span { class: "wizard-step-dot", "{i + 1}" }
+                    span { class: "wizard-step-label", "{label}" }
+                }
+            }
+        }
+
+        if let Some(err) = error() {
+            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
+                div { class: "card-header", "Error" }
+                div { style: "padding: 12px;", "{err}" }
+            }
+        }
+
+        div { class: "card",
+            // ---- Step 0: target type + name ----
+            if step_now == 0 {
+                div { class: "card-header", "What kind of software is this?" }
+                div { style: "padding: 16px;",
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            placeholder: "acme-web",
+                            value: "{name}",
+                            oninput: move |e| name.set(e.value()),
+                        }
+                    }
+                    div {
+                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
+                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
+                            div {
+                                class: "card",
+                                style: if target_type() == value {
+                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
+                                } else {
+                                    "padding: 12px; cursor: pointer;"
+                                },
+                                onclick: move |_| target_type.set(value.to_string()),
+                                div { style: "font-weight: 600;", "{tlabel}" }
+                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
+                            }
+                        }
+                    }
+                }
+            }
+
+            // ---- Step 1: artifacts ----
+            if step_now == 1 {
+                div { class: "card-header", "Attach artifacts" }
+                div { style: "padding: 16px;",
+                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
+                        div { class: "form-group", style: "margin: 0;",
+                            label { "Kind" }
+                            select {
+                                value: "{new_kind}",
+                                oninput: move |e| new_kind.set(e.value()),
+                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
+                                    option { value: "{value}", "{klabel}" }
+                                }
+                            }
+                        }
+                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                            label { "Reference (URL / path / text)" }
+                            input {
+                                r#type: "text",
+                                placeholder: "https://git.example.com/acme.git",
+                                value: "{new_source}",
+                                oninput: move |e| new_source.set(e.value()),
+                            }
+                        }
+                        if new_kind() == "git_repo" {
+                            div { class: "form-group", style: "margin: 0;",
+                                label { "Branch" }
+                                input {
+                                    r#type: "text",
+                                    value: "{new_branch}",
+                                    oninput: move |e| new_branch.set(e.value()),
+                                }
+                            }
+                        }
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| {
+                                let kind = new_kind();
+                                if !new_source().trim().is_empty() {
+                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
+                                    artifacts.write().push(ArtifactInputDto {
+                                        kind,
+                                        source_ref: new_source(),
+                                        branch,
+                                        plc_format: None,
+                                    });
+                                    new_source.set(String::new());
+                                }
+                            },
+                            "+ Add"
+                        }
+                    }
+
+                    div { style: "margin-top: 16px;",
+                        if has_artifacts {
+                            for (i, a) in artifacts().iter().enumerate() {
+                                div {
+                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
+                                    span {
+                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
+                                        "{a.source_ref}"
+                                    }
+                                    button {
+                                        class: "btn btn-ghost-danger btn-sm",
+                                        onclick: move |_| { artifacts.write().remove(i); },
+                                        "Remove"
+                                    }
+                                }
+                            }
+                        } else {
+                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
+                        }
+                    }
+                }
+            }
+
+            // ---- Step 2: review + create ----
+            if step_now == 2 {
+                div { class: "card-header", "Review" }
+                div { style: "padding: 16px;",
+                    div { class: "wizard-summary",
+                        div { strong { "Name: " } "{name()}" }
+                        div { strong { "Type: " } "{type_label(&target_type())}" }
+                        div { strong { "Artifacts:" } }
+                        ul {
+                            for a in artifacts() {
+                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
+                            }
+                        }
+                    }
+                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
+                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
+                    }
+                }
+            }
+
+            // ---- Step 3: created ----
+            if step_now == 3 {
+                div { class: "card-header", "Target onboarded" }
+                div { style: "padding: 16px;",
+                    p {
+                        strong { "{name()}" }
+                        " was created."
+                        if let Some(s) = suggested() {
+                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
+                        }
+                    }
+                    h4 { style: "margin-top: 16px;", "Applicable scans" }
+                    if scans().is_empty() {
+                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
+                    } else {
+                        for s in scans() {
+                            ScanRow { scan: s }
+                        }
+                    }
+                    if let Some(msg) = scan_msg() {
+                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
+                    }
+                    div { style: "margin-top: 16px; display: flex; gap: 8px;",
+                        button {
+                            class: "btn btn-primary",
+                            onclick: move |_| {
+                                if let Some(id) = created_id() {
+                                    scan_msg.set(Some("Scan triggered...".to_string()));
+                                    spawn(async move {
+                                        match trigger_target_scan(id).await {
+                                            Ok(_) => scan_msg.set(Some(
+                                                "Scan started — findings will appear as it runs.".to_string(),
+                                            )),
+                                            Err(e) => scan_msg.set(Some(format!("Failed to start scan: {e}"))),
+                                        }
+                                    });
+                                }
+                            },
+                            "Run scan"
+                        }
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| {
+                                step.set(0);
+                                name.set(String::new());
+                                target_type.set(String::new());
+                                description.set(String::new());
+                                artifacts.write().clear();
+                                scans.write().clear();
+                                suggested.set(None);
+                                created_id.set(None);
+                                scan_msg.set(None);
+                                error.set(None);
+                            },
+                            "Onboard another"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ---- Footer navigation ----
+        if step_now < 3 {
+            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
+                button {
+                    class: "btn btn-back",
+                    disabled: step_now == 0,
+                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
+                    "Back"
+                }
+                if step_now < 2 {
+                    button {
+                        class: "btn btn-primary",
+                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
+                        onclick: move |_| step.set(step() + 1),
+                        "Next"
+                    }
+                } else {
+                    button {
+                        class: "btn btn-primary",
+                        disabled: creating(),
+                        onclick: move |_| {
+                            let n = name();
+                            let tt = target_type();
+                            let desc = description();
+                            let arts = artifacts();
+                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
+                            creating.set(true);
+                            error.set(None);
+                            spawn(async move {
+                                match create_target(n, tt, d, arts).await {
+                                    Ok(resp) => {
+                                        let id = resp
+                                            .data
+                                            .get("_id")
+                                            .and_then(|o| o.get("$oid"))
+                                            .and_then(|s| s.as_str())
+                                            .map(String::from);
+                                        if let Some(id) = id {
+                                            created_id.set(Some(id.clone()));
+                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
+                                                scans.set(sc.data.scans);
+                                            }
+                                            if let Ok(det) = detect_target(id).await {
+                                                suggested.set(
+                                                    det.data
+                                                        .get("classification")
+                                                        .and_then(|c| c.get("suggested"))
+                                                        .and_then(|s| s.as_str())
+                                                        .map(String::from),
+                                                );
+                                            }
+                                        }
+                                        step.set(3);
+                                    }
+                                    Err(e) => error.set(Some(e.to_string())),
+                                }
+                                creating.set(false);
+                            });
+                        },
+                        if creating() { "Creating..." } else { "Create target" }
+                    }
+                }
+            }
+        }
+    }
+}

compliance-dashboard/src/pages/repositories.rs

@@ -23,20 +23,6 @@ async fn async_sleep_5s() {
 #[component]
 pub fn RepositoriesPage() -> Element {
     let mut page = use_signal(|| 1u64);
-    let mut show_add_form = use_signal(|| false);
-    let mut name = use_signal(String::new);
-    let mut git_url = use_signal(String::new);
-    let mut branch = use_signal(|| "main".to_string());
-    let mut auth_token = use_signal(String::new);
-    let mut auth_username = use_signal(String::new);
-    let mut show_auth = use_signal(|| false);
-    let mut ssh_public_key = use_signal(String::new);
-    let mut show_tracker = use_signal(|| false);
-    let mut tracker_type_val = use_signal(String::new);
-    let mut tracker_owner_val = use_signal(String::new);
-    let mut tracker_repo_val = use_signal(String::new);
-    let mut tracker_token_val = use_signal(String::new);
-    let mut adding = use_signal(|| false);
     let mut toasts = use_context::<Toasts>();
     let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
     let mut edit_repo_id = use_signal(|| Option::<String>::None);
@@ -64,222 +50,7 @@ pub fn RepositoriesPage() -> Element {
     rsx! {
         PageHeader {
             title: "Repositories",
-            description: "Tracked git repositories",
-        }
-
-        div { style: "margin-bottom: 16px;",
-            button {
-                class: "btn btn-primary",
-                onclick: move |_| show_add_form.toggle(),
-                if show_add_form() { "Cancel" } else { "+ Add Repository" }
-            }
-        }
-
-        if show_add_form() {
-            div { class: "card",
-                div { class: "card-header", "Add Repository" }
-                div { class: "form-group",
-                    label { "Name" }
-                    input {
-                        r#type: "text",
-                        placeholder: "my-project",
-                        value: "{name}",
-                        oninput: move |e| name.set(e.value()),
-                    }
-                }
-                div { class: "form-group",
-                    label { "Git URL" }
-                    input {
-                        r#type: "text",
-                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
-                        value: "{git_url}",
-                        oninput: move |e| git_url.set(e.value()),
-                    }
-                }
-                div { class: "form-group",
-                    label { "Default Branch" }
-                    input {
-                        r#type: "text",
-                        placeholder: "main",
-                        value: "{branch}",
-                        oninput: move |e| branch.set(e.value()),
-                    }
-                }
-
-                // Private repo auth section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| {
-                            let opening = !show_auth();
-                            show_auth.toggle();
-                            if opening {
-                                // Fetch SSH key every time the section opens
-                                ssh_public_key.set(String::new());
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
-                                        Ok(key) => ssh_public_key.set(key),
-                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
-                                    }
-                                });
-                            }
-                        },
-                        if show_auth() { "Hide auth options" } else { "Private repository?" }
-                    }
-                }
-
-                if show_auth() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        // SSH deploy key display
-                        div { style: "margin-bottom: 12px;",
-                            label { style: "font-size: 12px; color: var(--text-secondary);",
-                                "For SSH URLs: add this deploy key (read-only) to your repository"
-                            }
-                            div {
-                                class: "copyable",
-                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px;",
-                                code {
-                                    style: "font-size: 11px; word-break: break-all; user-select: all;",
-                                    if ssh_public_key().is_empty() {
-                                        "Loading..."
-                                    } else {
-                                        "{ssh_public_key}"
-                                    }
-                                }
-                                if !ssh_public_key().is_empty() {
-                                    crate::components::copy_button::CopyButton { value: ssh_public_key(), small: true }
-                                }
-                            }
-                        }
-
-                        // HTTPS auth fields
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "For HTTPS URLs: provide an access token (PAT) or username/password"
-                        }
-                        div { class: "form-group",
-                            label { "Auth Token / Password" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx or personal access token",
-                                value: "{auth_token}",
-                                oninput: move |e| auth_token.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Username (optional, defaults to x-access-token)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "x-access-token",
-                                value: "{auth_username}",
-                                oninput: move |e| auth_username.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
-                // Issue tracker config section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| show_tracker.toggle(),
-                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
-                    }
-                }
-
-                if show_tracker() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "Configure an issue tracker to auto-create issues from findings"
-                        }
-                        div { class: "form-group",
-                            label { "Tracker Type" }
-                            select {
-                                value: "{tracker_type_val}",
-                                onchange: move |e| tracker_type_val.set(e.value()),
-                                option { value: "", "None" }
-                                option { value: "github", "GitHub" }
-                                option { value: "gitlab", "GitLab" }
-                                option { value: "gitea", "Gitea" }
-                                option { value: "jira", "Jira" }
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Owner / Namespace" }
-                            input {
-                                r#type: "text",
-                                placeholder: "org-name",
-                                value: "{tracker_owner_val}",
-                                oninput: move |e| tracker_owner_val.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Repository / Project" }
-                            input {
-                                r#type: "text",
-                                placeholder: "repo-name",
-                                value: "{tracker_repo_val}",
-                                oninput: move |e| tracker_repo_val.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Tracker Token (PAT)" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx / glpat-xxxx",
-                                value: "{tracker_token_val}",
-                                oninput: move |e| tracker_token_val.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
-                button {
-                    class: "btn btn-primary",
-                    disabled: adding(),
-                    onclick: move |_| {
-                        let n = name();
-                        let u = git_url();
-                        let b = branch();
-                        let tok = {
-                            let v = auth_token();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let usr = {
-                            let v = auth_username();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
-                        adding.set(true);
-                        spawn(async move {
-                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
-                                Ok(_) => {
-                                    toasts.push(ToastType::Success, "Repository added");
-                                    repos.restart();
-                                }
-                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                            }
-                            adding.set(false);
-                        });
-                        show_add_form.set(false);
-                        show_auth.set(false);
-                        show_tracker.set(false);
-                        name.set(String::new());
-                        git_url.set(String::new());
-                        auth_token.set(String::new());
-                        auth_username.set(String::new());
-                        tracker_type_val.set(String::new());
-                        tracker_owner_val.set(String::new());
-                        tracker_repo_val.set(String::new());
-                        tracker_token_val.set(String::new());
-                    },
-                    if adding() { "Validating..." } else { "Add" }
-                }
-            }
+            description: "Legacy git repositories. Onboard new targets from Targets / Onboard.",
         }
 
         // ── Delete confirmation dialog ──

compliance-dashboard/src/pages/sbom.rs

@@ -28,9 +28,9 @@ pub fn SbomPage() -> Element {
     let mut diff_repo_a = use_signal(String::new);
     let mut diff_repo_b = use_signal(String::new);
 
-    // ── Repos for dropdowns ──
+    // ── Targets for dropdowns ──
     let repos = use_resource(|| async {
-        crate::infrastructure::repositories::fetch_repositories(1)
+        crate::infrastructure::onboarding::fetch_targets()
             .await
             .ok()
     });
@@ -114,14 +114,14 @@ pub fn SbomPage() -> Element {
                 select {
                     class: "sbom-filter-select",
                     onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                    option { value: "", "All Repositories" }
+                    option { value: "", "All Targets" }
                     {
                         match &*repos.read() {
                             Some(Some(resp)) => rsx! {
                                 for repo in &resp.data {
                                     {
-                                        let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                        let name = repo.name.clone();
+                                        let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                        let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                         rsx! { option { value: "{id}", "{name}" } }
                                     }
                                 }
@@ -476,8 +476,8 @@ pub fn SbomPage() -> Element {
                                     Some(Some(resp)) => rsx! {
                                         for repo in &resp.data {
                                             {
-                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                 rsx! { option { value: "{id}", "{name}" } }
                                             }
                                         }
@@ -498,8 +498,8 @@ pub fn SbomPage() -> Element {
                                     Some(Some(resp)) => rsx! {
                                         for repo in &resp.data {
                                             {
-                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                 rsx! { option { value: "{id}", "{name}" } }
                                             }
                                         }

compliance-dashboard/src/pages/targets.rs

@@ -0,0 +1,339 @@
+//! Targets page — lists onboarded targets (the unified `OnboardedTarget`
+//! records the wizard creates) and lets the user run a scan, inspect the
+//! classification / applicable scans, or delete a target.
+//!
+//! Creation lives in the Onboard wizard (`/onboard`); this page is the
+//! "where is my target, and what did the scan find" surface.
+
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+use dioxus_free_icons::Icon;
+
+use crate::components::page_header::PageHeader;
+use crate::components::toast::{ToastType, Toasts};
+use crate::infrastructure::onboarding::{
+    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan,
+};
+
+/// Prettify a snake_case target-type value into a human label.
+fn pretty_type(v: &str) -> String {
+    match v {
+        "web_app" => "Web Application".into(),
+        "backend_service" => "Backend / API".into(),
+        "desktop_app" => "Desktop App".into(),
+        "android_app" => "Android App".into(),
+        "ios_app" => "iOS App".into(),
+        "firmware_bare_metal" => "Firmware — bare metal".into(),
+        "firmware_rtos" => "Firmware — RTOS".into(),
+        "embedded_linux_yocto" => "Embedded Linux / Yocto".into(),
+        "plc_sps" => "PLC / SPS".into(),
+        other => other.replace('_', " "),
+    }
+}
+
+fn str_at<'a>(v: &'a serde_json::Value, key: &str) -> &'a str {
+    v.get(key).and_then(|x| x.as_str()).unwrap_or("")
+}
+
+fn target_id(t: &serde_json::Value) -> String {
+    t.get("_id")
+        .and_then(|o| o.get("$oid"))
+        .and_then(|s| s.as_str())
+        .unwrap_or_default()
+        .to_string()
+}
+
+/// The applicable-scans matrix for one target, fetched on expand.
+#[component]
+fn TargetScans(id: String) -> Element {
+    let scan_id = id.clone();
+    let scans = use_resource(move || {
+        let id = scan_id.clone();
+        async move { fetch_applicable_scans(id).await.ok() }
+    });
+
+    let snapshot = scans.read().clone();
+    match &snapshot {
+        Some(Some(resp)) => {
+            let rows = resp.data.scans.clone();
+            let pentest = resp.data.pentest_supported;
+            rsx! {
+                div { style: "margin-top: 8px;",
+                    if rows.is_empty() {
+                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
+                    }
+                    for s in rows {
+                        {
+                            let name = str_at(&s, "scan").to_string();
+                            let rationale = str_at(&s, "rationale").to_string();
+                            let blocked = s.get("blocked_reason").and_then(|b| b.as_str()).map(String::from);
+                            let default_on = s.get("default_on").and_then(|b| b.as_bool()).unwrap_or(false);
+                            let badge = if blocked.is_some() {
+                                "badge badge-info"
+                            } else if default_on {
+                                "badge badge-success"
+                            } else {
+                                "badge"
+                            };
+                            rsx! {
+                                div { style: "display: flex; gap: 8px; align-items: center; padding: 4px 0;",
+                                    span { class: "{badge}", "{name}" }
+                                    span { style: "opacity: 0.8; font-size: 0.9em;", "{rationale}" }
+                                    if let Some(b) = blocked {
+                                        span { style: "opacity: 0.6; font-style: italic; font-size: 0.9em;", "— {b}" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if pentest {
+                        div { style: "margin-top: 6px; opacity: 0.75; font-size: 0.85em;",
+                            "Active pentest is supported for this target type."
+                        }
+                    }
+                }
+            }
+        }
+        Some(None) => rsx! { div { style: "opacity: 0.6;", "Failed to load applicable scans." } },
+        None => rsx! { div { style: "opacity: 0.6;", "Loading scans..." } },
+    }
+}
+
+#[component]
+pub fn TargetsPage() -> Element {
+    let mut toasts = use_context::<Toasts>();
+    let mut scanning_ids = use_signal(Vec::<String>::new);
+    let mut expanded_ids = use_signal(Vec::<String>::new);
+    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
+
+    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
+
+    rsx! {
+        PageHeader {
+            title: "Targets",
+            description: "Onboarded targets and what their scans found. Add new targets from Onboard.",
+        }
+
+        div { style: "margin-bottom: 16px; display: flex; gap: 8px;",
+            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
+                "+ Onboard a target"
+            }
+            button {
+                class: "btn btn-secondary",
+                onclick: move |_| targets.restart(),
+                "Refresh"
+            }
+        }
+
+        // ── Delete confirmation ──
+        if let Some((del_id, del_name)) = confirm_delete() {
+            div { class: "modal-overlay",
+                div { class: "modal-dialog",
+                    h3 { "Delete Target" }
+                    p { "Delete " strong { "{del_name}" } "?" }
+                    p { class: "modal-warning",
+                        "This permanently removes the target and its findings, SBOM entries, scan runs, and CVE alerts."
+                    }
+                    div { class: "modal-actions",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| confirm_delete.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-danger",
+                            onclick: move |_| {
+                                let id = del_id.clone();
+                                let name = del_name.clone();
+                                confirm_delete.set(None);
+                                spawn(async move {
+                                    match delete_target(id).await {
+                                        Ok(_) => {
+                                            toasts.push(ToastType::Success, format!("{name} deleted"));
+                                            targets.restart();
+                                        }
+                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                    }
+                                });
+                            },
+                            "Delete"
+                        }
+                    }
+                }
+            }
+        }
+
+        {
+        let targets_snapshot = targets.read().clone();
+        match &targets_snapshot {
+            Some(Some(resp)) => {
+                let rows = resp.data.clone();
+                if rows.is_empty() {
+                    rsx! {
+                        div { class: "card", style: "padding: 24px; text-align: center;",
+                            p { style: "opacity: 0.7;", "No targets yet." }
+                            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
+                                "Onboard your first target"
+                            }
+                        }
+                    }
+                } else {
+                    rsx! {
+                        div { class: "card",
+                            div { class: "table-wrapper",
+                                table {
+                                    thead {
+                                        tr {
+                                            th { "Name" }
+                                            th { "Type" }
+                                            th { "Detected" }
+                                            th { "Artifacts" }
+                                            th { "Findings" }
+                                            th { "Actions" }
+                                        }
+                                    }
+                                    tbody {
+                                        for t in rows {
+                                            {
+                                                let id = target_id(&t);
+                                                let name = str_at(&t, "name").to_string();
+                                                let ttype = pretty_type(str_at(&t, "target_type"));
+                                                let suggested = t
+                                                    .get("classification")
+                                                    .and_then(|c| c.get("suggested"))
+                                                    .and_then(|s| s.as_str())
+                                                    .map(pretty_type);
+                                                let artifacts = t
+                                                    .get("artifacts")
+                                                    .and_then(|a| a.as_array())
+                                                    .cloned()
+                                                    .unwrap_or_default();
+                                                let findings = t
+                                                    .get("findings_count")
+                                                    .and_then(|n| n.as_u64())
+                                                    .unwrap_or(0);
+                                                let facts = t
+                                                    .get("classification")
+                                                    .and_then(|c| c.get("facts"))
+                                                    .and_then(|f| f.as_array())
+                                                    .cloned()
+                                                    .unwrap_or_default();
+                                                let is_scanning = scanning_ids().contains(&id);
+                                                let is_expanded = expanded_ids().contains(&id);
+                                                let id_scan = id.clone();
+                                                let id_exp = id.clone();
+                                                let id_del = id.clone();
+                                                let name_del = name.clone();
+                                                let artifacts_detail = artifacts.clone();
+                                                rsx! {
+                                                    tr {
+                                                        td { strong { "{name}" } }
+                                                        td { "{ttype}" }
+                                                        td {
+                                                            if let Some(sug) = suggested.clone() {
+                                                                span { class: "badge badge-success", "{sug}" }
+                                                            } else {
+                                                                span { style: "opacity: 0.5;", "—" }
+                                                            }
+                                                        }
+                                                        td { "{artifacts.len()}" }
+                                                        td { "{findings}" }
+                                                        td { style: "display: flex; gap: 4px;",
+                                                            button {
+                                                                class: "btn btn-ghost",
+                                                                title: "Details",
+                                                                onclick: move |_| {
+                                                                    let mut ids = expanded_ids();
+                                                                    if ids.contains(&id_exp) {
+                                                                        ids.retain(|i| i != &id_exp);
+                                                                    } else {
+                                                                        ids.push(id_exp.clone());
+                                                                    }
+                                                                    expanded_ids.set(ids);
+                                                                },
+                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
+                                                            }
+                                                            button {
+                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
+                                                                title: "Run scan",
+                                                                disabled: is_scanning,
+                                                                onclick: move |_| {
+                                                                    let id = id_scan.clone();
+                                                                    let mut ids = scanning_ids();
+                                                                    ids.push(id.clone());
+                                                                    scanning_ids.set(ids);
+                                                                    spawn(async move {
+                                                                        match trigger_target_scan(id.clone()).await {
+                                                                            Ok(_) => toasts.push(ToastType::Success, "Scan triggered — findings appear as it runs. Use Refresh."),
+                                                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                                                        }
+                                                                        let mut ids = scanning_ids();
+                                                                        ids.retain(|i| i != &id);
+                                                                        scanning_ids.set(ids);
+                                                                    });
+                                                                },
+                                                                if is_scanning {
+                                                                    span { class: "spinner" }
+                                                                } else {
+                                                                    Icon { icon: BsPlayCircle, width: 16, height: 16 }
+                                                                }
+                                                            }
+                                                            button {
+                                                                class: "btn btn-ghost btn-ghost-danger",
+                                                                title: "Delete target",
+                                                                onclick: move |_| {
+                                                                    confirm_delete.set(Some((id_del.clone(), name_del.clone())));
+                                                                },
+                                                                Icon { icon: BsTrash, width: 16, height: 16 }
+                                                            }
+                                                        }
+                                                    }
+                                                    if is_expanded {
+                                                        tr {
+                                                            td { colspan: "6",
+                                                                div { style: "padding: 12px 8px;",
+                                                                    h4 { style: "margin: 0 0 6px;", "Artifacts" }
+                                                                    if artifacts_detail.is_empty() {
+                                                                        div { style: "opacity: 0.6;", "No artifacts." }
+                                                                    }
+                                                                    for a in artifacts_detail {
+                                                                        div { style: "font-size: 0.9em; padding: 2px 0;",
+                                                                            span { style: "opacity: 0.7;", "{str_at(&a, \"kind\")}: " }
+                                                                            span { style: "font-family: monospace;", "{str_at(&a, \"source_ref\")}" }
+                                                                        }
+                                                                    }
+                                                                    if !facts.is_empty() {
+                                                                        h4 { style: "margin: 12px 0 6px;", "Detected facts" }
+                                                                        for f in facts {
+                                                                            div { style: "font-size: 0.9em; padding: 2px 0;",
+                                                                                span { style: "font-family: monospace;", "{str_at(&f, \"key\")}={str_at(&f, \"value\")}" }
+                                                                                span { style: "opacity: 0.5;", " ({str_at(&f, \"source\")})" }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                    h4 { style: "margin: 12px 0 6px;", "Applicable scans" }
+                                                                    TargetScans { id: id.clone() }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Some(None) => rsx! {
+                div { class: "card", p { "Failed to load targets." } }
+            },
+            None => rsx! {
+                div { class: "loading", "Loading targets..." }
+            },
+        }
+        }
+    }
+}