feat: pure Dioxus attack chain visualization, PDF report redesign, and orchestrator data fixes

- Replace vis-network JS graph with pure RSX attack chain component
  featuring KPI header, phase rail, expandable accordion with tool
  category chips, risk scores, and findings pills
- Redesign pentest report as professional PDF-first document with
  cover page, table of contents, severity bar chart, phased attack
  chain timeline, and print-friendly light theme
- Fix orchestrator to populate findings_produced, risk_score, and
  llm_reasoning on attack chain nodes
- Capture LLM reasoning text alongside tool calls in LlmResponse enum
- Add session-level KPI fallback for older pentest data
- Remove attack-chain-viz.js and prototype files
- Add encrypted ZIP report export endpoint with password protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.cargo/audit.toml

@@ -1,23 +0,0 @@
-[advisories]
-ignore = [
-    # hickory-proto 0.25.x pulled in transitively via mongodb → hickory-resolver.
-    # MongoDB 3.x has not yet released with hickory-resolver 0.26.x, so we cannot
-    # upgrade past this without a mongodb release. Both are DNS-layer DoS vectors
-    # requiring a MITM/controlled DNS server against MongoDB's hostname resolution —
-    # not a realistic attack surface here. Revisit when mongodb bumps hickory.
-    "RUSTSEC-2026-0118", # NSEC3 loop, no fix available upstream
-    "RUSTSEC-2026-0119", # O(n²) name compression, fixed in hickory-proto >=0.26.1
-
-    # rmcp 0.16.0 — DNS rebinding in Streamable HTTP server transport (missing
-    # Host header validation). Patched in rmcp >= 1.4.0, which is a major API
-    # version jump from our pin; rmcp shipped 0.x → 1.x → 2.x in three months
-    # and the migration touches every tool handler + the auth middleware we
-    # just landed in #92. Threat model in our deployment: the MCP server is
-    # exposed at a public hostname (comp-mcp-dev.meghsakha.com) behind orca's
-    # TLS-terminating ingress with per-tenant bearer auth — the attack model
-    # (browser DNS-rebinding into localhost MCP server) doesn't directly apply.
-    # Defense-in-depth Host-header check is still a worthwhile follow-up.
-    # FOLLOW-UP: bump rmcp to 2.x in a dedicated PR (M7.3 follow-up, sized
-    # multi-hour due to API surface change).
-    "RUSTSEC-2026-0189",
-]

.gitea/workflows/ci.yml

@@ -3,31 +3,18 @@ name: CI
 on:
   push:
     branches:
-      - main
+      - "**"
   pull_request:
+    branches:
+      - main
 
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
-  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
+  # sccache caches compilation artifacts within a job so that compiling
-  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
+  # both --features server and --features web shares common crate work.
-  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
-  # and HETZNER_S3_SECRET_KEY.
   RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_BUCKET: breakpilot-sccache
+  SCCACHE_DIR: /tmp/sccache
-  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
-  SCCACHE_REGION: auto
-  SCCACHE_S3_USE_SSL: "true"
-  SCCACHE_S3_KEY_PREFIX: compliance-scanner
-  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
-  # compliance-agent depends on tramiton-core via git; use the system git so the
-  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
-  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
-  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
-  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
-  CARGO_NET_RETRY: "10"
-  CARGO_HTTP_MULTIPLEXING: "false"
 
 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -36,11 +23,10 @@ concurrency:
 
 jobs:
   # ---------------------------------------------------------------------------
-  # Stage 1: Lint, audit, and test (single job to share cargo cache)
+  # Stage 1: Code quality checks (run in parallel)
   # ---------------------------------------------------------------------------
-  check:
+  fmt:
-    name: Check
+    name: Format
-    if: github.event_name == 'pull_request'
     runs-on: docker
     container:
       image: rust:1.94-bookworm
@@ -51,86 +37,105 @@ jobs:
           git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}"
           git checkout FETCH_HEAD
-      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
+      - run: rustup component add rustfmt
-      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
+      # Format check does not compile, so sccache is not needed here.
-      # replacement only applies to crates.io-sourced crates.
+      - run: cargo fmt --all --check
-      - name: Use Kellnr crates.io mirror
-        run: |
-          : "${CARGO_HOME:=/usr/local/cargo}"
-          mkdir -p "$CARGO_HOME"
-          {
-            echo '[source.crates-io]'
-            echo 'replace-with = "kellnr"'
-            echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
-          } >> "$CARGO_HOME/config.toml"
         env:
           RUSTC_WRAPPER: ""
-      - name: Install tools
+
+  clippy:
+    name: Clippy
+    runs-on: docker
+    container:
+      image: rust:1.94-bookworm
+    steps:
+      - name: Checkout
         run: |
-          rustup component add rustfmt clippy
+          git init
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
+          git fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout FETCH_HEAD
+      - name: Install sccache
+        run: |
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
           chmod +x /usr/local/bin/sccache
-          cargo install cargo-audit --locked
+      - run: rustup component add clippy
-        env:
+      # Lint the agent (native only).
-          RUSTC_WRAPPER: ""
-
-      # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
-      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
-      # with read:repository, owned by a user with access to sharang/tramiton).
-      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
-      - name: Configure git auth for private tramiton dependency
-        run: |
-          git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@gitea.meghsakha.com:22222/"
-        env:
-          RUSTC_WRAPPER: ""
-
-      # Format (no compilation needed)
-      - name: Format
-        run: cargo fmt --all --check
-        env:
-          RUSTC_WRAPPER: ""
-
-      # Clippy (compiles once, sccache reuses across feature sets)
       - name: Clippy (agent)
         run: cargo clippy -p compliance-agent -- -D warnings
+      # Lint the dashboard for both feature sets independently.
+      # sccache deduplicates shared crates between the two compilations.
       - name: Clippy (dashboard server)
         run: cargo clippy -p compliance-dashboard --features server --no-default-features -- -D warnings
       - name: Clippy (dashboard web)
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
+      - name: Show sccache stats
+        run: sccache --show-stats
+        if: always()
 
-      # Security audit
+  audit:
-      - name: Security Audit
+    name: Security Audit
-        run: cargo audit
+    runs-on: docker
+    if: github.ref == 'refs/heads/main'
+    container:
+      image: rust:1.94-bookworm
+    steps:
+      - name: Checkout
+        run: |
+          git init
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout FETCH_HEAD
+      - run: cargo install cargo-audit
+        env:
+          RUSTC_WRAPPER: ""
+      - run: cargo audit
         env:
           RUSTC_WRAPPER: ""
 
-      # Tests (reuses compilation artifacts from clippy)
+  # ---------------------------------------------------------------------------
-      - name: Tests (core + agent)
+  # Stage 2: Tests (only after all quality checks pass)
-        run: cargo test -p compliance-core -p compliance-agent --lib
+  # ---------------------------------------------------------------------------
-      - name: Tests (dashboard server)
+  test:
+    name: Tests
+    runs-on: docker
+    needs: [fmt, clippy, audit]
+    container:
+      image: rust:1.94-bookworm
+    steps:
+      - name: Checkout
+        run: |
+          git init
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout FETCH_HEAD
+      - name: Install sccache
+        run: |
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
+          chmod +x /usr/local/bin/sccache
+      - name: Run tests (core + agent)
+        run: cargo test -p compliance-core -p compliance-agent
+      - name: Run tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
-      - name: Tests (dashboard web)
+      - name: Run tests (dashboard web)
         run: cargo test -p compliance-dashboard --features web --no-default-features
-
       - name: Show sccache stats
         run: sccache --show-stats
         if: always()
 
   # ---------------------------------------------------------------------------
-  # Stage 2: Deploy (only on main, after checks pass)
+  # Stage 3: Deploy (only on main, after tests pass)
   # Each service only deploys when its relevant files changed.
   # ---------------------------------------------------------------------------
   detect-changes:
     name: Detect Changes
     runs-on: docker
     if: github.ref == 'refs/heads/main'
+    needs: [test]
     container:
       image: alpine:latest
     outputs:
@@ -188,20 +193,13 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.agent == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
+          apk add --no-cache curl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_AGENT }}" \
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-          IMAGE=registry.meghsakha.com/compliance-agent
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
 
   deploy-dashboard:
     name: Deploy Dashboard
@@ -209,20 +207,13 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.dashboard == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
+          apk add --no-cache curl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_DASHBOARD }}" \
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-          IMAGE=registry.meghsakha.com/compliance-dashboard
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
 
   deploy-docs:
     name: Deploy Docs
@@ -230,20 +221,13 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.docs == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
+          apk add --no-cache curl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_DOCS }}" \
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-          IMAGE=registry.meghsakha.com/compliance-docs
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy docs"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"
 
   deploy-mcp:
     name: Deploy MCP
@@ -251,17 +235,10 @@ jobs:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.mcp == 'true'
     container:
-      image: docker:27-cli
+      image: alpine:latest
     steps:
-      - name: Build, push and trigger orca redeploy
+      - name: Trigger Coolify deploy
         run: |
-          apk add --no-cache git curl openssl
+          apk add --no-cache curl
-          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          curl -sf "${{ secrets.COOLIFY_WEBHOOK_MCP }}" \
-          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
+            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
-          IMAGE=registry.meghsakha.com/compliance-mcp
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
-          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
-          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
-          RESP=$(curl -fsS -w "\nHTTP %{http_code}" -X POST "http://46.225.100.82:6880/api/v1/webhooks/github" -H "Content-Type: application/json" -H "X-Hub-Signature-256: sha256=$SIG" -d "$PAYLOAD"); echo "$RESP"

.gitea/workflows/nightly.yml

@@ -1,52 +0,0 @@
-name: Nightly E2E Tests
-
-on:
-  schedule:
-    - cron: '0 3 * * *'  # 3 AM UTC daily
-  workflow_dispatch:       # Allow manual trigger
-
-env:
-  CARGO_TERM_COLOR: always
-  RUSTFLAGS: "-D warnings"
-  RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_DIR: /tmp/sccache
-  TEST_MONGODB_URI: "mongodb://root:example@mongo:27017/?authSource=admin"
-
-concurrency:
-  group: nightly-e2e
-  cancel-in-progress: true
-
-jobs:
-  e2e:
-    name: E2E Tests
-    runs-on: docker
-    container:
-      image: rust:1.94-bookworm
-    services:
-      mongo:
-        image: mongo:7
-        env:
-          MONGO_INITDB_ROOT_USERNAME: root
-          MONGO_INITDB_ROOT_PASSWORD: example
-    steps:
-      - name: Checkout
-        run: |
-          git init
-          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-          git fetch --depth=1 origin "${GITHUB_SHA:-refs/heads/main}"
-          git checkout FETCH_HEAD
-
-      - name: Install sccache
-        run: |
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
-          chmod +x /usr/local/bin/sccache
-        env:
-          RUSTC_WRAPPER: ""
-
-      - name: Run E2E tests
-        run: cargo test -p compliance-agent --test e2e -- --test-threads=4
-
-      - name: Show sccache stats
-        run: sccache --show-stats
-        if: always()

.gitignore

@@ -4,6 +4,3 @@
 *.swo
 *~
 .DS_Store
-.playwright-mcp/
-report-preview-full.png
-compliance-dashboard/attack-chain-final.html

Cargo.lock

@@ -8,16 +8,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
-[[package]]
-name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common",
- "generic-array",
-]
-
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -29,20 +19,6 @@ dependencies = [
  "cpufeatures 0.2.17",
 ]
 
-[[package]]
-name = "aes-gcm"
-version = "0.10.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
-dependencies = [
- "aead",
- "aes",
- "cipher",
- "ctr",
- "ghash",
- "subtle",
-]
-
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -659,16 +635,13 @@ dependencies = [
 name = "compliance-agent"
 version = "0.1.0"
 dependencies = [
- "aes-gcm",
  "axum",
  "base64",
  "chrono",
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
- "dashmap",
  "dotenvy",
- "futures-core",
  "futures-util",
  "git2",
  "hex",
@@ -676,7 +649,6 @@ dependencies = [
  "jsonwebtoken",
  "mongodb",
  "octocrab",
- "rand 0.9.2",
  "regex",
  "reqwest",
  "secrecy",
@@ -686,13 +658,9 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tokio-cron-scheduler",
- "tokio-stream",
- "tokio-tungstenite 0.26.2",
- "tower",
  "tower-http",
  "tracing",
  "tracing-subscriber",
- "tramiton-core",
  "urlencoding",
  "uuid",
  "walkdir",
@@ -703,23 +671,19 @@ dependencies = [
 name = "compliance-core"
 version = "0.1.0"
 dependencies = [
- "axum",
  "bson",
  "chrono",
  "hex",
- "jsonwebtoken",
  "mongodb",
  "opentelemetry",
  "opentelemetry-appender-tracing",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
- "reqwest",
  "secrecy",
  "serde",
  "serde_json",
  "sha2",
  "thiserror 2.0.18",
- "tokio",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
@@ -766,13 +730,11 @@ dependencies = [
 name = "compliance-dast"
 version = "0.1.0"
 dependencies = [
- "base64",
  "bollard",
  "bson",
  "chromiumoxide",
  "chrono",
  "compliance-core",
- "futures-util",
  "mongodb",
  "native-tls",
  "reqwest",
@@ -782,7 +744,6 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tokio-native-tls",
- "tokio-tungstenite 0.26.2",
  "tracing",
  "url",
  "uuid",
@@ -820,15 +781,12 @@ dependencies = [
  "bson",
  "chrono",
  "compliance-core",
- "dashmap",
  "dotenvy",
- "hex",
  "mongodb",
  "rmcp",
  "schemars 1.2.1",
  "serde",
  "serde_json",
- "sha2",
  "thiserror 2.0.18",
  "tokio",
  "tower-http",
@@ -836,20 +794,6 @@ dependencies = [
  "tracing-subscriber",
 ]
 
-[[package]]
-name = "compliance-smoke"
-version = "0.1.0"
-dependencies = [
- "axum",
- "compliance-core",
- "reqwest",
- "serde",
- "serde_json",
- "tokio",
- "tracing",
- "tracing-subscriber",
-]
-
 [[package]]
 name = "console_error_panic_hook"
 version = "0.1.7"
@@ -1119,9 +1063,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.20"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1145,7 +1089,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -1172,15 +1115,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "ctr"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
-dependencies = [
- "cipher",
-]
-
 [[package]]
 name = "darling"
 version = "0.21.3"
@@ -2380,16 +2314,6 @@ dependencies = [
  "wasip3",
 ]
 
-[[package]]
-name = "ghash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
-dependencies = [
- "opaque-debug",
- "polyval",
-]
-
 [[package]]
 name = "git2"
 version = "0.20.4"
@@ -2748,7 +2672,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.6",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -3269,9 +3193,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
 name = "lz4_flex"
-version = "0.11.6"
+version = "0.11.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
+checksum = "08ab2867e3eeeca90e844d1940eab391c9dc5228783db2ed999acbc0a9ed375a"
 
 [[package]]
 name = "lzma-rs"
@@ -3548,9 +3472,9 @@ checksum = "224484c5d09285a7b8cb0a0c117e847ebd14cb6e4470ecf68cdb89c503b0edb9"
 
 [[package]]
 name = "mongodb"
-version = "3.6.0"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ef2c933617431ad0246fb5b43c425ebdae18c7f7259c87de0726d93b0e7e91b"
+checksum = "803dd859e8afa084c255a8effd8000ff86f7c8076a50cd6d8c99e8f3496f75c2"
 dependencies = [
  "base64",
  "bitflags",
@@ -3589,14 +3513,14 @@ dependencies = [
  "tokio-util",
  "typed-builder",
  "uuid",
- "webpki-roots 1.0.6",
+ "webpki-roots",
 ]
 
 [[package]]
 name = "mongodb-internal-macros"
-version = "3.6.0"
+version = "3.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5758dc828eb2d02ec30563cba365609d56ddd833190b192beaee2b475a7bb3"
+checksum = "a973ef3dd3dbc6f6e65bbdecfd9ec5e781b9e7493b0f369a7c62e35d8e5ae2c8"
 dependencies = [
  "macro_magic",
  "proc-macro2",
@@ -3823,12 +3747,6 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "269bca4c2591a28585d6bf10d9ed0332b7d76900a1b02bec41bdc3a2cdcda107"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
 [[package]]
 name = "openssl"
 version = "0.10.75"
@@ -4134,18 +4052,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
-[[package]]
-name = "polyval"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "opaque-debug",
- "universal-hash",
-]
-
 [[package]]
 name = "portable-atomic"
 version = "1.13.1"
@@ -4198,7 +4104,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit 0.23.10+spec-1.0.0",
+ "toml_edit",
 ]
 
 [[package]]
@@ -4283,9 +4189,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.15"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
@@ -4550,7 +4456,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.6",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -4723,9 +4629,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4997,15 +4903,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5204,7 +5101,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
  "syn",
@@ -5765,22 +5662,6 @@ dependencies = [
  "tokio-util",
 ]
 
-[[package]]
-name = "tokio-tungstenite"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
-dependencies = [
- "futures-util",
- "log",
- "rustls",
- "rustls-pki-types",
- "tokio",
- "tokio-rustls",
- "tungstenite 0.26.2",
- "webpki-roots 0.26.11",
-]
-
 [[package]]
 name = "tokio-tungstenite"
 version = "0.27.0"
@@ -5820,27 +5701,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5850,20 +5710,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap 2.13.0",
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_write",
- "winnow",
-]
-
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5871,7 +5717,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
  "indexmap 2.13.0",
- "toml_datetime 0.7.5+spec-1.1.0",
+ "toml_datetime",
  "toml_parser",
  "winnow",
 ]
@@ -5885,12 +5731,6 @@ dependencies = [
  "winnow",
 ]
 
-[[package]]
-name = "toml_write"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
-
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6137,18 +5977,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "tramiton-core"
-version = "0.4.0"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
-dependencies = [
- "serde",
- "tempfile",
- "thiserror 1.0.69",
- "toml",
- "walkdir",
-]
-
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -6232,25 +6060,6 @@ dependencies = [
  "utf-8",
 ]
 
-[[package]]
-name = "tungstenite"
-version = "0.26.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4793cb5e56680ecbb1d843515b23b6de9a75eb04b66643e256a396d43be33c13"
-dependencies = [
- "bytes",
- "data-encoding",
- "http",
- "httparse",
- "log",
- "rand 0.9.2",
- "rustls",
- "rustls-pki-types",
- "sha1",
- "thiserror 2.0.18",
- "utf-8",
-]
-
 [[package]]
 name = "tungstenite"
 version = "0.27.0"
@@ -6362,16 +6171,6 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
-[[package]]
-name = "universal-hash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
-dependencies = [
- "crypto-common",
- "subtle",
-]
-
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -6649,15 +6448,6 @@ dependencies = [
  "string_cache_codegen",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.6",
-]
-
 [[package]]
 name = "webpki-roots"
 version = "1.0.6"

Cargo.toml

@@ -6,7 +6,6 @@ members = [
     "compliance-graph",
     "compliance-dast",
     "compliance-mcp",
-    "compliance-smoke",
 ]
 resolver = "2"
 
@@ -31,8 +30,3 @@ uuid = { version = "1", features = ["v4", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }
-dashmap = "6"
-tokio-stream = { version = "0.1", features = ["sync"] }
-aes-gcm = "0.10"
-rand = "0.9"
-base64 = "0.22"

Dockerfile.agent

@@ -33,15 +33,9 @@ RUN pip3 install --break-system-packages ruff
 
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
 
-# Copy documentation for the help chat assistant
-COPY --from=builder /app/README.md /app/README.md
-COPY --from=builder /app/docs /app/docs
-ENV HELP_DOCS_PATH=/app
-
 # Ensure SSH key directory exists
 RUN mkdir -p /data/compliance-scanner/ssh
 
 EXPOSE 3001 3002
 
 ENTRYPOINT ["compliance-agent"]
-

Dockerfile.dashboard

@@ -1,6 +1,6 @@
 FROM rust:1.94-bookworm AS builder
 
-RUN cargo install dioxus-cli --version 0.7.3 --locked
+RUN cargo install dioxus-cli --version 0.7.3
 
 ARG DOCS_URL=/docs
 
@@ -20,4 +20,3 @@ ENV IP=0.0.0.0
 EXPOSE 8080
 
 ENTRYPOINT ["./compliance-dashboard"]
-

Dockerfile.docs

@@ -12,4 +12,3 @@ RUN rm /etc/nginx/conf.d/default.conf
 COPY docs/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /app/.vitepress/dist /usr/share/nginx/html
 EXPOSE 80
-

Dockerfile.mcp

@@ -14,4 +14,3 @@ EXPOSE 8090
 ENV MCP_PORT=8090
 
 ENTRYPOINT ["compliance-mcp"]
-

README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://www.rust-lang.org/"><img src="https://img.shields.io/badge/Rust-1.94-orange?logo=rust&logoColor=white" alt="Rust" /></a>
+  <a href="https://www.rust-lang.org/"><img src="https://img.shields.io/badge/Rust-1.89-orange?logo=rust&logoColor=white" alt="Rust" /></a>
   <a href="https://dioxuslabs.com/"><img src="https://img.shields.io/badge/Dioxus-0.7-blue?logo=webassembly&logoColor=white" alt="Dioxus" /></a>
   <a href="https://www.mongodb.com/"><img src="https://img.shields.io/badge/MongoDB-8.0-47A248?logo=mongodb&logoColor=white" alt="MongoDB" /></a>
   <a href="https://axum.rs/"><img src="https://img.shields.io/badge/Axum-0.8-4A4A55?logo=rust&logoColor=white" alt="Axum" /></a>
@@ -28,9 +28,9 @@
 
 ## About
 
-Compliance Scanner is an autonomous agent that continuously monitors git repositories for security vulnerabilities, GDPR/OAuth compliance patterns, and dependency risks. It creates issues in external trackers (GitHub/GitLab/Jira/Gitea) with evidence and remediation suggestions, reviews pull requests with multi-pass LLM analysis, runs autonomous penetration tests, and exposes a Dioxus-based dashboard for visualization.
+Compliance Scanner is an autonomous agent that continuously monitors git repositories for security vulnerabilities, GDPR/OAuth compliance patterns, and dependency risks. It creates issues in external trackers (GitHub/GitLab/Jira) with evidence and remediation suggestions, reviews pull requests, and exposes a Dioxus-based dashboard for visualization.
 
-> **How it works:** The agent runs as a lazy daemon -- it only scans when new commits are detected, triggered by cron schedules or webhooks. LLM-powered triage filters out false positives and generates actionable remediation with multi-language awareness.
+> **How it works:** The agent runs as a lazy daemon -- it only scans when new commits are detected, triggered by cron schedules or webhooks. LLM-powered triage filters out false positives and generates actionable remediation.
 
 ## Features
 
@@ -41,38 +41,31 @@ Compliance Scanner is an autonomous agent that continuously monitors git reposit
 | **CVE Monitoring** | OSV.dev batch queries, NVD CVSS enrichment, SearXNG context |
 | **GDPR Patterns** | Detect PII logging, missing consent, hardcoded retention, missing deletion |
 | **OAuth Patterns** | Detect implicit grant, missing PKCE, token in localStorage, token in URLs |
-| **LLM Triage** | Multi-language-aware confidence scoring (Rust, Python, Go, Java, Ruby, PHP, C++) |
+| **LLM Triage** | Confidence scoring via LiteLLM to filter false positives |
-| **Issue Creation** | Auto-create issues in GitHub, GitLab, Jira, or Gitea with dedup via fingerprints |
+| **Issue Creation** | Auto-create issues in GitHub, GitLab, or Jira with code evidence |
-| **PR Reviews** | Multi-pass security review (logic, security, convention, complexity) with dedup |
+| **PR Reviews** | Post security review comments on pull requests |
-| **DAST Scanning** | Black-box security testing with endpoint discovery and parameter fuzzing |
+| **Dashboard** | Fullstack Dioxus UI with findings, SBOM, issues, and statistics |
-| **AI Pentesting** | Autonomous LLM-orchestrated penetration testing with encrypted reports |
+| **Webhooks** | GitHub (HMAC-SHA256) and GitLab webhook receivers for push/PR events |
-| **Code Graph** | Interactive code knowledge graph with impact analysis |
-| **AI Chat (RAG)** | Natural language Q&A grounded in repository source code |
-| **Help Assistant** | Documentation-grounded help chat accessible from every dashboard page |
-| **MCP Server** | Expose live security data to Claude, Cursor, and other AI tools |
-| **Dashboard** | Fullstack Dioxus UI with findings, SBOM, issues, DAST, pentest, and graph |
-| **Webhooks** | GitHub, GitLab, and Gitea webhook receivers for push/PR events |
-| **Finding Dedup** | SHA-256 fingerprint dedup for SAST, CWE-based dedup for DAST findings |
 
 ## Architecture
 
 ```
-┌──────────────────────────────────────────────────────────────────────────┐
+┌─────────────────────────────────────────────────────────────┐
-│                          Cargo Workspace                                 │
+│                    Cargo Workspace                           │
-├──────────────┬──────────────────┬──────────────┬──────────┬─────────────┤
+├──────────────┬──────────────────┬───────────────────────────┤
-│ compliance-  │ compliance-      │ compliance-  │ complian-│ compliance- │
+│ compliance-  │ compliance-      │ compliance-               │
-│ core (lib)   │ agent (bin)      │ dashboard    │ ce-graph │ mcp (bin)   │
+│ core         │ agent            │ dashboard                 │
-│              │                  │ (bin)        │ (lib)    │             │
+│ (lib)        │ (bin)            │ (bin, Dioxus 0.7.3)       │
-│ Models       │ Scan Pipeline    │ Dioxus 0.7   │ Tree-    │ MCP Server  │
+│              │                  │                           │
-│ Traits       │ LLM Client      │ Fullstack UI │ sitter   │ Live data   │
+│ Models       │ Scan Pipeline    │ Fullstack Web UI          │
-│ Config       │ Issue Trackers   │ Help Chat    │ Graph    │ for AI      │
+│ Traits       │ LLM Client      │ Server Functions           │
-│ Errors       │ Pentest Engine   │ Server Fns   │ Embedds  │ tools       │
+│ Config       │ Issue Trackers   │ Charts + Tables           │
-│              │ DAST Tools       │              │ RAG      │             │
+│ Errors       │ Scheduler        │ Settings Page             │
-│              │ REST API         │              │          │             │
+│              │ REST API         │                           │
-│              │ Webhooks         │              │          │             │
+│              │ Webhooks         │                           │
-└──────────────┴──────────────────┴──────────────┴──────────┴─────────────┘
+└──────────────┴──────────────────┴───────────────────────────┘
-                                 │
+                        │
-                            MongoDB (shared)
+                   MongoDB (shared)
 ```
 
 ## Scan Pipeline (7 Stages)
@@ -91,22 +84,17 @@ Compliance Scanner is an autonomous agent that continuously monitors git reposit
 |-------|-----------|
 | Shared Library | `compliance-core` -- models, traits, config |
 | Agent | Axum REST API, git2, tokio-cron-scheduler, Semgrep, Syft |
-| Dashboard | Dioxus 0.7.3 fullstack, Tailwind CSS 4 |
+| Dashboard | Dioxus 0.7.3 fullstack, Tailwind CSS |
-| Code Graph | `compliance-graph` -- tree-sitter parsing, embeddings, RAG |
-| MCP Server | `compliance-mcp` -- Model Context Protocol for AI tools |
-| DAST | `compliance-dast` -- dynamic application security testing |
 | Database | MongoDB with typed collections |
-| LLM | LiteLLM (OpenAI-compatible API for chat, triage, embeddings) |
+| LLM | LiteLLM (OpenAI-compatible API) |
-| Issue Trackers | GitHub (octocrab), GitLab (REST v4), Jira (REST v3), Gitea |
+| Issue Trackers | GitHub (octocrab), GitLab (REST v4), Jira (REST v3) |
 | CVE Sources | OSV.dev, NVD, SearXNG |
-| Auth | Keycloak (OAuth2/PKCE, SSO) |
-| Browser Automation | Chromium (headless, for pentesting and PDF generation) |
 
 ## Getting Started
 
 ### Prerequisites
 
-- Rust 1.94+
+- Rust 1.89+
 - [Dioxus CLI](https://dioxuslabs.com/learn/0.7/getting_started) (`dx`)
 - MongoDB
 - Docker & Docker Compose (optional)
@@ -163,35 +151,20 @@ The agent exposes a REST API on port 3001:
 | `GET` | `/api/v1/sbom` | List dependencies |
 | `GET` | `/api/v1/issues` | List cross-tracker issues |
 | `GET` | `/api/v1/scan-runs` | Scan execution history |
-| `GET` | `/api/v1/graph/:repo_id` | Code knowledge graph |
-| `POST` | `/api/v1/graph/:repo_id/build` | Trigger graph build |
-| `GET` | `/api/v1/dast/targets` | List DAST targets |
-| `POST` | `/api/v1/dast/targets` | Add DAST target |
-| `GET` | `/api/v1/dast/findings` | List DAST findings |
-| `POST` | `/api/v1/chat/:repo_id` | RAG-powered code chat |
-| `POST` | `/api/v1/help/chat` | Documentation-grounded help chat |
-| `POST` | `/api/v1/pentest/sessions` | Create pentest session |
-| `POST` | `/api/v1/pentest/sessions/:id/export` | Export encrypted pentest report |
 | `POST` | `/webhook/github` | GitHub webhook (HMAC-SHA256) |
 | `POST` | `/webhook/gitlab` | GitLab webhook (token verify) |
-| `POST` | `/webhook/gitea` | Gitea webhook |
 
 ## Dashboard Pages
 
 | Page | Description |
 |------|-------------|
-| **Overview** | Stat cards, severity distribution, AI chat cards, MCP status |
+| **Overview** | Stat cards, severity distribution chart |
-| **Repositories** | Add/manage tracked repos, trigger scans, webhook config |
+| **Repositories** | Add/manage tracked repos, trigger scans |
-| **Findings** | Filterable table by severity, type, status, scanner |
+| **Findings** | Filterable table by severity, type, status |
 | **Finding Detail** | Code evidence, remediation, suggested fix, linked issue |
-| **SBOM** | Dependency inventory with vulnerability badges, license summary |
+| **SBOM** | Dependency inventory with vulnerability badges |
-| **Issues** | Cross-tracker view (GitHub + GitLab + Jira + Gitea) |
+| **Issues** | Cross-tracker view (GitHub + GitLab + Jira) |
-| **Code Graph** | Interactive architecture visualization, impact analysis |
+| **Settings** | Configure LiteLLM, tracker tokens, SearXNG URL |
-| **AI Chat** | RAG-powered Q&A about repository code |
-| **DAST** | Dynamic scanning targets, findings, and scan history |
-| **Pentest** | AI-driven pentest sessions, attack chain visualization |
-| **MCP Servers** | Model Context Protocol server management |
-| **Help Chat** | Floating assistant (available on every page) for product Q&A |
 
 ## Project Structure
 
@@ -200,24 +173,19 @@ compliance-scanner/
 ├── compliance-core/        Shared library (models, traits, config, errors)
 ├── compliance-agent/       Agent daemon (pipeline, LLM, trackers, API, webhooks)
 │   └── src/
-│       ├── pipeline/       7-stage scan pipeline, dedup, PR reviews, code review
+│       ├── pipeline/       7-stage scan pipeline
-│       ├── llm/            LiteLLM client, triage, descriptions, fixes, review prompts
+│       ├── llm/            LiteLLM client, triage, descriptions, fixes, PR review
-│       ├── trackers/       GitHub, GitLab, Jira, Gitea integrations
+│       ├── trackers/       GitHub, GitLab, Jira integrations
-│       ├── pentest/        AI-driven pentest orchestrator, tools, reports
+│       ├── api/            REST API (Axum)
-│       ├── rag/            RAG pipeline, chunking, embedding
+│       └── webhooks/       GitHub + GitLab webhook receivers
-│       ├── api/            REST API (Axum), help chat
-│       └── webhooks/       GitHub, GitLab, Gitea webhook receivers
 ├── compliance-dashboard/   Dioxus fullstack dashboard
 │   └── src/
-│       ├── components/     Reusable UI (sidebar, help chat, attack chain, etc.)
+│       ├── components/     Reusable UI components
-│       ├── infrastructure/ Server functions, DB, config, auth
+│       ├── infrastructure/ Server functions, DB, config
-│       └── pages/          Full page views (overview, DAST, pentest, graph, etc.)
+│       └── pages/          Full page views
-├── compliance-graph/       Code knowledge graph (tree-sitter, embeddings, RAG)
-├── compliance-dast/        Dynamic application security testing
-├── compliance-mcp/         Model Context Protocol server
-├── docs/                   VitePress documentation site
 ├── assets/                 Static assets (CSS, icons)
-└── styles/                 Tailwind input stylesheet
+├── styles/                 Tailwind input stylesheet
+└── bin/                    Dashboard binary entrypoint
 ```
 
 ## External Services
@@ -225,12 +193,10 @@ compliance-scanner/
 | Service | Purpose | Default URL |
 |---------|---------|-------------|
 | MongoDB | Persistence | `mongodb://localhost:27017` |
-| LiteLLM | LLM proxy (chat, triage, embeddings) | `http://localhost:4000` |
+| LiteLLM | LLM proxy for triage and generation | `http://localhost:4000` |
 | SearXNG | CVE context search | `http://localhost:8888` |
-| Keycloak | Authentication (OAuth2/PKCE, SSO) | `http://localhost:8080` |
 | Semgrep | SAST scanning | CLI tool |
 | Syft | SBOM generation | CLI tool |
-| Chromium | Headless browser (pentesting, PDF) | Managed via Docker |
 
 ---
 

compliance-agent/Cargo.toml

@@ -7,14 +7,9 @@ edition = "2021"
 workspace = true
 
 [dependencies]
-compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
+compliance-core = { workspace = true, features = ["mongodb", "telemetry"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
-# Native firmware build/target detection for bare-metal & RTOS artifacts.
-# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
-# available to the onboarding classifier. NOTE: CI must be able to fetch this
-# private repo (see the git-auth step in .gitea/workflows/ci.yml).
-tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -30,7 +25,7 @@ uuid = { workspace = true }
 secrecy = { workspace = true }
 regex = { workspace = true }
 axum = "0.8"
-tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
+tower-http = { version = "0.6", features = ["cors", "trace"] }
 git2 = "0.20"
 octocrab = "0.44"
 tokio-cron-scheduler = "0.13"
@@ -42,21 +37,3 @@ urlencoding = "2"
 futures-util = "0.3"
 jsonwebtoken = "9"
 zip = { workspace = true }
-aes-gcm = { workspace = true }
-tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
-futures-core = "0.3"
-dashmap = { workspace = true }
-tokio-stream = { workspace = true }
-rand = { workspace = true }
-
-[dev-dependencies]
-compliance-core = { workspace = true, features = ["mongodb", "axum"] }
-tower = { version = "0.5", features = ["util"] }
-reqwest = { workspace = true }
-serde_json = { workspace = true }
-tokio = { workspace = true }
-mongodb = { workspace = true }
-uuid = { workspace = true }
-secrecy = { workspace = true }
-axum = "0.8"
-tower-http = { version = "0.6", features = ["cors"] }

compliance-agent/src/agent.rs

@@ -1,82 +1,59 @@
 use std::sync::Arc;
 
-use dashmap::DashMap;
-use tokio::sync::{broadcast, watch, Semaphore};
-
-use compliance_core::models::pentest::PentestEvent;
 use compliance_core::AgentConfig;
 
-use crate::database::DatabasePool;
+use crate::database::Database;
 use crate::llm::LlmClient;
 use crate::pipeline::orchestrator::PipelineOrchestrator;
 
-/// Default maximum concurrent pentest sessions.
-const DEFAULT_MAX_CONCURRENT_SESSIONS: usize = 5;
-
 #[derive(Clone)]
 pub struct ComplianceAgent {
     pub config: AgentConfig,
-    /// Per-tenant Mongo broker. Every code path must obtain a
+    pub db: Database,
-    /// tenant-scoped [`crate::database::Database`] from this pool —
-    /// there is no single shared database any more.
-    pub db_pool: DatabasePool,
     pub llm: Arc<LlmClient>,
     pub http: reqwest::Client,
-    /// Per-session broadcast senders for SSE streaming.
-    pub session_streams: Arc<DashMap<String, broadcast::Sender<PentestEvent>>>,
-    /// Per-session pause controls (true = paused).
-    pub session_pause: Arc<DashMap<String, watch::Sender<bool>>>,
-    /// Semaphore limiting concurrent pentest sessions.
-    pub session_semaphore: Arc<Semaphore>,
 }
 
 impl ComplianceAgent {
-    pub fn new(config: AgentConfig, db_pool: DatabasePool) -> Self {
+    pub fn new(config: AgentConfig, db: Database) -> Self {
         let llm = Arc::new(LlmClient::new(
             config.litellm_url.clone(),
             config.litellm_api_key.clone(),
             config.litellm_model.clone(),
             config.litellm_embed_model.clone(),
         ));
-        let http = reqwest::Client::builder()
-            .timeout(std::time::Duration::from_secs(30))
-            .connect_timeout(std::time::Duration::from_secs(10))
-            .build()
-            .unwrap_or_default();
         Self {
             config,
-            db_pool,
+            db,
             llm,
-            http,
+            http: reqwest::Client::new(),
-            session_streams: Arc::new(DashMap::new()),
-            session_pause: Arc::new(DashMap::new()),
-            session_semaphore: Arc::new(Semaphore::new(DEFAULT_MAX_CONCURRENT_SESSIONS)),
         }
     }
 
     pub async fn run_scan(
         &self,
-        tenant_id: &str,
         repo_id: &str,
         trigger: compliance_core::models::ScanTrigger,
     ) -> Result<(), crate::error::AgentError> {
-        let db = self.db_pool.for_tenant_id(tenant_id).await?;
+        let orchestrator = PipelineOrchestrator::new(
-        let orchestrator =
+            self.config.clone(),
-            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+            self.db.clone(),
+            self.llm.clone(),
+            self.http.clone(),
+        );
         orchestrator.run(repo_id, trigger).await
     }
 
     /// Run a PR review: scan the diff and post review comments.
     pub async fn run_pr_review(
         &self,
-        tenant_id: &str,
         repo_id: &str,
         pr_number: u64,
         base_sha: &str,
         head_sha: &str,
     ) -> Result<(), crate::error::AgentError> {
-        let db = self.db_pool.for_tenant_id(tenant_id).await?;
+        let repo = self
-        let repo = db
+            .db
             .repositories()
             .find_one(mongodb::bson::doc! {
                 "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id)
@@ -87,60 +64,14 @@ impl ComplianceAgent {
                 crate::error::AgentError::Other(format!("Repository {repo_id} not found"))
             })?;
 
-        let orchestrator =
+        let orchestrator = PipelineOrchestrator::new(
-            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+            self.config.clone(),
+            self.db.clone(),
+            self.llm.clone(),
+            self.http.clone(),
+        );
         orchestrator
             .run_pr_review(&repo, repo_id, pr_number, base_sha, head_sha)
             .await
     }
-
-    // ── Session stream management ──────────────────────────────────
-
-    /// Register a broadcast sender for a session. Returns the sender.
-    pub fn register_session_stream(&self, session_id: &str) -> broadcast::Sender<PentestEvent> {
-        let (tx, _) = broadcast::channel(256);
-        self.session_streams
-            .insert(session_id.to_string(), tx.clone());
-        tx
-    }
-
-    /// Subscribe to a session's broadcast stream.
-    pub fn subscribe_session(&self, session_id: &str) -> Option<broadcast::Receiver<PentestEvent>> {
-        self.session_streams
-            .get(session_id)
-            .map(|tx| tx.subscribe())
-    }
-
-    // ── Session pause/resume management ────────────────────────────
-
-    /// Register a pause control for a session. Returns the watch receiver.
-    pub fn register_pause_control(&self, session_id: &str) -> watch::Receiver<bool> {
-        let (tx, rx) = watch::channel(false);
-        self.session_pause.insert(session_id.to_string(), tx);
-        rx
-    }
-
-    /// Pause a session.
-    pub fn pause_session(&self, session_id: &str) -> bool {
-        if let Some(tx) = self.session_pause.get(session_id) {
-            tx.send(true).is_ok()
-        } else {
-            false
-        }
-    }
-
-    /// Resume a session.
-    pub fn resume_session(&self, session_id: &str) -> bool {
-        if let Some(tx) = self.session_pause.get(session_id) {
-            tx.send(false).is_ok()
-        } else {
-            false
-        }
-    }
-
-    /// Clean up all per-session resources.
-    pub fn cleanup_session(&self, session_id: &str) {
-        self.session_streams.remove(session_id);
-        self.session_pause.remove(session_id);
-    }
 }

compliance-agent/src/api/auth_middleware.rs

@@ -0,0 +1,113 @@
+use std::sync::Arc;
+
+use axum::{
+    extract::Request,
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use jsonwebtoken::{decode, decode_header, jwk::JwkSet, DecodingKey, Validation};
+use reqwest::StatusCode;
+use serde::Deserialize;
+use tokio::sync::RwLock;
+
+/// Cached JWKS from Keycloak for token validation.
+#[derive(Clone)]
+pub struct JwksState {
+    pub jwks: Arc<RwLock<Option<JwkSet>>>,
+    pub jwks_url: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct Claims {
+    #[allow(dead_code)]
+    sub: String,
+}
+
+const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
+
+/// Middleware that validates Bearer JWT tokens against Keycloak's JWKS.
+///
+/// Skips validation for health check endpoints.
+/// If `JwksState` is not present as an extension (keycloak not configured),
+/// all requests pass through.
+pub async fn require_jwt_auth(request: Request, next: Next) -> Response {
+    let path = request.uri().path();
+
+    if PUBLIC_ENDPOINTS.contains(&path) {
+        return next.run(request).await;
+    }
+
+    let jwks_state = match request.extensions().get::<JwksState>() {
+        Some(s) => s.clone(),
+        None => return next.run(request).await,
+    };
+
+    let auth_header = match request.headers().get("authorization") {
+        Some(h) => h,
+        None => return (StatusCode::UNAUTHORIZED, "Missing authorization header").into_response(),
+    };
+
+    let token = match auth_header.to_str() {
+        Ok(s) if s.starts_with("Bearer ") => &s[7..],
+        _ => return (StatusCode::UNAUTHORIZED, "Invalid authorization header").into_response(),
+    };
+
+    match validate_token(token, &jwks_state).await {
+        Ok(()) => next.run(request).await,
+        Err(e) => {
+            tracing::warn!("JWT validation failed: {e}");
+            (StatusCode::UNAUTHORIZED, "Invalid token").into_response()
+        }
+    }
+}
+
+async fn validate_token(token: &str, state: &JwksState) -> Result<(), String> {
+    let header = decode_header(token).map_err(|e| format!("failed to decode JWT header: {e}"))?;
+
+    let kid = header
+        .kid
+        .ok_or_else(|| "JWT missing kid header".to_string())?;
+
+    let jwks = fetch_or_get_jwks(state).await?;
+
+    let jwk = jwks
+        .keys
+        .iter()
+        .find(|k| k.common.key_id.as_deref() == Some(&kid))
+        .ok_or_else(|| "no matching key found in JWKS".to_string())?;
+
+    let decoding_key =
+        DecodingKey::from_jwk(jwk).map_err(|e| format!("failed to create decoding key: {e}"))?;
+
+    let mut validation = Validation::new(header.alg);
+    validation.validate_exp = true;
+    validation.validate_aud = false;
+
+    decode::<Claims>(token, &decoding_key, &validation)
+        .map_err(|e| format!("token validation failed: {e}"))?;
+
+    Ok(())
+}
+
+async fn fetch_or_get_jwks(state: &JwksState) -> Result<JwkSet, String> {
+    {
+        let cached = state.jwks.read().await;
+        if let Some(ref jwks) = *cached {
+            return Ok(jwks.clone());
+        }
+    }
+
+    let resp = reqwest::get(&state.jwks_url)
+        .await
+        .map_err(|e| format!("failed to fetch JWKS: {e}"))?;
+
+    let jwks: JwkSet = resp
+        .json()
+        .await
+        .map_err(|e| format!("failed to parse JWKS: {e}"))?;
+
+    let mut cached = state.jwks.write().await;
+    *cached = Some(jwks.clone());
+
+    Ok(jwks)
+}

compliance-agent/src/api/handlers/admin.rs

@@ -1,115 +0,0 @@
-//! Cross-tenant admin endpoints (`/api/v1/admin/*`).
-//!
-//! Operator-only. Auth is a **static bearer token** (`ADMIN_API_TOKEN`
-//! env on the agent) — explicitly NOT a Keycloak JWT, because the
-//! whole point of these endpoints is to operate ACROSS tenants. A
-//! customer JWT (which always carries a single tenant_id) has no
-//! business mounting them.
-//!
-//! Routes are only registered when `ADMIN_API_TOKEN` is set. With no
-//! token, the endpoints don't exist at all (404), which is a stronger
-//! guarantee than "401 if you guess the path".
-//!
-//! Operations:
-//! - `GET    /api/v1/admin/tenants`              — list tenant DBs
-//! - `DELETE /api/v1/admin/tenants/{tenant_id}`  — GDPR delete
-//!
-//! Tenant ids in URLs are passed as-is to `DatabasePool::drop_tenant`,
-//! which sanitises them the same way it does for creation. Listing
-//! returns the raw DB names from `list_tenant_db_names` — operators
-//! can reverse-derive the tenant_id from the prefix.
-
-use axum::extract::{Extension, Path, Request};
-use axum::http::{header, StatusCode};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use secrecy::ExposeSecret;
-use serde::Serialize;
-
-use super::dto::AgentExt;
-
-#[derive(Serialize)]
-pub struct ListTenantDbsResponse {
-    pub tenant_db_names: Vec<String>,
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn list_tenant_dbs(
-    Extension(agent): AgentExt,
-) -> Result<Json<ListTenantDbsResponse>, StatusCode> {
-    let names = agent.db_pool.list_tenant_db_names().await.map_err(|e| {
-        tracing::error!("admin: list_tenant_db_names failed: {e}");
-        StatusCode::INTERNAL_SERVER_ERROR
-    })?;
-    Ok(Json(ListTenantDbsResponse {
-        tenant_db_names: names,
-    }))
-}
-
-#[tracing::instrument(skip_all, fields(tenant_id = %tenant_id))]
-pub async fn drop_tenant_db(
-    Extension(agent): AgentExt,
-    Path(tenant_id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    agent.db_pool.drop_tenant(&tenant_id).await.map_err(|e| {
-        tracing::error!("admin: drop_tenant failed: {e}");
-        StatusCode::INTERNAL_SERVER_ERROR
-    })?;
-    Ok(Json(serde_json::json!({ "status": "dropped" })))
-}
-
-/// Constant-time-ish comparison of the configured admin token against
-/// the incoming bearer. Uses `subtle`-style byte equality so timing
-/// attacks can't probe the token character by character.
-fn tokens_eq(a: &str, b: &str) -> bool {
-    if a.len() != b.len() {
-        return false;
-    }
-    let mut diff = 0u8;
-    for (x, y) in a.bytes().zip(b.bytes()) {
-        diff |= x ^ y;
-    }
-    diff == 0
-}
-
-/// Middleware enforcing the static `ADMIN_API_TOKEN`. Mounted only on
-/// the admin sub-router, so this never runs on customer routes.
-pub async fn require_admin_token(
-    Extension(agent): AgentExt,
-    request: Request,
-    next: Next,
-) -> Response {
-    let Some(expected) = agent.config.admin_api_token.as_ref() else {
-        // Belt-and-braces — if the routes were somehow mounted without
-        // a token configured, refuse rather than no-op-pass.
-        return (StatusCode::NOT_FOUND, "admin disabled").into_response();
-    };
-    let presented = request
-        .headers()
-        .get(header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|s| s.strip_prefix("Bearer "))
-        .map(|s| s.trim());
-    let Some(presented) = presented.filter(|s| !s.is_empty()) else {
-        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
-    };
-    if !tokens_eq(presented, expected.expose_secret()) {
-        return (StatusCode::UNAUTHORIZED, "Invalid admin token").into_response();
-    }
-    next.run(request).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn tokens_eq_basic() {
-        assert!(tokens_eq("abc", "abc"));
-        assert!(!tokens_eq("abc", "abd"));
-        assert!(!tokens_eq("abc", "abcd"));
-        assert!(!tokens_eq("", "x"));
-        assert!(tokens_eq("", ""));
-    }
-}

compliance-agent/src/api/handlers/chat.rs

@@ -7,13 +7,11 @@ use mongodb::bson::doc;
 
 use compliance_core::models::chat::{ChatRequest, ChatResponse, SourceReference};
 use compliance_core::models::embedding::EmbeddingBuildRun;
-use compliance_core::tenant_ctx::TenantCtx;
 use compliance_graph::graph::embedding_store::EmbeddingStore;
 
 use crate::agent::ComplianceAgent;
 use crate::rag::pipeline::RagPipeline;
 
-use super::dto::tenant_db;
 use super::ApiResponse;
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
@@ -22,12 +20,10 @@ type AgentExt = Extension<Arc<ComplianceAgent>>;
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn chat(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
     Json(req): Json<ChatRequest>,
 ) -> Result<Json<ApiResponse<ChatResponse>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let pipeline = RagPipeline::new(agent.llm.clone(), agent.db.inner());
-    let pipeline = RagPipeline::new(agent.llm.clone(), db.inner());
 
     // Step 1: Embed the user's message
     let query_vectors = agent
@@ -94,13 +90,10 @@ pub async fn chat(
     };
 
     let system_prompt = format!(
-        "You are a code assistant for this repository. Answer questions using the code context below.\n\n\
+        "You are an expert code assistant for a software repository. \
-         Rules:\n\
+         Answer the user's question based on the code context below. \
-         - Reference specific files, functions, and line numbers\n\
+         Reference specific files and functions when relevant. \
-         - Show code snippets when they help explain the answer\n\
+         If the context doesn't contain enough information, say so.\n\n\
-         - If the context is insufficient, say what's missing rather than guessing\n\
-         - Be concise — lead with the answer, then explain if needed\n\
-         - For security questions, note relevant CWEs and link to the finding if one exists\n\n\
          ## Code Context\n\n{code_context}"
     );
 
@@ -137,15 +130,12 @@ pub async fn chat(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn build_embeddings(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    // Resolve the tenant DB up front so we can move it into the spawn;
-    // the JWT/dev context isn't available inside detached tasks.
-    let db = tenant_db(&agent, &tenant).await?;
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
-        let repo = match db
+        let repo = match agent_clone
+            .db
             .repositories()
             .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
             .await
@@ -158,7 +148,8 @@ pub async fn build_embeddings(
         };
 
         // Get latest graph build
-        let build = match db
+        let build = match agent_clone
+            .db
             .graph_builds()
             .find_one(doc! { "repo_id": &repo_id })
             .sort(doc! { "started_at": -1 })
@@ -177,22 +168,26 @@ pub async fn build_embeddings(
             .unwrap_or_else(|| "unknown".to_string());
 
         // Get nodes
-        let nodes: Vec<compliance_core::models::graph::CodeNode> =
+        let nodes: Vec<compliance_core::models::graph::CodeNode> = match agent_clone
-            match db.graph_nodes().find(doc! { "repo_id": &repo_id }).await {
+            .db
-                Ok(cursor) => {
+            .graph_nodes()
-                    use futures_util::StreamExt;
+            .find(doc! { "repo_id": &repo_id })
-                    let mut items = Vec::new();
+            .await
-                    let mut cursor = cursor;
+        {
-                    while let Some(Ok(item)) = cursor.next().await {
+            Ok(cursor) => {
-                        items.push(item);
+                use futures_util::StreamExt;
-                    }
+                let mut items = Vec::new();
-                    items
+                let mut cursor = cursor;
+                while let Some(Ok(item)) = cursor.next().await {
+                    items.push(item);
                 }
-                Err(e) => {
+                items
-                    tracing::error!("[{repo_id}] Failed to fetch nodes: {e}");
+            }
-                    return;
+            Err(e) => {
-                }
+                tracing::error!("[{repo_id}] Failed to fetch nodes: {e}");
-            };
+                return;
+            }
+        };
 
         let creds = crate::pipeline::git::RepoCredentials {
             ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
@@ -209,7 +204,7 @@ pub async fn build_embeddings(
             }
         };
 
-        let pipeline = RagPipeline::new(agent_clone.llm.clone(), db.inner());
+        let pipeline = RagPipeline::new(agent_clone.llm.clone(), agent_clone.db.inner());
         match pipeline
             .build_embeddings(&repo_id, &repo_path, &graph_build_id, &nodes)
             .await
@@ -236,11 +231,9 @@ pub async fn build_embeddings(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn embedding_status(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<Option<EmbeddingBuildRun>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let store = EmbeddingStore::new(agent.db.inner());
-    let store = EmbeddingStore::new(db.inner());
     let build = store.get_latest_build(&repo_id).await.map_err(|e| {
         tracing::error!("Failed to get embedding status: {e}");
         StatusCode::INTERNAL_SERVER_ERROR

compliance-agent/src/api/handlers/dast.rs

@@ -7,11 +7,9 @@ use mongodb::bson::doc;
 use serde::Deserialize;
 
 use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
-use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
-use super::dto::tenant_db;
 use super::{collect_cursor_async, ApiResponse, PaginationParams};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
@@ -47,11 +45,9 @@ fn default_rate_limit() -> u32 {
 #[tracing::instrument(skip_all)]
 pub async fn list_targets(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<DastTarget>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .dast_targets()
@@ -84,7 +80,6 @@ pub async fn list_targets(
 #[tracing::instrument(skip_all)]
 pub async fn add_target(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Json(req): Json<AddTargetRequest>,
 ) -> Result<Json<ApiResponse<DastTarget>>, StatusCode> {
     let mut target = DastTarget::new(req.name, req.base_url, req.target_type);
@@ -94,8 +89,9 @@ pub async fn add_target(
     target.rate_limit = req.rate_limit;
     target.allow_destructive = req.allow_destructive;
 
-    let db = tenant_db(&agent, &tenant).await?;
+    agent
-    db.dast_targets()
+        .db
+        .dast_targets()
         .insert_one(&target)
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
@@ -111,19 +107,19 @@ pub async fn add_target(
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn trigger_scan(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
 
-    let target = db
+    let target = agent
+        .db
         .dast_targets()
         .find_one(doc! { "_id": oid })
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
         .ok_or(StatusCode::NOT_FOUND)?;
 
+    let db = agent.db.clone();
     tokio::spawn(async move {
         let orchestrator = compliance_dast::DastOrchestrator::new(100);
         match orchestrator.run_scan(&target, Vec::new()).await {
@@ -151,11 +147,9 @@ pub async fn trigger_scan(
 #[tracing::instrument(skip_all)]
 pub async fn list_scan_runs(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<DastScanRun>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .dast_scan_runs()
@@ -189,11 +183,9 @@ pub async fn list_scan_runs(
 #[tracing::instrument(skip_all)]
 pub async fn list_findings(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<DastFinding>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .dast_findings()
@@ -227,13 +219,12 @@ pub async fn list_findings(
 #[tracing::instrument(skip_all, fields(finding_id = %id))]
 pub async fn get_finding(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<DastFinding>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
 
-    let finding = db
+    let finding = agent
+        .db
         .dast_findings()
         .find_one(doc! { "_id": oid })
         .await

compliance-agent/src/api/handlers/dto.rs

@@ -1,502 +0,0 @@
-use compliance_core::models::TrackerType;
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::ScanRun;
-
-#[derive(Deserialize)]
-pub struct PaginationParams {
-    #[serde(default = "default_page")]
-    pub page: u64,
-    #[serde(default = "default_limit")]
-    pub limit: i64,
-}
-
-pub(crate) fn default_page() -> u64 {
-    1
-}
-pub(crate) fn default_limit() -> i64 {
-    50
-}
-
-#[derive(Deserialize)]
-pub struct FindingsFilter {
-    #[serde(default)]
-    pub repo_id: Option<String>,
-    #[serde(default)]
-    pub severity: Option<String>,
-    #[serde(default)]
-    pub scan_type: Option<String>,
-    #[serde(default)]
-    pub status: Option<String>,
-    #[serde(default)]
-    pub q: Option<String>,
-    #[serde(default)]
-    pub sort_by: Option<String>,
-    #[serde(default)]
-    pub sort_order: Option<String>,
-    #[serde(default = "default_page")]
-    pub page: u64,
-    #[serde(default = "default_limit")]
-    pub limit: i64,
-}
-
-#[derive(Serialize)]
-pub struct ApiResponse<T: Serialize> {
-    pub data: T,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub total: Option<u64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub page: Option<u64>,
-}
-
-#[derive(Serialize)]
-pub struct OverviewStats {
-    pub total_repositories: u64,
-    pub total_findings: u64,
-    pub critical_findings: u64,
-    pub high_findings: u64,
-    pub medium_findings: u64,
-    pub low_findings: u64,
-    pub total_sbom_entries: u64,
-    pub total_cve_alerts: u64,
-    pub total_issues: u64,
-    pub recent_scans: Vec<ScanRun>,
-}
-
-#[derive(Deserialize)]
-pub struct AddRepositoryRequest {
-    pub name: String,
-    pub git_url: String,
-    #[serde(default = "default_branch")]
-    pub default_branch: String,
-    pub auth_token: Option<String>,
-    pub auth_username: Option<String>,
-    pub tracker_type: Option<TrackerType>,
-    pub tracker_owner: Option<String>,
-    pub tracker_repo: Option<String>,
-    pub tracker_token: Option<String>,
-    pub scan_schedule: Option<String>,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateRepositoryRequest {
-    pub name: Option<String>,
-    pub default_branch: Option<String>,
-    pub auth_token: Option<String>,
-    pub auth_username: Option<String>,
-    pub tracker_type: Option<TrackerType>,
-    pub tracker_owner: Option<String>,
-    pub tracker_repo: Option<String>,
-    pub tracker_token: Option<String>,
-    pub scan_schedule: Option<String>,
-}
-
-fn default_branch() -> String {
-    "main".to_string()
-}
-
-#[derive(Deserialize)]
-pub struct UpdateStatusRequest {
-    pub status: String,
-}
-
-#[derive(Deserialize)]
-pub struct BulkUpdateStatusRequest {
-    pub ids: Vec<String>,
-    pub status: String,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateFeedbackRequest {
-    pub feedback: String,
-}
-
-#[derive(Deserialize)]
-pub struct SbomFilter {
-    #[serde(default)]
-    pub repo_id: Option<String>,
-    #[serde(default)]
-    pub package_manager: Option<String>,
-    #[serde(default)]
-    pub q: Option<String>,
-    #[serde(default)]
-    pub has_vulns: Option<bool>,
-    #[serde(default)]
-    pub license: Option<String>,
-    #[serde(default = "default_page")]
-    pub page: u64,
-    #[serde(default = "default_limit")]
-    pub limit: i64,
-}
-
-#[derive(Deserialize)]
-pub struct SbomExportParams {
-    pub repo_id: String,
-    #[serde(default = "default_export_format")]
-    pub format: String,
-}
-
-fn default_export_format() -> String {
-    "cyclonedx".to_string()
-}
-
-#[derive(Deserialize)]
-pub struct SbomDiffParams {
-    pub repo_a: String,
-    pub repo_b: String,
-}
-
-#[derive(Serialize)]
-pub struct LicenseSummary {
-    pub license: String,
-    pub count: u64,
-    pub is_copyleft: bool,
-    pub packages: Vec<String>,
-}
-
-#[derive(Serialize)]
-pub struct SbomDiffResult {
-    pub only_in_a: Vec<SbomDiffEntry>,
-    pub only_in_b: Vec<SbomDiffEntry>,
-    pub version_changed: Vec<SbomVersionDiff>,
-    pub common_count: u64,
-}
-
-#[derive(Serialize)]
-pub struct SbomDiffEntry {
-    pub name: String,
-    pub version: String,
-    pub package_manager: String,
-}
-
-#[derive(Serialize)]
-pub struct SbomVersionDiff {
-    pub name: String,
-    pub package_manager: String,
-    pub version_a: String,
-    pub version_b: String,
-}
-
-pub(crate) type AgentExt = axum::extract::Extension<std::sync::Arc<crate::agent::ComplianceAgent>>;
-pub(crate) type ApiResult<T> = Result<axum::Json<ApiResponse<T>>, axum::http::StatusCode>;
-
-/// Resolve a tenant-scoped [`Database`] from the request's
-/// [`TenantContext`] (inserted by the M7.1 JWT middleware, or by the
-/// dev fallback in unsecured environments). The pool ensures the
-/// tenant's indexes idempotently.
-///
-/// Returns 500 on the rare path where Mongo refuses the database
-/// handle — the M7.1 auth/status middleware already rejects every
-/// other failure mode with 4xx before we get here.
-pub(crate) async fn tenant_db(
-    agent: &crate::agent::ComplianceAgent,
-    tenant: &compliance_core::tenant_ctx::TenantCtx,
-) -> Result<crate::database::Database, axum::http::StatusCode> {
-    agent.db_pool.for_tenant(&tenant.0).await.map_err(|e| {
-        tracing::error!(
-            tenant_id = %tenant.0.tenant_id,
-            "Failed to acquire tenant database: {e}"
-        );
-        axum::http::StatusCode::INTERNAL_SERVER_ERROR
-    })
-}
-
-pub(crate) async fn collect_cursor_async<T: serde::de::DeserializeOwned + Unpin + Send>(
-    mut cursor: mongodb::Cursor<T>,
-) -> Vec<T> {
-    use futures_util::StreamExt;
-    let mut items = Vec::new();
-    while let Some(result) = cursor.next().await {
-        match result {
-            Ok(item) => items.push(item),
-            Err(e) => tracing::warn!("Failed to deserialize document: {e}"),
-        }
-    }
-    items
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    // ── PaginationParams ─────────────────────────────────────────
-
-    #[test]
-    fn pagination_params_defaults() {
-        let p: PaginationParams = serde_json::from_str("{}").unwrap();
-        assert_eq!(p.page, 1);
-        assert_eq!(p.limit, 50);
-    }
-
-    #[test]
-    fn pagination_params_custom_values() {
-        let p: PaginationParams = serde_json::from_str(r#"{"page":3,"limit":10}"#).unwrap();
-        assert_eq!(p.page, 3);
-        assert_eq!(p.limit, 10);
-    }
-
-    #[test]
-    fn pagination_params_partial_override() {
-        let p: PaginationParams = serde_json::from_str(r#"{"page":5}"#).unwrap();
-        assert_eq!(p.page, 5);
-        assert_eq!(p.limit, 50);
-    }
-
-    #[test]
-    fn pagination_params_zero_page() {
-        let p: PaginationParams = serde_json::from_str(r#"{"page":0}"#).unwrap();
-        assert_eq!(p.page, 0);
-    }
-
-    // ── FindingsFilter ───────────────────────────────────────────
-
-    #[test]
-    fn findings_filter_all_defaults() {
-        let f: FindingsFilter = serde_json::from_str("{}").unwrap();
-        assert!(f.repo_id.is_none());
-        assert!(f.severity.is_none());
-        assert!(f.scan_type.is_none());
-        assert!(f.status.is_none());
-        assert!(f.q.is_none());
-        assert!(f.sort_by.is_none());
-        assert!(f.sort_order.is_none());
-        assert_eq!(f.page, 1);
-        assert_eq!(f.limit, 50);
-    }
-
-    #[test]
-    fn findings_filter_with_all_fields() {
-        let f: FindingsFilter = serde_json::from_str(
-            r#"{
-            "repo_id": "abc",
-            "severity": "high",
-            "scan_type": "sast",
-            "status": "open",
-            "q": "sql injection",
-            "sort_by": "severity",
-            "sort_order": "desc",
-            "page": 2,
-            "limit": 25
-        }"#,
-        )
-        .unwrap();
-        assert_eq!(f.repo_id.as_deref(), Some("abc"));
-        assert_eq!(f.severity.as_deref(), Some("high"));
-        assert_eq!(f.scan_type.as_deref(), Some("sast"));
-        assert_eq!(f.status.as_deref(), Some("open"));
-        assert_eq!(f.q.as_deref(), Some("sql injection"));
-        assert_eq!(f.sort_by.as_deref(), Some("severity"));
-        assert_eq!(f.sort_order.as_deref(), Some("desc"));
-        assert_eq!(f.page, 2);
-        assert_eq!(f.limit, 25);
-    }
-
-    #[test]
-    fn findings_filter_empty_string_fields() {
-        let f: FindingsFilter = serde_json::from_str(r#"{"repo_id":"","severity":""}"#).unwrap();
-        assert_eq!(f.repo_id.as_deref(), Some(""));
-        assert_eq!(f.severity.as_deref(), Some(""));
-    }
-
-    // ── ApiResponse ──────────────────────────────────────────────
-
-    #[test]
-    fn api_response_serializes_with_all_fields() {
-        let resp = ApiResponse {
-            data: vec!["a", "b"],
-            total: Some(100),
-            page: Some(1),
-        };
-        let v = serde_json::to_value(&resp).unwrap();
-        assert_eq!(v["data"], json!(["a", "b"]));
-        assert_eq!(v["total"], 100);
-        assert_eq!(v["page"], 1);
-    }
-
-    #[test]
-    fn api_response_skips_none_fields() {
-        let resp = ApiResponse {
-            data: "hello",
-            total: None,
-            page: None,
-        };
-        let v = serde_json::to_value(&resp).unwrap();
-        assert_eq!(v["data"], "hello");
-        assert!(v.get("total").is_none());
-        assert!(v.get("page").is_none());
-    }
-
-    #[test]
-    fn api_response_with_nested_struct() {
-        #[derive(Serialize)]
-        struct Item {
-            id: u32,
-        }
-        let resp = ApiResponse {
-            data: Item { id: 42 },
-            total: Some(1),
-            page: None,
-        };
-        let v = serde_json::to_value(&resp).unwrap();
-        assert_eq!(v["data"]["id"], 42);
-        assert_eq!(v["total"], 1);
-        assert!(v.get("page").is_none());
-    }
-
-    #[test]
-    fn api_response_empty_vec() {
-        let resp: ApiResponse<Vec<String>> = ApiResponse {
-            data: vec![],
-            total: Some(0),
-            page: Some(1),
-        };
-        let v = serde_json::to_value(&resp).unwrap();
-        assert!(v["data"].as_array().unwrap().is_empty());
-    }
-
-    // ── SbomFilter ───────────────────────────────────────────────
-
-    #[test]
-    fn sbom_filter_defaults() {
-        let f: SbomFilter = serde_json::from_str("{}").unwrap();
-        assert!(f.repo_id.is_none());
-        assert!(f.package_manager.is_none());
-        assert!(f.q.is_none());
-        assert!(f.has_vulns.is_none());
-        assert!(f.license.is_none());
-        assert_eq!(f.page, 1);
-        assert_eq!(f.limit, 50);
-    }
-
-    #[test]
-    fn sbom_filter_has_vulns_bool() {
-        let f: SbomFilter = serde_json::from_str(r#"{"has_vulns": true}"#).unwrap();
-        assert_eq!(f.has_vulns, Some(true));
-    }
-
-    // ── SbomExportParams ─────────────────────────────────────────
-
-    #[test]
-    fn sbom_export_params_default_format() {
-        let p: SbomExportParams = serde_json::from_str(r#"{"repo_id":"r1"}"#).unwrap();
-        assert_eq!(p.repo_id, "r1");
-        assert_eq!(p.format, "cyclonedx");
-    }
-
-    #[test]
-    fn sbom_export_params_custom_format() {
-        let p: SbomExportParams =
-            serde_json::from_str(r#"{"repo_id":"r1","format":"spdx"}"#).unwrap();
-        assert_eq!(p.format, "spdx");
-    }
-
-    // ── AddRepositoryRequest ─────────────────────────────────────
-
-    #[test]
-    fn add_repository_request_defaults() {
-        let r: AddRepositoryRequest = serde_json::from_str(
-            r#"{
-            "name": "my-repo",
-            "git_url": "https://github.com/x/y.git"
-        }"#,
-        )
-        .unwrap();
-        assert_eq!(r.name, "my-repo");
-        assert_eq!(r.git_url, "https://github.com/x/y.git");
-        assert_eq!(r.default_branch, "main");
-        assert!(r.auth_token.is_none());
-        assert!(r.tracker_type.is_none());
-        assert!(r.scan_schedule.is_none());
-    }
-
-    #[test]
-    fn add_repository_request_custom_branch() {
-        let r: AddRepositoryRequest = serde_json::from_str(
-            r#"{
-            "name": "repo",
-            "git_url": "url",
-            "default_branch": "develop"
-        }"#,
-        )
-        .unwrap();
-        assert_eq!(r.default_branch, "develop");
-    }
-
-    // ── UpdateStatusRequest / BulkUpdateStatusRequest ────────────
-
-    #[test]
-    fn update_status_request() {
-        let r: UpdateStatusRequest = serde_json::from_str(r#"{"status":"resolved"}"#).unwrap();
-        assert_eq!(r.status, "resolved");
-    }
-
-    #[test]
-    fn bulk_update_status_request() {
-        let r: BulkUpdateStatusRequest =
-            serde_json::from_str(r#"{"ids":["a","b"],"status":"dismissed"}"#).unwrap();
-        assert_eq!(r.ids, vec!["a", "b"]);
-        assert_eq!(r.status, "dismissed");
-    }
-
-    #[test]
-    fn bulk_update_status_empty_ids() {
-        let r: BulkUpdateStatusRequest =
-            serde_json::from_str(r#"{"ids":[],"status":"x"}"#).unwrap();
-        assert!(r.ids.is_empty());
-    }
-
-    // ── SbomDiffResult serialization ─────────────────────────────
-
-    #[test]
-    fn sbom_diff_result_serializes() {
-        let r = SbomDiffResult {
-            only_in_a: vec![SbomDiffEntry {
-                name: "pkg-a".to_string(),
-                version: "1.0".to_string(),
-                package_manager: "npm".to_string(),
-            }],
-            only_in_b: vec![],
-            version_changed: vec![SbomVersionDiff {
-                name: "shared".to_string(),
-                package_manager: "cargo".to_string(),
-                version_a: "0.1".to_string(),
-                version_b: "0.2".to_string(),
-            }],
-            common_count: 10,
-        };
-        let v = serde_json::to_value(&r).unwrap();
-        assert_eq!(v["only_in_a"].as_array().unwrap().len(), 1);
-        assert_eq!(v["only_in_b"].as_array().unwrap().len(), 0);
-        assert_eq!(v["version_changed"][0]["version_a"], "0.1");
-        assert_eq!(v["common_count"], 10);
-    }
-
-    // ── LicenseSummary ───────────────────────────────────────────
-
-    #[test]
-    fn license_summary_serializes() {
-        let ls = LicenseSummary {
-            license: "MIT".to_string(),
-            count: 42,
-            is_copyleft: false,
-            packages: vec!["serde".to_string()],
-        };
-        let v = serde_json::to_value(&ls).unwrap();
-        assert_eq!(v["license"], "MIT");
-        assert_eq!(v["is_copyleft"], false);
-        assert_eq!(v["count"], 42);
-    }
-
-    // ── Default helper functions ─────────────────────────────────
-
-    #[test]
-    fn default_page_returns_1() {
-        assert_eq!(default_page(), 1);
-    }
-
-    #[test]
-    fn default_limit_returns_50() {
-        assert_eq!(default_limit(), 50);
-    }
-}

compliance-agent/src/api/handlers/findings.rs

@@ -1,177 +0,0 @@
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::Finding;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all, fields(repo_id = ?filter.repo_id, severity = ?filter.severity, scan_type = ?filter.scan_type))]
-pub async fn list_findings(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(filter): Query<FindingsFilter>,
-) -> ApiResult<Vec<Finding>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let mut query = doc! {};
-    if let Some(repo_id) = &filter.repo_id {
-        query.insert("repo_id", repo_id);
-    }
-    if let Some(severity) = &filter.severity {
-        query.insert("severity", severity);
-    }
-    if let Some(scan_type) = &filter.scan_type {
-        query.insert("scan_type", scan_type);
-    }
-    if let Some(status) = &filter.status {
-        query.insert("status", status);
-    }
-    // Text search across title, description, file_path, rule_id
-    if let Some(q) = &filter.q {
-        if !q.is_empty() {
-            let regex = doc! { "$regex": q, "$options": "i" };
-            query.insert(
-                "$or",
-                mongodb::bson::bson!([
-                    { "title": regex.clone() },
-                    { "description": regex.clone() },
-                    { "file_path": regex.clone() },
-                    { "rule_id": regex },
-                ]),
-            );
-        }
-    }
-
-    // Dynamic sort
-    let sort_field = filter.sort_by.as_deref().unwrap_or("created_at");
-    let sort_dir: i32 = match filter.sort_order.as_deref() {
-        Some("asc") => 1,
-        _ => -1,
-    };
-    let sort_doc = doc! { sort_field: sort_dir };
-
-    let skip = (filter.page.saturating_sub(1)) * filter.limit as u64;
-    let total = db
-        .findings()
-        .count_documents(query.clone())
-        .await
-        .unwrap_or(0);
-
-    let findings = match db
-        .findings()
-        .find(query)
-        .sort(sort_doc)
-        .skip(skip)
-        .limit(filter.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch findings: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: findings,
-        total: Some(total),
-        page: Some(filter.page),
-    }))
-}
-
-#[tracing::instrument(skip_all, fields(finding_id = %id))]
-pub async fn get_finding(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<Finding>>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let finding = db
-        .findings()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    Ok(Json(ApiResponse {
-        data: finding,
-        total: None,
-        page: None,
-    }))
-}
-
-#[tracing::instrument(skip_all, fields(finding_id = %id))]
-pub async fn update_finding_status(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateStatusRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    db.findings()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "status": &req.status, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    Ok(Json(serde_json::json!({ "status": "updated" })))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn bulk_update_finding_status(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<BulkUpdateStatusRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oids: Vec<mongodb::bson::oid::ObjectId> = req
-        .ids
-        .iter()
-        .filter_map(|id| mongodb::bson::oid::ObjectId::parse_str(id).ok())
-        .collect();
-
-    if oids.is_empty() {
-        return Err(StatusCode::BAD_REQUEST);
-    }
-
-    let db = tenant_db(&agent, &tenant).await?;
-    let result = db
-        .findings()
-        .update_many(
-            doc! { "_id": { "$in": oids } },
-            doc! { "$set": { "status": &req.status, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    Ok(Json(
-        serde_json::json!({ "status": "updated", "modified_count": result.modified_count }),
-    ))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn update_finding_feedback(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateFeedbackRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    db.findings()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "developer_feedback": &req.feedback, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    Ok(Json(serde_json::json!({ "status": "updated" })))
-}

compliance-agent/src/api/handlers/graph.rs

@@ -7,11 +7,9 @@ use mongodb::bson::doc;
 use serde::{Deserialize, Serialize};
 
 use compliance_core::models::graph::{CodeEdge, CodeNode, GraphBuildRun, ImpactAnalysis};
-use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
-use super::dto::tenant_db;
 use super::{collect_cursor_async, ApiResponse};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
@@ -38,11 +36,9 @@ fn default_search_limit() -> usize {
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_graph(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<GraphData>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
 
     // Get latest build
     let build: Option<GraphBuildRun> = db
@@ -102,11 +98,9 @@ pub async fn get_graph(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_nodes(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<Vec<CodeNode>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
     let filter = doc! { "repo_id": &repo_id };
 
     let nodes: Vec<CodeNode> = match db.graph_nodes().find(filter).await {
@@ -129,11 +123,9 @@ pub async fn get_nodes(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_communities(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<Vec<CommunityInfo>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
     let filter = doc! { "repo_id": &repo_id };
 
     let nodes: Vec<CodeNode> = match db.graph_nodes().find(filter).await {
@@ -184,11 +176,9 @@ pub struct CommunityInfo {
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id, finding_id = %finding_id))]
 pub async fn get_impact(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path((repo_id, finding_id)): Path<(String, String)>,
 ) -> Result<Json<ApiResponse<Option<ImpactAnalysis>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
     let filter = doc! { "repo_id": &repo_id, "finding_id": &finding_id };
 
     let impact = db
@@ -208,12 +198,10 @@ pub async fn get_impact(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id, query = %params.q))]
 pub async fn search_symbols(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
     Query(params): Query<SearchParams>,
 ) -> Result<Json<ApiResponse<Vec<CodeNode>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
 
     // Simple text search on qualified_name and name fields
     let filter = doc! {
@@ -246,12 +234,10 @@ pub async fn search_symbols(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_file_content(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
     Query(params): Query<FileContentParams>,
 ) -> Result<Json<ApiResponse<FileContent>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
+    let db = &agent.db;
-    let db = &db;
 
     // Look up the repository to get repo name
     let repo = db
@@ -310,13 +296,12 @@ pub struct FileContent {
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn trigger_build(
     Extension(agent): AgentExt,
-    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
-        let repo = match db
+        let repo = match agent_clone
+            .db
             .repositories()
             .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
             .await
@@ -348,7 +333,8 @@ pub async fn trigger_build(
 
         match engine.build_graph(&repo_path, &repo_id, &graph_build_id) {
             Ok((code_graph, build_run)) => {
-                let store = compliance_graph::graph::persistence::GraphStore::new(db.inner());
+                let store =
+                    compliance_graph::graph::persistence::GraphStore::new(agent_clone.db.inner());
                 let _ = store.delete_repo_graph(&repo_id).await;
                 let _ = store
                     .store_graph(&build_run, &code_graph.nodes, &code_graph.edges)

compliance-agent/src/api/handlers/health.rs

@@ -1,89 +0,0 @@
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::ScanRun;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all)]
-pub async fn health() -> Json<serde_json::Value> {
-    Json(serde_json::json!({ "status": "ok" }))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn stats_overview(
-    axum::extract::Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> ApiResult<OverviewStats> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    let total_repositories = db
-        .repositories()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-    let total_findings = db.findings().count_documents(doc! {}).await.unwrap_or(0);
-    let critical_findings = db
-        .findings()
-        .count_documents(doc! { "severity": "critical" })
-        .await
-        .unwrap_or(0);
-    let high_findings = db
-        .findings()
-        .count_documents(doc! { "severity": "high" })
-        .await
-        .unwrap_or(0);
-    let medium_findings = db
-        .findings()
-        .count_documents(doc! { "severity": "medium" })
-        .await
-        .unwrap_or(0);
-    let low_findings = db
-        .findings()
-        .count_documents(doc! { "severity": "low" })
-        .await
-        .unwrap_or(0);
-    let total_sbom_entries = db
-        .sbom_entries()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-    let total_cve_alerts = db.cve_alerts().count_documents(doc! {}).await.unwrap_or(0);
-    let total_issues = db
-        .tracker_issues()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-
-    let recent_scans: Vec<ScanRun> = match db
-        .scan_runs()
-        .find(doc! {})
-        .sort(doc! { "started_at": -1 })
-        .limit(10)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch recent scans: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: OverviewStats {
-            total_repositories,
-            total_findings,
-            critical_findings,
-            high_findings,
-            medium_findings,
-            low_findings,
-            total_sbom_entries,
-            total_cve_alerts,
-            total_issues,
-            recent_scans,
-        },
-        total: None,
-        page: None,
-    }))
-}

compliance-agent/src/api/handlers/help_chat.rs

@@ -1,217 +0,0 @@
-use std::path::{Path, PathBuf};
-use std::sync::OnceLock;
-
-use axum::extract::Extension;
-use axum::http::StatusCode;
-use axum::Json;
-use serde::{Deserialize, Serialize};
-use walkdir::WalkDir;
-
-use super::dto::{AgentExt, ApiResponse};
-
-// ── DTOs ─────────────────────────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct HelpChatMessage {
-    pub role: String,
-    pub content: String,
-}
-
-#[derive(Debug, Deserialize)]
-pub struct HelpChatRequest {
-    pub message: String,
-    #[serde(default)]
-    pub history: Vec<HelpChatMessage>,
-}
-
-#[derive(Debug, Serialize)]
-pub struct HelpChatResponse {
-    pub message: String,
-}
-
-// ── Doc cache ────────────────────────────────────────────────────────────────
-
-static DOC_CONTEXT: OnceLock<String> = OnceLock::new();
-
-/// Walk upward from `start` until we find a directory containing both
-/// `README.md` and a `docs/` subdirectory.
-fn find_project_root(start: &Path) -> Option<PathBuf> {
-    let mut current = start.to_path_buf();
-    loop {
-        if current.join("README.md").is_file() && current.join("docs").is_dir() {
-            return Some(current);
-        }
-        if !current.pop() {
-            return None;
-        }
-    }
-}
-
-/// Read README.md + all docs/**/*.md (excluding node_modules).
-fn load_docs(root: &Path) -> String {
-    let mut parts: Vec<String> = Vec::new();
-
-    // Root README first
-    if let Ok(content) = std::fs::read_to_string(root.join("README.md")) {
-        parts.push(format!("<!-- file: README.md -->\n{content}"));
-    }
-
-    // docs/**/*.md, skipping node_modules
-    for entry in WalkDir::new(root.join("docs"))
-        .follow_links(false)
-        .into_iter()
-        .filter_entry(|e| {
-            !e.path()
-                .components()
-                .any(|c| c.as_os_str() == "node_modules")
-        })
-        .filter_map(|e| e.ok())
-    {
-        let path = entry.path();
-        if !path.is_file() {
-            continue;
-        }
-        if path
-            .extension()
-            .and_then(|s| s.to_str())
-            .map(|s| !s.eq_ignore_ascii_case("md"))
-            .unwrap_or(true)
-        {
-            continue;
-        }
-
-        let rel = path.strip_prefix(root).unwrap_or(path);
-        if let Ok(content) = std::fs::read_to_string(path) {
-            parts.push(format!("<!-- file: {} -->\n{content}", rel.display()));
-        }
-    }
-
-    if parts.is_empty() {
-        tracing::warn!(
-            "help_chat: no documentation files found under {}",
-            root.display()
-        );
-    } else {
-        tracing::info!(
-            "help_chat: loaded {} documentation file(s) from {}",
-            parts.len(),
-            root.display()
-        );
-    }
-
-    parts.join("\n\n---\n\n")
-}
-
-/// Returns a reference to the cached doc context string, initialised on
-/// first call via `OnceLock`.
-///
-/// Discovery order:
-/// 1. `HELP_DOCS_PATH` env var (explicit override)
-/// 2. Walk up from the binary location
-/// 3. Current working directory
-/// 4. Common Docker paths (/app, /opt/compliance-scanner)
-fn doc_context() -> &'static str {
-    DOC_CONTEXT.get_or_init(|| {
-        // 1. Explicit env var
-        if let Ok(path) = std::env::var("HELP_DOCS_PATH") {
-            let p = PathBuf::from(&path);
-            if p.join("README.md").is_file() || p.join("docs").is_dir() {
-                tracing::info!("help_chat: loading docs from HELP_DOCS_PATH={path}");
-                return load_docs(&p);
-            }
-            tracing::warn!("help_chat: HELP_DOCS_PATH={path} has no README.md or docs/");
-        }
-
-        // 2. Walk up from binary location
-        let start = std::env::current_exe()
-            .ok()
-            .and_then(|p| p.parent().map(Path::to_path_buf))
-            .unwrap_or_else(|| PathBuf::from("."));
-
-        if let Some(root) = find_project_root(&start) {
-            return load_docs(&root);
-        }
-
-        // 3. Current working directory
-        if let Ok(cwd) = std::env::current_dir() {
-            if let Some(root) = find_project_root(&cwd) {
-                return load_docs(&root);
-            }
-            if cwd.join("README.md").is_file() {
-                return load_docs(&cwd);
-            }
-        }
-
-        // 4. Common Docker/deployment paths
-        for candidate in ["/app", "/opt/compliance-scanner", "/srv/compliance-scanner"] {
-            let p = PathBuf::from(candidate);
-            if p.join("README.md").is_file() || p.join("docs").is_dir() {
-                tracing::info!("help_chat: found docs at {candidate}");
-                return load_docs(&p);
-            }
-        }
-
-        tracing::error!(
-            "help_chat: could not locate project root; doc context will be empty. \
-             Set HELP_DOCS_PATH to the directory containing README.md and docs/"
-        );
-        String::new()
-    })
-}
-
-// ── Handler ──────────────────────────────────────────────────────────────────
-
-/// POST /api/v1/help/chat — Answer questions about the compliance-scanner
-/// using the project documentation as grounding context.
-#[tracing::instrument(skip_all)]
-pub async fn help_chat(
-    Extension(agent): AgentExt,
-    Json(req): Json<HelpChatRequest>,
-) -> Result<Json<ApiResponse<HelpChatResponse>>, StatusCode> {
-    let context = doc_context();
-
-    let system_prompt = if context.is_empty() {
-        "You are a helpful assistant for the Compliance Scanner project. \
-         Answer questions about how to use and configure it. \
-         No documentation was loaded at startup, so rely on your general knowledge."
-            .to_string()
-    } else {
-        format!(
-            "You are a helpful assistant for the Compliance Scanner project. \
-             Answer questions about how to use, configure, and understand it \
-             using the documentation below as your primary source of truth.\n\n\
-             Rules:\n\
-             - Prefer information from the provided docs over general knowledge\n\
-             - Quote or reference the relevant doc section when it helps\n\
-             - If the docs do not cover the topic, say so clearly\n\
-             - Be concise — lead with the answer, then explain if needed\n\
-             - Use markdown formatting for readability\n\n\
-             ## Project Documentation\n\n{context}"
-        )
-    };
-
-    let mut messages: Vec<(String, String)> = Vec::with_capacity(req.history.len() + 2);
-    messages.push(("system".to_string(), system_prompt));
-
-    for msg in &req.history {
-        messages.push((msg.role.clone(), msg.content.clone()));
-    }
-    messages.push(("user".to_string(), req.message));
-
-    let response_text = agent
-        .llm
-        .chat_with_messages(messages, Some(0.3))
-        .await
-        .map_err(|e| {
-            tracing::error!("LLM help chat failed: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-
-    Ok(Json(ApiResponse {
-        data: HelpChatResponse {
-            message: response_text,
-        },
-        total: None,
-        page: None,
-    }))
-}

compliance-agent/src/api/handlers/issues.rs

@@ -1,44 +0,0 @@
-use axum::extract::{Extension, Query};
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::TrackerIssue;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all)]
-pub async fn list_issues(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> ApiResult<Vec<TrackerIssue>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .tracker_issues()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-
-    let issues = match db
-        .tracker_issues()
-        .find(doc! {})
-        .sort(doc! { "created_at": -1 })
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch tracker issues: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: issues,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}

compliance-agent/src/api/handlers/mcp_tokens.rs

@@ -1,186 +0,0 @@
-//! `/api/v1/mcp-tokens` — per-tenant API tokens for the MCP server.
-//!
-//! These are opaque static bearers issued via the dashboard (or a
-//! direct curl with a KC JWT) and copied into LLM clients (Claude
-//! Desktop / Cursor / ChatGPT). The MCP server hashes incoming bearers
-//! and looks them up in the cross-tenant `<prefix>__admin.mcp_tokens`
-//! collection to derive the tenant_id for routing.
-//!
-//! The raw token is shown to the caller exactly once at creation; the
-//! database only ever stores the SHA-256 hash. Revocation is a soft
-//! delete (sets `revoked: true`) so the audit log keeps the record.
-
-use axum::extract::{Extension, Path};
-use axum::http::StatusCode;
-use axum::Json;
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use compliance_core::models::{McpToken, McpTokenView};
-use compliance_core::tenant_ctx::TenantCtx;
-use mongodb::bson::doc;
-use rand::RngCore;
-use sha2::{Digest, Sha256};
-
-use super::dto::{AgentExt, ApiResponse};
-
-/// Mongo collection name inside the admin DB.
-const COLLECTION: &str = "mcp_tokens";
-
-/// Token prefix the MCP server expects on every bearer.
-const TOKEN_PREFIX: &str = "mcpt_";
-
-/// Bytes of randomness behind each token. 32 → ~256 bits.
-/// Encoded as URL-safe base64 without padding → 43 chars.
-/// Combined with `mcpt_` → 48-char tokens.
-const TOKEN_RAND_BYTES: usize = 32;
-
-#[derive(serde::Deserialize)]
-pub struct CreateMcpTokenRequest {
-    pub name: String,
-}
-
-/// Returned exactly once at creation. The `token` field is gone from
-/// the listing endpoint — the user must save it now.
-#[derive(serde::Serialize)]
-pub struct CreateMcpTokenResponse {
-    pub token: String,
-    pub view: McpTokenView,
-}
-
-/// `POST /api/v1/mcp-tokens` — mint a new token for the caller's tenant.
-#[tracing::instrument(skip_all)]
-pub async fn create_mcp_token(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<CreateMcpTokenRequest>,
-) -> Result<Json<CreateMcpTokenResponse>, StatusCode> {
-    if req.name.trim().is_empty() {
-        return Err(StatusCode::BAD_REQUEST);
-    }
-    let raw = generate_token();
-    let token_hash = sha256_hex(&raw);
-    let token_prefix: String = raw.chars().take(12).collect();
-
-    let mut token = McpToken {
-        id: None,
-        token_hash,
-        token_prefix,
-        tenant_id: tenant.0.tenant_id.clone(),
-        name: req.name.trim().to_string(),
-        created_by: tenant.0.user_id.clone(),
-        created_at: chrono::Utc::now(),
-        last_used_at: None,
-        revoked: false,
-    };
-
-    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
-    let res = col.insert_one(&token).await.map_err(|e| {
-        tracing::error!("Failed to insert MCP token: {e}");
-        StatusCode::INTERNAL_SERVER_ERROR
-    })?;
-    token.id = res.inserted_id.as_object_id();
-
-    Ok(Json(CreateMcpTokenResponse {
-        view: McpTokenView::from(&token),
-        token: raw,
-    }))
-}
-
-/// `GET /api/v1/mcp-tokens` — list tokens for the caller's tenant.
-/// Hash is never returned; only metadata + the 12-char prefix so the
-/// user can identify which row is which.
-#[tracing::instrument(skip_all)]
-pub async fn list_mcp_tokens(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> Result<Json<ApiResponse<Vec<McpTokenView>>>, StatusCode> {
-    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
-    let mut cursor = col
-        .find(doc! { "tenant_id": &tenant.0.tenant_id })
-        .sort(doc! { "created_at": -1 })
-        .await
-        .map_err(|e| {
-            tracing::error!("Failed to list MCP tokens: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-    let mut out = Vec::new();
-    while cursor.advance().await.map_err(|e| {
-        tracing::warn!("MCP tokens cursor advance failed: {e}");
-        StatusCode::INTERNAL_SERVER_ERROR
-    })? {
-        match cursor.deserialize_current() {
-            Ok(t) => out.push(McpTokenView::from(&t)),
-            Err(e) => tracing::warn!("Failed to deserialize MCP token: {e}"),
-        }
-    }
-    Ok(Json(ApiResponse {
-        data: out,
-        total: None,
-        page: None,
-    }))
-}
-
-/// `DELETE /api/v1/mcp-tokens/{id}` — revoke (soft delete).
-/// Scoped to the caller's tenant: a user can't revoke another tenant's
-/// token even if they guess its id.
-#[tracing::instrument(skip_all, fields(id = %id))]
-pub async fn revoke_mcp_token(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
-    let result = col
-        .update_one(
-            doc! { "_id": oid, "tenant_id": &tenant.0.tenant_id },
-            doc! { "$set": { "revoked": true } },
-        )
-        .await
-        .map_err(|e| {
-            tracing::error!("Failed to revoke MCP token: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-    Ok(Json(serde_json::json!({ "status": "revoked" })))
-}
-
-/// 32 bytes random → URL-safe base64 → 43 chars, no padding.
-/// Prefixed with `mcpt_` so the MCP server can sniff the format
-/// before bothering with the DB lookup.
-fn generate_token() -> String {
-    let mut bytes = [0u8; TOKEN_RAND_BYTES];
-    rand::rng().fill_bytes(&mut bytes);
-    format!("{TOKEN_PREFIX}{}", URL_SAFE_NO_PAD.encode(bytes))
-}
-
-fn sha256_hex(s: &str) -> String {
-    let mut h = Sha256::new();
-    h.update(s.as_bytes());
-    hex::encode(h.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn generated_tokens_are_unique_and_prefixed() {
-        let a = generate_token();
-        let b = generate_token();
-        assert_ne!(a, b);
-        assert!(a.starts_with(TOKEN_PREFIX));
-        assert!(b.starts_with(TOKEN_PREFIX));
-        // 5 + 43 = 48 chars
-        assert_eq!(a.len(), 5 + 43);
-    }
-
-    #[test]
-    fn sha256_is_stable_and_64_hex() {
-        let h = sha256_hex("mcpt_abc");
-        assert_eq!(h.len(), 64);
-        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
-        assert_eq!(sha256_hex("mcpt_abc"), h);
-    }
-}

compliance-agent/src/api/handlers/notifications.rs

@@ -1,183 +0,0 @@
-use axum::extract::Extension;
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-use serde::Deserialize;
-
-use compliance_core::models::notification::CveNotification;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use super::dto::{tenant_db, AgentExt, ApiResponse};
-
-/// GET /api/v1/notifications — List CVE notifications (newest first)
-#[tracing::instrument(skip_all)]
-pub async fn list_notifications(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    axum::extract::Query(params): axum::extract::Query<NotificationFilter>,
-) -> Result<Json<ApiResponse<Vec<CveNotification>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let mut filter = doc! {};
-
-    // Filter by status (default: show new + read, exclude dismissed)
-    match params.status.as_deref() {
-        Some("all") => {}
-        Some(s) => {
-            filter.insert("status", s);
-        }
-        None => {
-            filter.insert("status", doc! { "$in": ["new", "read"] });
-        }
-    }
-
-    // Filter by severity
-    if let Some(ref sev) = params.severity {
-        filter.insert("severity", sev.as_str());
-    }
-
-    // Filter by repo
-    if let Some(ref repo_id) = params.repo_id {
-        filter.insert("repo_id", repo_id.as_str());
-    }
-
-    let page = params.page.unwrap_or(1).max(1);
-    let limit = params.limit.unwrap_or(50).min(200);
-    let skip = (page - 1) * limit as u64;
-
-    let total = db
-        .cve_notifications()
-        .count_documents(filter.clone())
-        .await
-        .unwrap_or(0);
-
-    let notifications: Vec<CveNotification> = match db
-        .cve_notifications()
-        .find(filter)
-        .sort(doc! { "created_at": -1 })
-        .skip(skip)
-        .limit(limit)
-        .await
-    {
-        Ok(cursor) => {
-            use futures_util::StreamExt;
-            let mut items = Vec::new();
-            let mut cursor = cursor;
-            while let Some(Ok(n)) = cursor.next().await {
-                items.push(n);
-            }
-            items
-        }
-        Err(e) => {
-            tracing::error!("Failed to list notifications: {e}");
-            return Err(StatusCode::INTERNAL_SERVER_ERROR);
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: notifications,
-        total: Some(total),
-        page: Some(page),
-    }))
-}
-
-/// GET /api/v1/notifications/count — Count of unread notifications
-#[tracing::instrument(skip_all)]
-pub async fn notification_count(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let count = db
-        .cve_notifications()
-        .count_documents(doc! { "status": "new" })
-        .await
-        .unwrap_or(0);
-
-    Ok(Json(serde_json::json!({ "count": count })))
-}
-
-/// PATCH /api/v1/notifications/:id/read — Mark a notification as read
-#[tracing::instrument(skip_all, fields(id = %id))]
-pub async fn mark_read(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    axum::extract::Path(id): axum::extract::Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let result = db
-        .cve_notifications()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": {
-                "status": "read",
-                "read_at": mongodb::bson::DateTime::now(),
-            }},
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-    Ok(Json(serde_json::json!({ "status": "read" })))
-}
-
-/// PATCH /api/v1/notifications/:id/dismiss — Dismiss a notification
-#[tracing::instrument(skip_all, fields(id = %id))]
-pub async fn dismiss_notification(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    axum::extract::Path(id): axum::extract::Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let result = db
-        .cve_notifications()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "status": "dismissed" } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-    Ok(Json(serde_json::json!({ "status": "dismissed" })))
-}
-
-/// POST /api/v1/notifications/read-all — Mark all new notifications as read
-#[tracing::instrument(skip_all)]
-pub async fn mark_all_read(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let result = db
-        .cve_notifications()
-        .update_many(
-            doc! { "status": "new" },
-            doc! { "$set": {
-                "status": "read",
-                "read_at": mongodb::bson::DateTime::now(),
-            }},
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    Ok(Json(
-        serde_json::json!({ "updated": result.modified_count }),
-    ))
-}
-
-#[derive(Debug, Deserialize)]
-pub struct NotificationFilter {
-    pub status: Option<String>,
-    pub severity: Option<String>,
-    pub repo_id: Option<String>,
-    pub page: Option<u64>,
-    pub limit: Option<i64>,
-}

compliance-agent/src/api/handlers/pentest.rs

@@ -0,0 +1,717 @@
+use std::sync::Arc;
+
+use axum::extract::{Extension, Path, Query};
+use axum::http::StatusCode;
+use axum::response::sse::{Event, Sse};
+use axum::response::IntoResponse;
+use axum::Json;
+use futures_util::stream;
+use mongodb::bson::doc;
+use serde::Deserialize;
+
+use compliance_core::models::dast::DastFinding;
+use compliance_core::models::pentest::*;
+
+use crate::agent::ComplianceAgent;
+use crate::pentest::PentestOrchestrator;
+
+use super::{collect_cursor_async, ApiResponse, PaginationParams};
+
+type AgentExt = Extension<Arc<ComplianceAgent>>;
+
+#[derive(Deserialize)]
+pub struct CreateSessionRequest {
+    pub target_id: String,
+    #[serde(default = "default_strategy")]
+    pub strategy: String,
+    pub message: Option<String>,
+}
+
+fn default_strategy() -> String {
+    "comprehensive".to_string()
+}
+
+#[derive(Deserialize)]
+pub struct SendMessageRequest {
+    pub message: String,
+}
+
+/// POST /api/v1/pentest/sessions — Create a new pentest session and start the orchestrator
+#[tracing::instrument(skip_all)]
+pub async fn create_session(
+    Extension(agent): AgentExt,
+    Json(req): Json<CreateSessionRequest>,
+) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&req.target_id).map_err(|_| {
+        (
+            StatusCode::BAD_REQUEST,
+            "Invalid target_id format".to_string(),
+        )
+    })?;
+
+    // Look up the target
+    let target = agent
+        .db
+        .dast_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Database error: {e}"),
+            )
+        })?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Target not found".to_string()))?;
+
+    // Parse strategy
+    let strategy = match req.strategy.as_str() {
+        "quick" => PentestStrategy::Quick,
+        "targeted" => PentestStrategy::Targeted,
+        "aggressive" => PentestStrategy::Aggressive,
+        "stealth" => PentestStrategy::Stealth,
+        _ => PentestStrategy::Comprehensive,
+    };
+
+    // Create session
+    let mut session = PentestSession::new(req.target_id.clone(), strategy);
+    session.repo_id = target.repo_id.clone();
+
+    let insert_result = agent
+        .db
+        .pentest_sessions()
+        .insert_one(&session)
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Failed to create session: {e}"),
+            )
+        })?;
+
+    // Set the generated ID back on the session so the orchestrator has it
+    session.id = insert_result.inserted_id.as_object_id();
+
+    let initial_message = req.message.unwrap_or_else(|| {
+        format!(
+            "Begin a {} penetration test against {} ({}). \
+             Identify vulnerabilities and provide evidence for each finding.",
+            session.strategy, target.name, target.base_url,
+        )
+    });
+
+    // Spawn the orchestrator on a background task
+    let llm = agent.llm.clone();
+    let db = agent.db.clone();
+    let session_clone = session.clone();
+    let target_clone = target.clone();
+    tokio::spawn(async move {
+        let orchestrator = PentestOrchestrator::new(llm, db);
+        orchestrator
+            .run_session_guarded(&session_clone, &target_clone, &initial_message)
+            .await;
+    });
+
+    Ok(Json(ApiResponse {
+        data: session,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/pentest/sessions — List pentest sessions
+#[tracing::instrument(skip_all)]
+pub async fn list_sessions(
+    Extension(agent): AgentExt,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<PentestSession>>>, StatusCode> {
+    let db = &agent.db;
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = db
+        .pentest_sessions()
+        .count_documents(doc! {})
+        .await
+        .unwrap_or(0);
+
+    let sessions = match db
+        .pentest_sessions()
+        .find(doc! {})
+        .sort(doc! { "started_at": -1 })
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch pentest sessions: {e}");
+            Vec::new()
+        }
+    };
+
+    Ok(Json(ApiResponse {
+        data: sessions,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+/// GET /api/v1/pentest/sessions/:id — Get a single pentest session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn get_session(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<PentestSession>>, StatusCode> {
+    let oid =
+        mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    Ok(Json(ApiResponse {
+        data: session,
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/pentest/sessions/:id/chat — Send a user message and trigger next orchestrator iteration
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn send_message(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+    Json(req): Json<SendMessageRequest>,
+) -> Result<Json<ApiResponse<PentestMessage>>, (StatusCode, String)> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
+        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+
+    // Verify session exists and is running
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Database error: {e}"),
+            )
+        })?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
+
+    if session.status != PentestStatus::Running && session.status != PentestStatus::Paused {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            format!("Session is {}, cannot send messages", session.status),
+        ));
+    }
+
+    // Look up the target
+    let target_oid =
+        mongodb::bson::oid::ObjectId::parse_str(&session.target_id).map_err(|_| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "Invalid target_id in session".to_string(),
+            )
+        })?;
+
+    let target = agent
+        .db
+        .dast_targets()
+        .find_one(doc! { "_id": target_oid })
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Database error: {e}"),
+            )
+        })?
+        .ok_or_else(|| {
+            (
+                StatusCode::NOT_FOUND,
+                "Target for session not found".to_string(),
+            )
+        })?;
+
+    // Store user message
+    let session_id = id.clone();
+    let user_msg = PentestMessage::user(session_id.clone(), req.message.clone());
+    let _ = agent.db.pentest_messages().insert_one(&user_msg).await;
+
+    let response_msg = user_msg.clone();
+
+    // Spawn orchestrator to continue the session
+    let llm = agent.llm.clone();
+    let db = agent.db.clone();
+    let message = req.message.clone();
+    tokio::spawn(async move {
+        let orchestrator = PentestOrchestrator::new(llm, db);
+        orchestrator
+            .run_session_guarded(&session, &target, &message)
+            .await;
+    });
+
+    Ok(Json(ApiResponse {
+        data: response_msg,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/pentest/sessions/:id/stream — SSE endpoint for real-time events
+///
+/// Returns recent messages as SSE events (polling approach).
+/// True real-time streaming with broadcast channels will be added in a future iteration.
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn session_stream(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+) -> Result<Sse<impl futures_util::Stream<Item = Result<Event, std::convert::Infallible>>>, StatusCode>
+{
+    let oid =
+        mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    // Verify session exists
+    let _session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // Fetch recent messages for this session
+    let messages: Vec<PentestMessage> = match agent
+        .db
+        .pentest_messages()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "created_at": 1 })
+        .limit(100)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(_) => Vec::new(),
+    };
+
+    // Fetch recent attack chain nodes
+    let nodes: Vec<AttackChainNode> = match agent
+        .db
+        .attack_chain_nodes()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "started_at": 1 })
+        .limit(100)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(_) => Vec::new(),
+    };
+
+    // Build SSE events from stored data
+    let mut events: Vec<Result<Event, std::convert::Infallible>> = Vec::new();
+
+    for msg in &messages {
+        let event_data = serde_json::json!({
+            "type": "message",
+            "role": msg.role,
+            "content": msg.content,
+            "created_at": msg.created_at.to_rfc3339(),
+        });
+        if let Ok(data) = serde_json::to_string(&event_data) {
+            events.push(Ok(Event::default().event("message").data(data)));
+        }
+    }
+
+    for node in &nodes {
+        let event_data = serde_json::json!({
+            "type": "tool_execution",
+            "node_id": node.node_id,
+            "tool_name": node.tool_name,
+            "status": node.status,
+            "findings_produced": node.findings_produced,
+        });
+        if let Ok(data) = serde_json::to_string(&event_data) {
+            events.push(Ok(Event::default().event("tool").data(data)));
+        }
+    }
+
+    // Add session status event
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .ok()
+        .flatten();
+
+    if let Some(s) = session {
+        let status_data = serde_json::json!({
+            "type": "status",
+            "status": s.status,
+            "findings_count": s.findings_count,
+            "tool_invocations": s.tool_invocations,
+        });
+        if let Ok(data) = serde_json::to_string(&status_data) {
+            events.push(Ok(Event::default().event("status").data(data)));
+        }
+    }
+
+    Ok(Sse::new(stream::iter(events)))
+}
+
+/// POST /api/v1/pentest/sessions/:id/stop — Stop a running pentest session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn stop_session(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
+        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Database error: {e}")))?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
+
+    if session.status != PentestStatus::Running {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            format!("Session is {}, not running", session.status),
+        ));
+    }
+
+    agent
+        .db
+        .pentest_sessions()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$set": {
+                "status": "failed",
+                "completed_at": mongodb::bson::DateTime::now(),
+                "error_message": "Stopped by user",
+            }},
+        )
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Database error: {e}")))?;
+
+    let updated = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Database error: {e}")))?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found after update".to_string()))?;
+
+    Ok(Json(ApiResponse {
+        data: updated,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/pentest/sessions/:id/attack-chain — Get attack chain nodes for a session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn get_attack_chain(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<Vec<AttackChainNode>>>, StatusCode> {
+    // Verify the session ID is valid
+    let _oid =
+        mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    let nodes = match agent
+        .db
+        .attack_chain_nodes()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "started_at": 1 })
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch attack chain nodes: {e}");
+            Vec::new()
+        }
+    };
+
+    let total = nodes.len() as u64;
+    Ok(Json(ApiResponse {
+        data: nodes,
+        total: Some(total),
+        page: None,
+    }))
+}
+
+/// GET /api/v1/pentest/sessions/:id/messages — Get messages for a session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn get_messages(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<PentestMessage>>>, StatusCode> {
+    let _oid =
+        mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = agent
+        .db
+        .pentest_messages()
+        .count_documents(doc! { "session_id": &id })
+        .await
+        .unwrap_or(0);
+
+    let messages = match agent
+        .db
+        .pentest_messages()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "created_at": 1 })
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch pentest messages: {e}");
+            Vec::new()
+        }
+    };
+
+    Ok(Json(ApiResponse {
+        data: messages,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+/// GET /api/v1/pentest/stats — Aggregated pentest statistics
+#[tracing::instrument(skip_all)]
+pub async fn pentest_stats(
+    Extension(agent): AgentExt,
+) -> Result<Json<ApiResponse<PentestStats>>, StatusCode> {
+    let db = &agent.db;
+
+    let running_sessions = db
+        .pentest_sessions()
+        .count_documents(doc! { "status": "running" })
+        .await
+        .unwrap_or(0) as u32;
+
+    // Count DAST findings from pentest sessions
+    let total_vulnerabilities = db
+        .dast_findings()
+        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null } })
+        .await
+        .unwrap_or(0) as u32;
+
+    // Aggregate tool invocations from all sessions
+    let sessions: Vec<PentestSession> = match db.pentest_sessions().find(doc! {}).await {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(_) => Vec::new(),
+    };
+
+    let total_tool_invocations: u32 = sessions.iter().map(|s| s.tool_invocations).sum();
+    let total_successes: u32 = sessions.iter().map(|s| s.tool_successes).sum();
+    let tool_success_rate = if total_tool_invocations == 0 {
+        100.0
+    } else {
+        (total_successes as f64 / total_tool_invocations as f64) * 100.0
+    };
+
+    // Severity distribution from pentest-related DAST findings
+    let critical = db
+        .dast_findings()
+        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "critical" })
+        .await
+        .unwrap_or(0) as u32;
+    let high = db
+        .dast_findings()
+        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "high" })
+        .await
+        .unwrap_or(0) as u32;
+    let medium = db
+        .dast_findings()
+        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "medium" })
+        .await
+        .unwrap_or(0) as u32;
+    let low = db
+        .dast_findings()
+        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "low" })
+        .await
+        .unwrap_or(0) as u32;
+    let info = db
+        .dast_findings()
+        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "info" })
+        .await
+        .unwrap_or(0) as u32;
+
+    Ok(Json(ApiResponse {
+        data: PentestStats {
+            running_sessions,
+            total_vulnerabilities,
+            total_tool_invocations,
+            tool_success_rate,
+            severity_distribution: SeverityDistribution {
+                critical,
+                high,
+                medium,
+                low,
+                info,
+            },
+        },
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/pentest/sessions/:id/findings — Get DAST findings for a pentest session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn get_session_findings(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<DastFinding>>>, StatusCode> {
+    let _oid =
+        mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = agent
+        .db
+        .dast_findings()
+        .count_documents(doc! { "session_id": &id })
+        .await
+        .unwrap_or(0);
+
+    let findings = match agent
+        .db
+        .dast_findings()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "created_at": -1 })
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch pentest session findings: {e}");
+            Vec::new()
+        }
+    };
+
+    Ok(Json(ApiResponse {
+        data: findings,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+#[derive(Deserialize)]
+pub struct ExportBody {
+    pub password: String,
+    /// Requester display name (from auth)
+    #[serde(default)]
+    pub requester_name: String,
+    /// Requester email (from auth)
+    #[serde(default)]
+    pub requester_email: String,
+}
+
+/// POST /api/v1/pentest/sessions/:id/export — Export an encrypted pentest report archive
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn export_session_report(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+    Json(body): Json<ExportBody>,
+) -> Result<axum::response::Response, (StatusCode, String)> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
+        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+
+    if body.password.len() < 8 {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "Password must be at least 8 characters".to_string(),
+        ));
+    }
+
+    // Fetch session
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("Database error: {e}")))?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
+
+    // Resolve target name
+    let target = if let Ok(tid) = mongodb::bson::oid::ObjectId::parse_str(&session.target_id) {
+        agent
+            .db
+            .dast_targets()
+            .find_one(doc! { "_id": tid })
+            .await
+            .ok()
+            .flatten()
+    } else {
+        None
+    };
+    let target_name = target
+        .as_ref()
+        .map(|t| t.name.clone())
+        .unwrap_or_else(|| "Unknown Target".to_string());
+    let target_url = target
+        .as_ref()
+        .map(|t| t.base_url.clone())
+        .unwrap_or_default();
+
+    // Fetch attack chain nodes
+    let nodes: Vec<AttackChainNode> = match agent
+        .db
+        .attack_chain_nodes()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "started_at": 1 })
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(_) => Vec::new(),
+    };
+
+    // Fetch DAST findings for this session
+    let findings: Vec<DastFinding> = match agent
+        .db
+        .dast_findings()
+        .find(doc! { "session_id": &id })
+        .sort(doc! { "severity": -1, "created_at": -1 })
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(_) => Vec::new(),
+    };
+
+    let ctx = crate::pentest::report::ReportContext {
+        session,
+        target_name,
+        target_url,
+        findings,
+        attack_chain: nodes,
+        requester_name: if body.requester_name.is_empty() {
+            "Unknown".to_string()
+        } else {
+            body.requester_name
+        },
+        requester_email: body.requester_email,
+    };
+
+    let report = crate::pentest::generate_encrypted_report(&ctx, &body.password)
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
+
+    let response = serde_json::json!({
+        "archive_base64": base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &report.archive),
+        "sha256": report.sha256,
+        "filename": format!("pentest-report-{id}.zip"),
+    });
+
+    Ok(Json(response).into_response())
+}

compliance-agent/src/api/handlers/pentest_handlers/export.rs

@@ -1,235 +0,0 @@
-use std::sync::Arc;
-
-use axum::extract::{Extension, Path};
-use axum::http::StatusCode;
-use axum::response::IntoResponse;
-use axum::Json;
-use mongodb::bson::doc;
-use serde::Deserialize;
-
-use futures_util::StreamExt;
-
-use compliance_core::models::dast::DastFinding;
-use compliance_core::models::finding::Finding;
-use compliance_core::models::pentest::*;
-use compliance_core::models::sbom::SbomEntry;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-
-use super::super::dto::{collect_cursor_async, tenant_db};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-#[derive(Deserialize)]
-pub struct ExportBody {
-    pub password: String,
-    /// Requester display name (from auth)
-    #[serde(default)]
-    pub requester_name: String,
-    /// Requester email (from auth)
-    #[serde(default)]
-    pub requester_email: String,
-}
-
-/// POST /api/v1/pentest/sessions/:id/export — Export an encrypted pentest report archive
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn export_session_report(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(body): Json<ExportBody>,
-) -> Result<axum::response::Response, (StatusCode, String)> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
-        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-
-    if body.password.len() < 8 {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            "Password must be at least 8 characters".to_string(),
-        ));
-    }
-
-    // Fetch session
-    let session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
-
-    // Resolve target name
-    let target = if let Ok(tid) = mongodb::bson::oid::ObjectId::parse_str(&session.target_id) {
-        db.dast_targets()
-            .find_one(doc! { "_id": tid })
-            .await
-            .ok()
-            .flatten()
-    } else {
-        None
-    };
-    let target_name = target
-        .as_ref()
-        .map(|t| t.name.clone())
-        .unwrap_or_else(|| "Unknown Target".to_string());
-    let target_url = target
-        .as_ref()
-        .map(|t| t.base_url.clone())
-        .unwrap_or_default();
-
-    // Fetch attack chain nodes
-    let nodes: Vec<AttackChainNode> = match db
-        .attack_chain_nodes()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "started_at": 1 })
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(_) => Vec::new(),
-    };
-
-    // Fetch DAST findings for this session, then deduplicate
-    let raw_findings: Vec<DastFinding> = match db
-        .dast_findings()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "severity": -1, "created_at": -1 })
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(_) => Vec::new(),
-    };
-    let raw_count = raw_findings.len();
-    let findings = crate::pipeline::dedup::dedup_dast_findings(raw_findings);
-    if findings.len() < raw_count {
-        tracing::info!(
-            "Deduped DAST findings for session {id}: {raw_count} → {}",
-            findings.len()
-        );
-    }
-
-    // Fetch SAST findings, SBOM, and code context for the linked repository
-    let repo_id = session
-        .repo_id
-        .clone()
-        .or_else(|| target.as_ref().and_then(|t| t.repo_id.clone()));
-
-    let (sast_findings, sbom_entries, code_context) = if let Some(ref rid) = repo_id {
-        let sast: Vec<Finding> = match db
-            .findings()
-            .find(doc! {
-                "repo_id": rid,
-                "status": { "$in": ["open", "triaged"] },
-            })
-            .sort(doc! { "severity": -1 })
-            .limit(100)
-            .await
-        {
-            Ok(mut cursor) => {
-                let mut results = Vec::new();
-                while let Some(Ok(f)) = cursor.next().await {
-                    results.push(f);
-                }
-                results
-            }
-            Err(_) => Vec::new(),
-        };
-
-        let sbom: Vec<SbomEntry> = match db
-            .sbom_entries()
-            .find(doc! {
-                "repo_id": rid,
-                "known_vulnerabilities": { "$exists": true, "$ne": [] },
-            })
-            .limit(50)
-            .await
-        {
-            Ok(mut cursor) => {
-                let mut results = Vec::new();
-                while let Some(Ok(e)) = cursor.next().await {
-                    results.push(e);
-                }
-                results
-            }
-            Err(_) => Vec::new(),
-        };
-
-        // Build code context from graph nodes
-        let code_ctx: Vec<CodeContextHint> = match db
-            .graph_nodes()
-            .find(doc! { "repo_id": rid, "is_entry_point": true })
-            .limit(50)
-            .await
-        {
-            Ok(mut cursor) => {
-                let mut nodes_vec = Vec::new();
-                while let Some(Ok(n)) = cursor.next().await {
-                    let linked_vulns: Vec<String> = sast
-                        .iter()
-                        .filter(|f| f.file_path.as_deref() == Some(&n.file_path))
-                        .map(|f| {
-                            format!(
-                                "[{}] {}: {} (line {})",
-                                f.severity,
-                                f.scanner,
-                                f.title,
-                                f.line_number.unwrap_or(0)
-                            )
-                        })
-                        .collect();
-                    nodes_vec.push(CodeContextHint {
-                        endpoint_pattern: n.qualified_name.clone(),
-                        handler_function: n.name.clone(),
-                        file_path: n.file_path.clone(),
-                        code_snippet: String::new(),
-                        known_vulnerabilities: linked_vulns,
-                    });
-                }
-                nodes_vec
-            }
-            Err(_) => Vec::new(),
-        };
-
-        (sast, sbom, code_ctx)
-    } else {
-        (Vec::new(), Vec::new(), Vec::new())
-    };
-
-    let config = session.config.clone();
-    let ctx = crate::pentest::report::ReportContext {
-        session,
-        target_name,
-        target_url,
-        findings,
-        attack_chain: nodes,
-        requester_name: if body.requester_name.is_empty() {
-            "Unknown".to_string()
-        } else {
-            body.requester_name
-        },
-        requester_email: body.requester_email,
-        config,
-        sast_findings,
-        sbom_entries,
-        code_context,
-    };
-
-    let report = crate::pentest::generate_encrypted_report(&ctx, &body.password)
-        .await
-        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e))?;
-
-    let response = serde_json::json!({
-        "archive_base64": base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &report.archive),
-        "sha256": report.sha256,
-        "filename": format!("pentest-report-{id}.zip"),
-    });
-
-    Ok(Json(response).into_response())
-}

compliance-agent/src/api/handlers/pentest_handlers/mod.rs

@@ -1,9 +0,0 @@
-mod export;
-mod session;
-mod stats;
-mod stream;
-
-pub use export::*;
-pub use session::*;
-pub use stats::*;
-pub use stream::*;

compliance-agent/src/api/handlers/pentest_handlers/session.rs

@@ -1,849 +0,0 @@
-use std::sync::Arc;
-
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-use serde::Deserialize;
-
-use compliance_core::models::pentest::*;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-use crate::pentest::PentestOrchestrator;
-
-use super::super::dto::{collect_cursor_async, tenant_db, ApiResponse, PaginationParams};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-#[derive(Deserialize)]
-pub struct CreateSessionRequest {
-    pub target_id: Option<String>,
-    #[serde(default = "default_strategy")]
-    pub strategy: String,
-    pub message: Option<String>,
-    /// Wizard configuration — if present, takes precedence over legacy fields
-    pub config: Option<PentestConfig>,
-}
-
-fn default_strategy() -> String {
-    "comprehensive".to_string()
-}
-
-#[derive(Deserialize)]
-pub struct SendMessageRequest {
-    pub message: String,
-}
-
-#[derive(Deserialize)]
-pub struct LookupRepoQuery {
-    pub url: String,
-}
-
-/// POST /api/v1/pentest/sessions — Create a new pentest session and start the orchestrator
-#[tracing::instrument(skip_all)]
-pub async fn create_session(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<CreateSessionRequest>,
-) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
-    // Try to acquire a concurrency permit
-    let permit = agent
-        .session_semaphore
-        .clone()
-        .try_acquire_owned()
-        .map_err(|_| {
-            (
-                StatusCode::TOO_MANY_REQUESTS,
-                "Maximum concurrent pentest sessions reached. Try again later.".to_string(),
-            )
-        })?;
-
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-
-    if let Some(ref config) = req.config {
-        // ── Wizard path ──────────────────────────────────────────────
-        if !config.disclaimer_accepted {
-            return Err((
-                StatusCode::BAD_REQUEST,
-                "Disclaimer must be accepted".to_string(),
-            ));
-        }
-
-        // Look up or auto-create DastTarget by app_url
-        let target = match db
-            .dast_targets()
-            .find_one(doc! { "base_url": &config.app_url })
-            .await
-            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?
-        {
-            Some(t) => t,
-            None => {
-                use compliance_core::models::dast::{DastTarget, DastTargetType};
-                let mut t = DastTarget::new(
-                    config.app_url.clone(),
-                    config.app_url.clone(),
-                    DastTargetType::WebApp,
-                );
-                if let Some(rl) = config.rate_limit {
-                    t.rate_limit = rl;
-                }
-                t.allow_destructive = config.allow_destructive;
-                t.excluded_paths = config.scope_exclusions.clone();
-                let res = db.dast_targets().insert_one(&t).await.map_err(|e| {
-                    (
-                        StatusCode::INTERNAL_SERVER_ERROR,
-                        format!("Failed to create target: {e}"),
-                    )
-                })?;
-                t.id = res.inserted_id.as_object_id();
-                t
-            }
-        };
-
-        let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
-
-        // Parse strategy from config or request
-        let strat_str = config.strategy.as_deref().unwrap_or(req.strategy.as_str());
-        let strategy = parse_strategy(strat_str);
-
-        let mut session = PentestSession::new(target_id, strategy);
-        session.config = Some(config.clone());
-        session.repo_id = target.repo_id.clone();
-
-        // Resolve repo_id from git_repo_url if provided
-        if let Some(ref git_url) = config.git_repo_url {
-            if let Ok(Some(repo)) = db
-                .repositories()
-                .find_one(doc! { "git_url": git_url })
-                .await
-            {
-                session.repo_id = repo.id.map(|oid| oid.to_hex());
-            }
-        }
-
-        let insert_result = db
-            .pentest_sessions()
-            .insert_one(&session)
-            .await
-            .map_err(|e| {
-                (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Failed to create session: {e}"),
-                )
-            })?;
-        session.id = insert_result.inserted_id.as_object_id();
-
-        let session_id_str = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-
-        // Register broadcast stream and pause control
-        let event_tx = agent.register_session_stream(&session_id_str);
-        let pause_rx = agent.register_pause_control(&session_id_str);
-
-        // Merge server-default IMAP/email settings where wizard left blanks
-        if let Some(ref mut cfg) = session.config {
-            if cfg.auth.mode == AuthMode::AutoRegister {
-                if cfg.auth.verification_email.is_none() {
-                    cfg.auth.verification_email = agent.config.pentest_verification_email.clone();
-                }
-                if cfg.auth.imap_host.is_none() {
-                    cfg.auth.imap_host = agent.config.pentest_imap_host.clone();
-                }
-                if cfg.auth.imap_port.is_none() {
-                    cfg.auth.imap_port = agent.config.pentest_imap_port;
-                }
-                if cfg.auth.imap_username.is_none() {
-                    cfg.auth.imap_username = agent.config.pentest_imap_username.clone();
-                }
-                if cfg.auth.imap_password.is_none() {
-                    cfg.auth.imap_password = agent.config.pentest_imap_password.as_ref().map(|s| {
-                        use secrecy::ExposeSecret;
-                        s.expose_secret().to_string()
-                    });
-                }
-            }
-        }
-
-        // Pre-populate test user record for auto-register sessions
-        if let Some(ref cfg) = session.config {
-            if cfg.auth.mode == AuthMode::AutoRegister {
-                let verification_email = cfg.auth.verification_email.clone();
-                // Build plus-addressed email for this session
-                let test_email = verification_email.as_deref().map(|email| {
-                    let parts: Vec<&str> = email.splitn(2, '@').collect();
-                    if parts.len() == 2 {
-                        format!("{}+{}@{}", parts[0], session_id_str, parts[1])
-                    } else {
-                        email.to_string()
-                    }
-                });
-
-                // Detect identity provider from keycloak config
-                let provider = if agent.config.keycloak_url.is_some() {
-                    Some(compliance_core::models::pentest::IdentityProvider::Keycloak)
-                } else {
-                    None
-                };
-
-                session.test_user = Some(compliance_core::models::pentest::TestUserRecord {
-                    username: None, // LLM will choose; updated after registration
-                    email: test_email,
-                    provider_user_id: None,
-                    provider,
-                    cleaned_up: false,
-                });
-            }
-        }
-
-        // Encrypt credentials before they linger in memory
-        let mut session_for_task = session.clone();
-        if let Some(ref mut cfg) = session_for_task.config {
-            cfg.auth.username = cfg
-                .auth
-                .username
-                .as_ref()
-                .map(|u| crate::pentest::crypto::encrypt(u));
-            cfg.auth.password = cfg
-                .auth
-                .password
-                .as_ref()
-                .map(|p| crate::pentest::crypto::encrypt(p));
-        }
-
-        // Persist encrypted credentials to DB
-        if session_for_task.config.is_some() {
-            if let Some(sid) = session.id {
-                let _ = db
-                    .pentest_sessions()
-                    .update_one(
-                        doc! { "_id": sid },
-                        doc! { "$set": {
-                            "config.auth.username": session_for_task.config.as_ref()
-                                .and_then(|c| c.auth.username.as_deref())
-                                .map(|s| mongodb::bson::Bson::String(s.to_string()))
-                                .unwrap_or(mongodb::bson::Bson::Null),
-                            "config.auth.password": session_for_task.config.as_ref()
-                                .and_then(|c| c.auth.password.as_deref())
-                                .map(|s| mongodb::bson::Bson::String(s.to_string()))
-                                .unwrap_or(mongodb::bson::Bson::Null),
-                        }},
-                    )
-                    .await;
-            }
-        }
-
-        let initial_message = config
-            .initial_instructions
-            .clone()
-            .or(req.message.clone())
-            .unwrap_or_else(|| {
-                format!(
-                    "Begin a {} penetration test against {} ({}). \
-                     Identify vulnerabilities and provide evidence for each finding.",
-                    session.strategy, target.name, target.base_url,
-                )
-            });
-
-        let llm = agent.llm.clone();
-        let db_for_orchestrator = db.clone();
-        let session_clone = session.clone();
-        let target_clone = target.clone();
-        let agent_ref = agent.clone();
-        tokio::spawn(async move {
-            let orchestrator =
-                PentestOrchestrator::new(llm, db_for_orchestrator, event_tx, Some(pause_rx));
-            orchestrator
-                .run_session_guarded(&session_clone, &target_clone, &initial_message)
-                .await;
-            // Clean up session resources
-            agent_ref.cleanup_session(&session_id_str);
-            // Release concurrency permit
-            drop(permit);
-        });
-
-        // Redact credentials in response
-        let mut response_session = session;
-        if let Some(ref mut cfg) = response_session.config {
-            if cfg.auth.username.is_some() {
-                cfg.auth.username = Some("********".to_string());
-            }
-            if cfg.auth.password.is_some() {
-                cfg.auth.password = Some("********".to_string());
-            }
-        }
-
-        Ok(Json(ApiResponse {
-            data: response_session,
-            total: None,
-            page: None,
-        }))
-    } else {
-        // ── Legacy path ──────────────────────────────────────────────
-        let target_id = req.target_id.clone().ok_or_else(|| {
-            (
-                StatusCode::BAD_REQUEST,
-                "target_id is required for legacy creation".to_string(),
-            )
-        })?;
-
-        let oid = mongodb::bson::oid::ObjectId::parse_str(&target_id).map_err(|_| {
-            (
-                StatusCode::BAD_REQUEST,
-                "Invalid target_id format".to_string(),
-            )
-        })?;
-
-        let target = db
-            .dast_targets()
-            .find_one(doc! { "_id": oid })
-            .await
-            .map_err(|e| {
-                (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Database error: {e}"),
-                )
-            })?
-            .ok_or_else(|| (StatusCode::NOT_FOUND, "Target not found".to_string()))?;
-
-        let strategy = parse_strategy(&req.strategy);
-
-        let mut session = PentestSession::new(target_id, strategy);
-        session.repo_id = target.repo_id.clone();
-
-        let insert_result = db
-            .pentest_sessions()
-            .insert_one(&session)
-            .await
-            .map_err(|e| {
-                (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("Failed to create session: {e}"),
-                )
-            })?;
-        session.id = insert_result.inserted_id.as_object_id();
-
-        let session_id_str = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-
-        // Register broadcast stream and pause control
-        let event_tx = agent.register_session_stream(&session_id_str);
-        let pause_rx = agent.register_pause_control(&session_id_str);
-
-        let initial_message = req.message.unwrap_or_else(|| {
-            format!(
-                "Begin a {} penetration test against {} ({}). \
-                 Identify vulnerabilities and provide evidence for each finding.",
-                session.strategy, target.name, target.base_url,
-            )
-        });
-
-        let llm = agent.llm.clone();
-        let db_for_orchestrator = db.clone();
-        let session_clone = session.clone();
-        let target_clone = target.clone();
-        let agent_ref = agent.clone();
-        tokio::spawn(async move {
-            let orchestrator =
-                PentestOrchestrator::new(llm, db_for_orchestrator, event_tx, Some(pause_rx));
-            orchestrator
-                .run_session_guarded(&session_clone, &target_clone, &initial_message)
-                .await;
-            agent_ref.cleanup_session(&session_id_str);
-            drop(permit);
-        });
-
-        Ok(Json(ApiResponse {
-            data: session,
-            total: None,
-            page: None,
-        }))
-    }
-}
-
-fn parse_strategy(s: &str) -> PentestStrategy {
-    match s {
-        "quick" => PentestStrategy::Quick,
-        "targeted" => PentestStrategy::Targeted,
-        "aggressive" => PentestStrategy::Aggressive,
-        "stealth" => PentestStrategy::Stealth,
-        _ => PentestStrategy::Comprehensive,
-    }
-}
-
-/// GET /api/v1/pentest/lookup-repo — Look up a tracked repository by git URL
-#[tracing::instrument(skip_all)]
-pub async fn lookup_repo(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<LookupRepoQuery>,
-) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let repo = db
-        .repositories()
-        .find_one(doc! { "git_url": &params.url })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    let data = match repo {
-        Some(r) => serde_json::json!({
-            "name": r.name,
-            "default_branch": r.default_branch,
-            "last_scanned_commit": r.last_scanned_commit,
-        }),
-        None => serde_json::Value::Null,
-    };
-
-    Ok(Json(ApiResponse {
-        data,
-        total: None,
-        page: None,
-    }))
-}
-
-/// GET /api/v1/pentest/sessions — List pentest sessions
-#[tracing::instrument(skip_all)]
-pub async fn list_sessions(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> Result<Json<ApiResponse<Vec<PentestSession>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .pentest_sessions()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-
-    let sessions = match db
-        .pentest_sessions()
-        .find(doc! {})
-        .sort(doc! { "started_at": -1 })
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch pentest sessions: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: sessions,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-/// GET /api/v1/pentest/sessions/:id — Get a single pentest session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn get_session(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<PentestSession>>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // Redact credentials in response
-    if let Some(ref mut cfg) = session.config {
-        if cfg.auth.username.is_some() {
-            cfg.auth.username = Some("********".to_string());
-        }
-        if cfg.auth.password.is_some() {
-            cfg.auth.password = Some("********".to_string());
-        }
-    }
-
-    Ok(Json(ApiResponse {
-        data: session,
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/pentest/sessions/:id/chat — Send a user message and trigger next orchestrator iteration
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn send_message(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<SendMessageRequest>,
-) -> Result<Json<ApiResponse<PentestMessage>>, (StatusCode, String)> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
-        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-
-    // Verify session exists and is running
-    let session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
-
-    if session.status != PentestStatus::Running && session.status != PentestStatus::Paused {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Session is {}, cannot send messages", session.status),
-        ));
-    }
-
-    // Look up the target
-    let target_oid = mongodb::bson::oid::ObjectId::parse_str(&session.target_id).map_err(|_| {
-        (
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Invalid target_id in session".to_string(),
-        )
-    })?;
-
-    let target = db
-        .dast_targets()
-        .find_one(doc! { "_id": target_oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| {
-            (
-                StatusCode::NOT_FOUND,
-                "Target for session not found".to_string(),
-            )
-        })?;
-
-    // Store user message
-    let session_id = id.clone();
-    let user_msg = PentestMessage::user(session_id.clone(), req.message.clone());
-    let _ = db.pentest_messages().insert_one(&user_msg).await;
-
-    let response_msg = user_msg.clone();
-
-    // Spawn orchestrator to continue the session
-    let llm = agent.llm.clone();
-    let db_for_orchestrator = db.clone();
-    let message = req.message.clone();
-
-    // Use existing broadcast sender if available, otherwise create a new one
-    let event_tx = agent
-        .subscribe_session(&session_id)
-        .and_then(|_| {
-            agent
-                .session_streams
-                .get(&session_id)
-                .map(|entry| entry.value().clone())
-        })
-        .unwrap_or_else(|| agent.register_session_stream(&session_id));
-
-    tokio::spawn(async move {
-        let orchestrator = PentestOrchestrator::new(llm, db_for_orchestrator, event_tx, None);
-        orchestrator
-            .run_session_guarded(&session, &target, &message)
-            .await;
-    });
-
-    Ok(Json(ApiResponse {
-        data: response_msg,
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/pentest/sessions/:id/stop — Stop a running pentest session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn stop_session(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
-        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-
-    let session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
-
-    if session.status != PentestStatus::Running && session.status != PentestStatus::Paused {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Session is {}, not running or paused", session.status),
-        ));
-    }
-
-    db.pentest_sessions()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": {
-                "status": "failed",
-                "completed_at": mongodb::bson::DateTime::now(),
-                "error_message": "Stopped by user",
-            }},
-        )
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?;
-
-    // Clean up session resources
-    agent.cleanup_session(&id);
-
-    let updated = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| {
-            (
-                StatusCode::NOT_FOUND,
-                "Session not found after update".to_string(),
-            )
-        })?;
-
-    Ok(Json(ApiResponse {
-        data: updated,
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/pentest/sessions/:id/pause — Pause a running pentest session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn pause_session(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<serde_json::Value>>, (StatusCode, String)> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
-        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-
-    let session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
-
-    if session.status != PentestStatus::Running {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Session is {}, not running", session.status),
-        ));
-    }
-
-    if !agent.pause_session(&id) {
-        return Err((
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to send pause signal".to_string(),
-        ));
-    }
-
-    Ok(Json(ApiResponse {
-        data: serde_json::json!({ "status": "paused" }),
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/pentest/sessions/:id/resume — Resume a paused pentest session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn resume_session(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<serde_json::Value>>, (StatusCode, String)> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
-        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-
-    let session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
-            )
-        })?
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
-
-    if session.status != PentestStatus::Paused {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Session is {}, not paused", session.status),
-        ));
-    }
-
-    if !agent.resume_session(&id) {
-        return Err((
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "Failed to send resume signal".to_string(),
-        ));
-    }
-
-    Ok(Json(ApiResponse {
-        data: serde_json::json!({ "status": "running" }),
-        total: None,
-        page: None,
-    }))
-}
-
-/// GET /api/v1/pentest/sessions/:id/attack-chain — Get attack chain nodes for a session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn get_attack_chain(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<Vec<AttackChainNode>>>, StatusCode> {
-    let _oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let nodes = match db
-        .attack_chain_nodes()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "started_at": 1 })
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch attack chain nodes: {e}");
-            Vec::new()
-        }
-    };
-
-    let total = nodes.len() as u64;
-    Ok(Json(ApiResponse {
-        data: nodes,
-        total: Some(total),
-        page: None,
-    }))
-}
-
-/// GET /api/v1/pentest/sessions/:id/messages — Get messages for a session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn get_messages(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Query(params): Query<PaginationParams>,
-) -> Result<Json<ApiResponse<Vec<PentestMessage>>>, StatusCode> {
-    let _oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .pentest_messages()
-        .count_documents(doc! { "session_id": &id })
-        .await
-        .unwrap_or(0);
-
-    let messages = match db
-        .pentest_messages()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "created_at": 1 })
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch pentest messages: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: messages,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-/// GET /api/v1/pentest/sessions/:id/findings — Get DAST findings for a pentest session
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn get_session_findings(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Query(params): Query<PaginationParams>,
-) -> Result<Json<ApiResponse<Vec<compliance_core::models::dast::DastFinding>>>, StatusCode> {
-    let _oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .dast_findings()
-        .count_documents(doc! { "session_id": &id })
-        .await
-        .unwrap_or(0);
-
-    let findings = match db
-        .dast_findings()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "created_at": -1 })
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch pentest session findings: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: findings,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}

compliance-agent/src/api/handlers/pentest_handlers/stats.rs

@@ -1,105 +0,0 @@
-use std::sync::Arc;
-
-use axum::extract::Extension;
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-
-use compliance_core::models::pentest::*;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-
-use super::super::dto::{collect_cursor_async, tenant_db, ApiResponse};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-/// GET /api/v1/pentest/stats — Aggregated pentest statistics
-#[tracing::instrument(skip_all)]
-pub async fn pentest_stats(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> Result<Json<ApiResponse<PentestStats>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    let running_sessions = db
-        .pentest_sessions()
-        .count_documents(doc! { "status": "running" })
-        .await
-        .unwrap_or(0) as u32;
-
-    // Count DAST findings from pentest sessions
-    let total_vulnerabilities = db
-        .dast_findings()
-        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null } })
-        .await
-        .unwrap_or(0) as u32;
-
-    // Aggregate tool invocations from all sessions
-    let sessions: Vec<PentestSession> = match db.pentest_sessions().find(doc! {}).await {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(_) => Vec::new(),
-    };
-
-    let total_tool_invocations: u32 = sessions.iter().map(|s| s.tool_invocations).sum();
-    let total_successes: u32 = sessions.iter().map(|s| s.tool_successes).sum();
-    let tool_success_rate = if total_tool_invocations == 0 {
-        100.0
-    } else {
-        (total_successes as f64 / total_tool_invocations as f64) * 100.0
-    };
-
-    // Severity distribution from pentest-related DAST findings
-    let critical = db
-        .dast_findings()
-        .count_documents(
-            doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "critical" },
-        )
-        .await
-        .unwrap_or(0) as u32;
-    let high = db
-        .dast_findings()
-        .count_documents(
-            doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "high" },
-        )
-        .await
-        .unwrap_or(0) as u32;
-    let medium = db
-        .dast_findings()
-        .count_documents(
-            doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "medium" },
-        )
-        .await
-        .unwrap_or(0) as u32;
-    let low = db
-        .dast_findings()
-        .count_documents(doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "low" })
-        .await
-        .unwrap_or(0) as u32;
-    let info = db
-        .dast_findings()
-        .count_documents(
-            doc! { "session_id": { "$exists": true, "$ne": null }, "severity": "info" },
-        )
-        .await
-        .unwrap_or(0) as u32;
-
-    Ok(Json(ApiResponse {
-        data: PentestStats {
-            running_sessions,
-            total_vulnerabilities,
-            total_tool_invocations,
-            tool_success_rate,
-            severity_distribution: SeverityDistribution {
-                critical,
-                high,
-                medium,
-                low,
-                info,
-            },
-        },
-        total: None,
-        page: None,
-    }))
-}

compliance-agent/src/api/handlers/pentest_handlers/stream.rs

@@ -1,157 +0,0 @@
-use std::convert::Infallible;
-use std::sync::Arc;
-use std::time::Duration;
-
-use axum::extract::{Extension, Path};
-use axum::http::StatusCode;
-use axum::response::sse::{Event, KeepAlive, Sse};
-use futures_util::stream;
-use mongodb::bson::doc;
-use tokio_stream::wrappers::BroadcastStream;
-use tokio_stream::StreamExt;
-
-use compliance_core::models::pentest::*;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-
-use super::super::dto::{collect_cursor_async, tenant_db};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-/// GET /api/v1/pentest/sessions/:id/stream — SSE endpoint for real-time events
-///
-/// Replays stored messages/nodes as initial burst, then subscribes to the
-/// broadcast channel for live updates. Sends keepalive comments every 15s.
-#[tracing::instrument(skip_all, fields(session_id = %id))]
-pub async fn session_stream(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Sse<impl futures_util::Stream<Item = Result<Event, Infallible>>>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    // Verify session exists
-    let _session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // ── Initial burst: replay stored data ──────────────────────────
-
-    let mut initial_events: Vec<Result<Event, Infallible>> = Vec::new();
-
-    // Fetch recent messages for this session
-    let messages: Vec<PentestMessage> = match db
-        .pentest_messages()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "created_at": 1 })
-        .limit(100)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(_) => Vec::new(),
-    };
-
-    // Fetch recent attack chain nodes
-    let nodes: Vec<AttackChainNode> = match db
-        .attack_chain_nodes()
-        .find(doc! { "session_id": &id })
-        .sort(doc! { "started_at": 1 })
-        .limit(100)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(_) => Vec::new(),
-    };
-
-    for msg in &messages {
-        let event_data = serde_json::json!({
-            "type": "message",
-            "role": msg.role,
-            "content": msg.content,
-            "created_at": msg.created_at.to_rfc3339(),
-        });
-        if let Ok(data) = serde_json::to_string(&event_data) {
-            initial_events.push(Ok(Event::default().event("message").data(data)));
-        }
-    }
-
-    for node in &nodes {
-        let event_data = serde_json::json!({
-            "type": "tool_execution",
-            "node_id": node.node_id,
-            "tool_name": node.tool_name,
-            "status": node.status,
-            "findings_produced": node.findings_produced,
-        });
-        if let Ok(data) = serde_json::to_string(&event_data) {
-            initial_events.push(Ok(Event::default().event("tool").data(data)));
-        }
-    }
-
-    // Add current session status event
-    let session = db
-        .pentest_sessions()
-        .find_one(doc! { "_id": oid })
-        .await
-        .ok()
-        .flatten();
-
-    if let Some(s) = session {
-        let status_data = serde_json::json!({
-            "type": "status",
-            "status": s.status,
-            "findings_count": s.findings_count,
-            "tool_invocations": s.tool_invocations,
-        });
-        if let Ok(data) = serde_json::to_string(&status_data) {
-            initial_events.push(Ok(Event::default().event("status").data(data)));
-        }
-    }
-
-    // ── Live stream: subscribe to broadcast ────────────────────────
-
-    let live_stream = if let Some(rx) = agent.subscribe_session(&id) {
-        let broadcast = BroadcastStream::new(rx).filter_map(|result| match result {
-            Ok(event) => {
-                if let Ok(data) = serde_json::to_string(&event) {
-                    let event_type = match &event {
-                        PentestEvent::ToolStart { .. } => "tool_start",
-                        PentestEvent::ToolComplete { .. } => "tool_complete",
-                        PentestEvent::Finding { .. } => "finding",
-                        PentestEvent::Message { .. } => "message",
-                        PentestEvent::Complete { .. } => "complete",
-                        PentestEvent::Error { .. } => "error",
-                        PentestEvent::Thinking { .. } => "thinking",
-                        PentestEvent::Paused => "paused",
-                        PentestEvent::Resumed => "resumed",
-                    };
-                    Some(Ok(Event::default().event(event_type).data(data)))
-                } else {
-                    None
-                }
-            }
-            Err(_) => None,
-        });
-        // Box to unify types
-        Box::pin(broadcast)
-            as std::pin::Pin<Box<dyn futures_util::Stream<Item = Result<Event, Infallible>> + Send>>
-    } else {
-        // No active broadcast — return empty stream
-        Box::pin(stream::empty())
-            as std::pin::Pin<Box<dyn futures_util::Stream<Item = Result<Event, Infallible>> + Send>>
-    };
-
-    // Chain initial burst + live stream
-    let combined = stream::iter(initial_events).chain(live_stream);
-
-    Ok(Sse::new(combined).keep_alive(
-        KeepAlive::new()
-            .interval(Duration::from_secs(15))
-            .text("keepalive"),
-    ))
-}

compliance-agent/src/api/handlers/repos.rs

@@ -1,339 +0,0 @@
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::*;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all)]
-pub async fn list_repositories(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> ApiResult<Vec<TrackedRepository>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .repositories()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-
-    let repos = match db
-        .repositories()
-        .find(doc! {})
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch repositories: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: repos,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn add_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<AddRepositoryRequest>,
-) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
-    // Validate repository access before saving
-    let creds = crate::pipeline::git::RepoCredentials {
-        ssh_key_path: Some(agent.config.ssh_key_path.clone()),
-        auth_token: req.auth_token.clone(),
-        auth_username: req.auth_username.clone(),
-    };
-
-    if let Err(e) = crate::pipeline::git::GitOps::test_access(&req.git_url, &creds) {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Cannot access repository: {e}"),
-        ));
-    }
-
-    let mut repo = TrackedRepository::new(req.name, req.git_url);
-    repo.default_branch = req.default_branch;
-    repo.auth_token = req.auth_token;
-    repo.auth_username = req.auth_username;
-    repo.tracker_type = req.tracker_type;
-    repo.tracker_owner = req.tracker_owner;
-    repo.tracker_repo = req.tracker_repo;
-    repo.tracker_token = req.tracker_token;
-    repo.scan_schedule = req.scan_schedule;
-
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-    db.repositories().insert_one(&repo).await.map_err(|_| {
-        (
-            StatusCode::CONFLICT,
-            "Repository already exists".to_string(),
-        )
-    })?;
-
-    Ok(Json(ApiResponse {
-        data: repo,
-        total: None,
-        page: None,
-    }))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn update_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateRepositoryRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut set_doc = doc! { "updated_at": mongodb::bson::DateTime::now() };
-
-    if let Some(name) = &req.name {
-        set_doc.insert("name", name);
-    }
-    if let Some(branch) = &req.default_branch {
-        set_doc.insert("default_branch", branch);
-    }
-    if let Some(token) = &req.auth_token {
-        set_doc.insert("auth_token", token);
-    }
-    if let Some(username) = &req.auth_username {
-        set_doc.insert("auth_username", username);
-    }
-    if let Some(tracker_type) = &req.tracker_type {
-        set_doc.insert("tracker_type", tracker_type.to_string());
-    }
-    if let Some(owner) = &req.tracker_owner {
-        set_doc.insert("tracker_owner", owner);
-    }
-    if let Some(repo) = &req.tracker_repo {
-        set_doc.insert("tracker_repo", repo);
-    }
-    if let Some(token) = &req.tracker_token {
-        set_doc.insert("tracker_token", token);
-    }
-    if let Some(schedule) = &req.scan_schedule {
-        set_doc.insert("scan_schedule", schedule);
-    }
-
-    let result = db
-        .repositories()
-        .update_one(doc! { "_id": oid }, doc! { "$set": set_doc })
-        .await
-        .map_err(|e| {
-            tracing::warn!("Failed to update repository: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    Ok(Json(serde_json::json!({ "status": "updated" })))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn get_ssh_public_key(
-    Extension(agent): AgentExt,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let public_path = format!("{}.pub", agent.config.ssh_key_path);
-    let public_key = std::fs::read_to_string(&public_path).map_err(|_| StatusCode::NOT_FOUND)?;
-    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn trigger_scan(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let agent_clone = (*agent).clone();
-    let tenant_id = tenant.0.tenant_id.clone();
-    tokio::spawn(async move {
-        if let Err(e) = agent_clone
-            .run_scan(&tenant_id, &id, ScanTrigger::Manual)
-            .await
-        {
-            tracing::error!("Manual scan failed for {id}: {e}");
-        }
-    });
-
-    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
-}
-
-/// Return the webhook secret for a repository (used by dashboard to display it)
-pub async fn get_webhook_config(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let repo = db
-        .repositories()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    let tracker_type = repo
-        .tracker_type
-        .as_ref()
-        .map(|t| t.to_string())
-        .unwrap_or_else(|| "gitea".to_string());
-
-    Ok(Json(serde_json::json!({
-        "webhook_secret": repo.webhook_secret,
-        "tracker_type": tracker_type,
-    })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn delete_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    // Delete the repository
-    let result = db
-        .repositories()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    if result.deleted_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    // Cascade delete all related data
-    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .tracker_issues()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .impact_analyses()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .code_embeddings()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .embedding_builds()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    // Cascade delete DAST targets linked to this repo, and all their downstream data
-    // (scan runs, findings, pentest sessions, attack chains, messages)
-    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(target)) = cursor.next().await {
-            let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !target_id.is_empty() {
-                cascade_delete_dast_target(db, &target_id).await;
-            }
-        }
-    }
-
-    // Also delete pentest sessions linked directly to this repo (not via target)
-    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                // Delete DAST findings produced by this session
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    Ok(Json(serde_json::json!({ "status": "deleted" })))
-}
-
-/// Cascade-delete a DAST target and all its downstream data.
-async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
-    // Delete pentest sessions for this target (and their attack chains + messages)
-    if let Ok(mut cursor) = db
-        .pentest_sessions()
-        .find(doc! { "target_id": target_id })
-        .await
-    {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-
-    // Delete DAST scan runs and their findings
-    let _ = db
-        .dast_findings()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-    let _ = db
-        .dast_scan_runs()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-
-    // Delete the target itself
-    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
-        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
-    }
-}

compliance-agent/src/api/handlers/sbom.rs

@@ -1,390 +0,0 @@
-use axum::extract::{Extension, Query};
-use axum::http::{header, StatusCode};
-use axum::response::IntoResponse;
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::SbomEntry;
-use compliance_core::tenant_ctx::TenantCtx;
-
-const COPYLEFT_LICENSES: &[&str] = &[
-    "GPL-2.0",
-    "GPL-2.0-only",
-    "GPL-2.0-or-later",
-    "GPL-3.0",
-    "GPL-3.0-only",
-    "GPL-3.0-or-later",
-    "AGPL-3.0",
-    "AGPL-3.0-only",
-    "AGPL-3.0-or-later",
-    "LGPL-2.1",
-    "LGPL-2.1-only",
-    "LGPL-2.1-or-later",
-    "LGPL-3.0",
-    "LGPL-3.0-only",
-    "LGPL-3.0-or-later",
-    "MPL-2.0",
-];
-
-#[tracing::instrument(skip_all)]
-pub async fn sbom_filters(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    let managers: Vec<String> = db
-        .sbom_entries()
-        .distinct("package_manager", doc! {})
-        .await
-        .unwrap_or_default()
-        .into_iter()
-        .filter_map(|v| v.as_str().map(|s| s.to_string()))
-        .filter(|s| !s.is_empty() && s != "unknown" && s != "file")
-        .collect();
-
-    let licenses: Vec<String> = db
-        .sbom_entries()
-        .distinct("license", doc! {})
-        .await
-        .unwrap_or_default()
-        .into_iter()
-        .filter_map(|v| v.as_str().map(|s| s.to_string()))
-        .filter(|s| !s.is_empty())
-        .collect();
-
-    Ok(Json(serde_json::json!({
-        "package_managers": managers,
-        "licenses": licenses,
-    })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = ?filter.repo_id, package_manager = ?filter.package_manager))]
-pub async fn list_sbom(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(filter): Query<SbomFilter>,
-) -> ApiResult<Vec<SbomEntry>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let mut query = doc! {};
-
-    if let Some(repo_id) = &filter.repo_id {
-        query.insert("repo_id", repo_id);
-    }
-    if let Some(pm) = &filter.package_manager {
-        query.insert("package_manager", pm);
-    }
-    if let Some(q) = &filter.q {
-        if !q.is_empty() {
-            query.insert("name", doc! { "$regex": q, "$options": "i" });
-        }
-    }
-    if let Some(has_vulns) = filter.has_vulns {
-        if has_vulns {
-            query.insert("known_vulnerabilities", doc! { "$exists": true, "$ne": [] });
-        } else {
-            query.insert("known_vulnerabilities", doc! { "$size": 0 });
-        }
-    }
-    if let Some(license) = &filter.license {
-        query.insert("license", license);
-    }
-
-    let skip = (filter.page.saturating_sub(1)) * filter.limit as u64;
-    let total = db
-        .sbom_entries()
-        .count_documents(query.clone())
-        .await
-        .unwrap_or(0);
-
-    let entries = match db
-        .sbom_entries()
-        .find(query)
-        .sort(doc! { "name": 1 })
-        .skip(skip)
-        .limit(filter.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch SBOM entries: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: entries,
-        total: Some(total),
-        page: Some(filter.page),
-    }))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn export_sbom(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<SbomExportParams>,
-) -> Result<impl IntoResponse, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let entries: Vec<SbomEntry> = match db
-        .sbom_entries()
-        .find(doc! { "repo_id": &params.repo_id })
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch SBOM entries for export: {e}");
-            Vec::new()
-        }
-    };
-
-    let body = if params.format == "spdx" {
-        // SPDX 2.3 format
-        let packages: Vec<serde_json::Value> = entries
-            .iter()
-            .enumerate()
-            .map(|(i, e)| {
-                serde_json::json!({
-                    "SPDXID": format!("SPDXRef-Package-{i}"),
-                    "name": e.name,
-                    "versionInfo": e.version,
-                    "downloadLocation": "NOASSERTION",
-                    "licenseConcluded": e.license.as_deref().unwrap_or("NOASSERTION"),
-                    "externalRefs": e.purl.as_ref().map(|p| vec![serde_json::json!({
-                        "referenceCategory": "PACKAGE-MANAGER",
-                        "referenceType": "purl",
-                        "referenceLocator": p,
-                    })]).unwrap_or_default(),
-                })
-            })
-            .collect();
-
-        serde_json::json!({
-            "spdxVersion": "SPDX-2.3",
-            "dataLicense": "CC0-1.0",
-            "SPDXID": "SPDXRef-DOCUMENT",
-            "name": format!("sbom-{}", params.repo_id),
-            "documentNamespace": format!("https://compliance-scanner/sbom/{}", params.repo_id),
-            "packages": packages,
-        })
-    } else {
-        // CycloneDX 1.5 format
-        let components: Vec<serde_json::Value> = entries
-            .iter()
-            .map(|e| {
-                let mut comp = serde_json::json!({
-                    "type": "library",
-                    "name": e.name,
-                    "version": e.version,
-                    "group": e.package_manager,
-                });
-                if let Some(purl) = &e.purl {
-                    comp["purl"] = serde_json::Value::String(purl.clone());
-                }
-                if let Some(license) = &e.license {
-                    comp["licenses"] = serde_json::json!([{ "license": { "id": license } }]);
-                }
-                if !e.known_vulnerabilities.is_empty() {
-                    comp["vulnerabilities"] = serde_json::json!(
-                        e.known_vulnerabilities.iter().map(|v| serde_json::json!({
-                            "id": v.id,
-                            "source": { "name": v.source },
-                            "ratings": v.severity.as_ref().map(|s| vec![serde_json::json!({"severity": s})]).unwrap_or_default(),
-                        })).collect::<Vec<_>>()
-                    );
-                }
-                comp
-            })
-            .collect();
-
-        serde_json::json!({
-            "bomFormat": "CycloneDX",
-            "specVersion": "1.5",
-            "version": 1,
-            "metadata": {
-                "component": {
-                    "type": "application",
-                    "name": format!("repo-{}", params.repo_id),
-                }
-            },
-            "components": components,
-        })
-    };
-
-    let json_str =
-        serde_json::to_string_pretty(&body).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    let filename = if params.format == "spdx" {
-        format!("sbom-{}-spdx.json", params.repo_id)
-    } else {
-        format!("sbom-{}-cyclonedx.json", params.repo_id)
-    };
-
-    let disposition = format!("attachment; filename=\"{filename}\"");
-    Ok((
-        [
-            (
-                header::CONTENT_TYPE,
-                header::HeaderValue::from_static("application/json"),
-            ),
-            (
-                header::CONTENT_DISPOSITION,
-                header::HeaderValue::from_str(&disposition)
-                    .unwrap_or_else(|_| header::HeaderValue::from_static("attachment")),
-            ),
-        ],
-        json_str,
-    ))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn license_summary(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<SbomFilter>,
-) -> ApiResult<Vec<LicenseSummary>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let mut query = doc! {};
-    if let Some(repo_id) = &params.repo_id {
-        query.insert("repo_id", repo_id);
-    }
-
-    let entries: Vec<SbomEntry> = match db.sbom_entries().find(query).await {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch SBOM entries for license summary: {e}");
-            Vec::new()
-        }
-    };
-
-    let mut license_map: std::collections::HashMap<String, Vec<String>> =
-        std::collections::HashMap::new();
-    for entry in &entries {
-        let lic = entry.license.as_deref().unwrap_or("Unknown").to_string();
-        license_map.entry(lic).or_default().push(entry.name.clone());
-    }
-
-    let mut summaries: Vec<LicenseSummary> = license_map
-        .into_iter()
-        .map(|(license, packages)| {
-            let is_copyleft = COPYLEFT_LICENSES
-                .iter()
-                .any(|c| license.to_uppercase().contains(&c.to_uppercase()));
-            LicenseSummary {
-                license,
-                count: packages.len() as u64,
-                is_copyleft,
-                packages,
-            }
-        })
-        .collect();
-    summaries.sort_by(|a, b| b.count.cmp(&a.count));
-
-    Ok(Json(ApiResponse {
-        data: summaries,
-        total: None,
-        page: None,
-    }))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn sbom_diff(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<SbomDiffParams>,
-) -> ApiResult<SbomDiffResult> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    let entries_a: Vec<SbomEntry> = match db
-        .sbom_entries()
-        .find(doc! { "repo_id": &params.repo_a })
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch SBOM entries for repo_a: {e}");
-            Vec::new()
-        }
-    };
-
-    let entries_b: Vec<SbomEntry> = match db
-        .sbom_entries()
-        .find(doc! { "repo_id": &params.repo_b })
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch SBOM entries for repo_b: {e}");
-            Vec::new()
-        }
-    };
-
-    // Build maps by (name, package_manager) -> version
-    let map_a: std::collections::HashMap<(String, String), String> = entries_a
-        .iter()
-        .map(|e| {
-            (
-                (e.name.clone(), e.package_manager.clone()),
-                e.version.clone(),
-            )
-        })
-        .collect();
-    let map_b: std::collections::HashMap<(String, String), String> = entries_b
-        .iter()
-        .map(|e| {
-            (
-                (e.name.clone(), e.package_manager.clone()),
-                e.version.clone(),
-            )
-        })
-        .collect();
-
-    let mut only_in_a = Vec::new();
-    let mut version_changed = Vec::new();
-    let mut common_count: u64 = 0;
-
-    for (key, ver_a) in &map_a {
-        match map_b.get(key) {
-            None => only_in_a.push(SbomDiffEntry {
-                name: key.0.clone(),
-                version: ver_a.clone(),
-                package_manager: key.1.clone(),
-            }),
-            Some(ver_b) if ver_a != ver_b => {
-                version_changed.push(SbomVersionDiff {
-                    name: key.0.clone(),
-                    package_manager: key.1.clone(),
-                    version_a: ver_a.clone(),
-                    version_b: ver_b.clone(),
-                });
-            }
-            Some(_) => common_count += 1,
-        }
-    }
-
-    let only_in_b: Vec<SbomDiffEntry> = map_b
-        .iter()
-        .filter(|(key, _)| !map_a.contains_key(key))
-        .map(|(key, ver)| SbomDiffEntry {
-            name: key.0.clone(),
-            version: ver.clone(),
-            package_manager: key.1.clone(),
-        })
-        .collect();
-
-    Ok(Json(ApiResponse {
-        data: SbomDiffResult {
-            only_in_a,
-            only_in_b,
-            version_changed,
-            common_count,
-        },
-        total: None,
-        page: None,
-    }))
-}

compliance-agent/src/api/handlers/scans.rs

@@ -1,40 +0,0 @@
-use axum::extract::{Extension, Query};
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::ScanRun;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all)]
-pub async fn list_scan_runs(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> ApiResult<Vec<ScanRun>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db.scan_runs().count_documents(doc! {}).await.unwrap_or(0);
-
-    let scans = match db
-        .scan_runs()
-        .find(doc! {})
-        .sort(doc! { "started_at": -1 })
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch scan runs: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: scans,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}

compliance-agent/src/api/mod.rs

@@ -1,3 +1,4 @@
+pub mod auth_middleware;
 pub mod handlers;
 pub mod routes;
 pub mod server;

compliance-agent/src/api/routes.rs

@@ -2,6 +2,7 @@ use axum::routing::{delete, get, patch, post};
 use axum::Router;
 
 use crate::api::handlers;
+use crate::webhooks;
 
 pub fn build_router() -> Router {
     Router::new()
@@ -46,15 +47,6 @@ pub fn build_router() -> Router {
         .route("/api/v1/sbom/diff", get(handlers::sbom_diff))
         .route("/api/v1/issues", get(handlers::list_issues))
         .route("/api/v1/scan-runs", get(handlers::list_scan_runs))
-        // MCP token management (per-tenant API tokens for the MCP server)
-        .route(
-            "/api/v1/mcp-tokens",
-            get(handlers::mcp_tokens::list_mcp_tokens).post(handlers::mcp_tokens::create_mcp_token),
-        )
-        .route(
-            "/api/v1/mcp-tokens/{id}",
-            delete(handlers::mcp_tokens::revoke_mcp_token),
-        )
         // Graph API endpoints
         .route("/api/v1/graph/{repo_id}", get(handlers::graph::get_graph))
         .route(
@@ -107,34 +99,7 @@ pub fn build_router() -> Router {
             "/api/v1/chat/{repo_id}/status",
             get(handlers::chat::embedding_status),
         )
-        // Help chat (documentation-grounded Q&A)
-        .route("/api/v1/help/chat", post(handlers::help_chat::help_chat))
-        // CVE notification endpoints
-        .route(
-            "/api/v1/notifications",
-            get(handlers::notifications::list_notifications),
-        )
-        .route(
-            "/api/v1/notifications/count",
-            get(handlers::notifications::notification_count),
-        )
-        .route(
-            "/api/v1/notifications/read-all",
-            post(handlers::notifications::mark_all_read),
-        )
-        .route(
-            "/api/v1/notifications/{id}/read",
-            patch(handlers::notifications::mark_read),
-        )
-        .route(
-            "/api/v1/notifications/{id}/dismiss",
-            patch(handlers::notifications::dismiss_notification),
-        )
         // Pentest API endpoints
-        .route(
-            "/api/v1/pentest/lookup-repo",
-            get(handlers::pentest::lookup_repo),
-        )
         .route(
             "/api/v1/pentest/sessions",
             get(handlers::pentest::list_sessions).post(handlers::pentest::create_session),
@@ -151,14 +116,6 @@ pub fn build_router() -> Router {
             "/api/v1/pentest/sessions/{id}/stop",
             post(handlers::pentest::stop_session),
         )
-        .route(
-            "/api/v1/pentest/sessions/{id}/pause",
-            post(handlers::pentest::pause_session),
-        )
-        .route(
-            "/api/v1/pentest/sessions/{id}/resume",
-            post(handlers::pentest::resume_session),
-        )
         .route(
             "/api/v1/pentest/sessions/{id}/stream",
             get(handlers::pentest::session_stream),
@@ -179,14 +136,18 @@ pub fn build_router() -> Router {
             "/api/v1/pentest/sessions/{id}/export",
             post(handlers::pentest::export_session_report),
         )
+        .route("/api/v1/pentest/stats", get(handlers::pentest::pentest_stats))
+        // Webhook endpoints (proxied through dashboard)
         .route(
-            "/api/v1/pentest/stats",
+            "/webhook/github/{repo_id}",
-            get(handlers::pentest::pentest_stats),
+            post(webhooks::github::handle_github_webhook),
+        )
+        .route(
+            "/webhook/gitlab/{repo_id}",
+            post(webhooks::gitlab::handle_gitlab_webhook),
+        )
+        .route(
+            "/webhook/gitea/{repo_id}",
+            post(webhooks::gitea::handle_gitea_webhook),
         )
-    // Webhook routes live on the separate webhook server (port 3002,
-    // see crate::webhooks::server). The M7.2-C tenant-in-URL form is
-    // `/webhook/{tenant_id}/{platform}/{repo_id}` and the handlers
-    // expect a (tenant_id, repo_id) path tuple. Anything mounting
-    // them here on the API server would mismatch the handler
-    // signature, so the routes are not exported.
 }

compliance-agent/src/api/server.rs

@@ -1,99 +1,20 @@
 use std::sync::Arc;
 
-use axum::extract::Request;
+use axum::{middleware, Extension};
-use axum::http::HeaderValue;
-use axum::middleware::Next;
-use axum::response::Response;
-use axum::routing::{delete, get};
-use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
-use tower_http::set_header::SetResponseHeaderLayer;
 use tower_http::trace::TraceLayer;
 
-use compliance_core::auth::{require_jwt_auth, require_tenant_status, JwksState};
-use compliance_core::{TenantContext, TenantStatus};
-
 use crate::agent::ComplianceAgent;
-use crate::api::handlers;
+use crate::api::auth_middleware::{require_jwt_auth, JwksState};
 use crate::api::routes;
 use crate::error::AgentError;
 
-/// Synthetic tenant id used when Keycloak isn't configured (local dev,
-/// `cargo run` against a bare Mongo). Lets the handler stack stay
-/// uniformly tenant-scoped without the operator having to spin up KC
-/// just to poke at the API. Override via `DEV_TENANT_ID`.
-const DEFAULT_DEV_TENANT_ID: &str = "dev";
-
-/// Inject a synthetic [`TenantContext`] for any request that lacks one.
-/// Only mounted when Keycloak is NOT configured; with KC, the real
-/// `require_jwt_auth` middleware owns this and we never reach here
-/// without a context.
-///
-/// Public so the integration-test harness can mount it without
-/// duplicating the synthetic-context shape.
-pub async fn inject_dev_tenant(mut request: Request, next: Next) -> Response {
-    if request.extensions().get::<TenantContext>().is_none() {
-        let tenant_id =
-            std::env::var("DEV_TENANT_ID").unwrap_or_else(|_| DEFAULT_DEV_TENANT_ID.to_string());
-        let ctx = TenantContext {
-            tenant_slug: tenant_id.clone(),
-            tenant_id,
-            org_roles: vec![],
-            products: vec![],
-            plan: "dev".to_string(),
-            status: TenantStatus::Active,
-            user_id: "dev-user".to_string(),
-            user_name: None,
-        };
-        request.extensions_mut().insert(ctx);
-    }
-    next.run(request).await
-}
-
 pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), AgentError> {
-    // Admin sub-router. Routes are only mounted when ADMIN_API_TOKEN is
-    // configured — without it, the paths don't exist at all (404 rather
-    // than 401), so an operator who hasn't opted in can't fingerprint
-    // the surface area.
-    let admin_router: Router = if agent.config.admin_api_token.is_some() {
-        tracing::info!("Admin API enabled — /api/v1/admin/* mounted behind ADMIN_API_TOKEN bearer");
-        Router::new()
-            .route(
-                "/api/v1/admin/tenants",
-                get(handlers::admin::list_tenant_dbs),
-            )
-            .route(
-                "/api/v1/admin/tenants/{tenant_id}",
-                delete(handlers::admin::drop_tenant_db),
-            )
-            .layer(middleware::from_fn(handlers::admin::require_admin_token))
-    } else {
-        Router::new()
-    };
-
     let mut app = routes::build_router()
-        .merge(admin_router)
         .layer(Extension(Arc::new(agent.clone())))
         .layer(CorsLayer::permissive())
-        .layer(TraceLayer::new_for_http())
+        .layer(TraceLayer::new_for_http());
-        // Security headers (defense-in-depth, primary enforcement via Traefik)
-        .layer(SetResponseHeaderLayer::overriding(
-            axum::http::header::STRICT_TRANSPORT_SECURITY,
-            HeaderValue::from_static("max-age=31536000; includeSubDomains"),
-        ))
-        .layer(SetResponseHeaderLayer::overriding(
-            axum::http::header::X_FRAME_OPTIONS,
-            HeaderValue::from_static("DENY"),
-        ))
-        .layer(SetResponseHeaderLayer::overriding(
-            axum::http::header::X_CONTENT_TYPE_OPTIONS,
-            HeaderValue::from_static("nosniff"),
-        ))
-        .layer(SetResponseHeaderLayer::overriding(
-            axum::http::header::REFERRER_POLICY,
-            HeaderValue::from_static("strict-origin-when-cross-origin"),
-        ));
 
     if let (Some(kc_url), Some(kc_realm)) =
         (&agent.config.keycloak_url, &agent.config.keycloak_realm)
@@ -104,22 +25,11 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
             jwks_url,
         };
         tracing::info!("Keycloak JWT auth enabled for realm '{kc_realm}'");
-        // Layers execute outermost-first. Extension(jwks_state) must run
-        // before require_jwt_auth so the middleware can read it; the
-        // status gate runs after JWT so TenantContext is in extensions.
         app = app
-            .layer(middleware::from_fn(require_tenant_status))
+            .layer(Extension(jwks_state))
-            .layer(middleware::from_fn(require_jwt_auth))
+            .layer(middleware::from_fn(require_jwt_auth));
-            .layer(Extension(jwks_state));
     } else {
-        let tenant_id =
+        tracing::warn!("Keycloak not configured - API endpoints are unprotected");
-            std::env::var("DEV_TENANT_ID").unwrap_or_else(|_| DEFAULT_DEV_TENANT_ID.to_string());
-        tracing::warn!(
-            tenant_id = %tenant_id,
-            "Keycloak not configured — running unauthenticated against the dev tenant. \
-             DO NOT use in any environment with real customer data."
-        );
-        app = app.layer(middleware::from_fn(inject_dev_tenant));
     }
 
     let addr = format!("0.0.0.0:{port}");

compliance-agent/src/classify/firmware.rs

@@ -1,217 +0,0 @@
-//! Firmware classification via tramiton.
-//!
-//! tramiton is the company's firmware build/repro engine; we do not re-implement
-//! its detection. We depend on `tramiton-core` directly (same-company IP) and run
-//! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
-//! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
-//! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
-//! tramiton sources nor a real firmware tree.
-
-use std::path::Path;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{DetectedFact, TargetType};
-use compliance_core::traits::ClassifierVerdict;
-
-/// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
-/// Kept small and tramiton-independent so the classifier and the test mock don't
-/// need to construct a full tramiton plan.
-#[derive(Debug, Clone, Default)]
-pub struct FirmwareDetection {
-    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
-    pub provider: String,
-    /// Detection confidence: `low` | `medium` | `high`.
-    pub confidence: String,
-    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
-    pub build_system: String,
-    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
-    pub framework: Option<String>,
-    /// Target board / MCU / arch.
-    pub target: FirmwareTarget,
-    /// Unresolved gaps in the plan.
-    pub gaps: Vec<String>,
-}
-
-/// The detected firmware target (board / MCU / arch).
-#[derive(Debug, Clone, Default)]
-pub struct FirmwareTarget {
-    /// Board name.
-    pub board: Option<String>,
-    /// MCU part.
-    pub mcu: Option<String>,
-    /// Architecture.
-    pub arch: Option<String>,
-}
-
-/// A source of tramiton firmware detection.
-#[allow(async_fn_in_trait)]
-pub trait FirmwareDetector: Send + Sync {
-    /// Run detection over a path, returning a firmware detection if tramiton
-    /// could form a build plan.
-    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
-}
-
-/// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
-/// so it runs on a blocking thread to avoid stalling the async runtime. A path
-/// with no recognizable build system yields `Ok(None)`.
-pub struct TramitonNative;
-
-impl FirmwareDetector for TramitonNative {
-    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
-        let path = path.to_path_buf();
-        let plan = tokio::task::spawn_blocking(move || {
-            let repo = tramiton_core::Repo::new(&path);
-            tramiton_core::provider::analyze(&repo)
-        })
-        .await
-        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
-        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
-        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
-    }
-}
-
-/// Map tramiton's `BuildPlan` onto our minimal detection summary.
-fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
-    FirmwareDetection {
-        provider: bp.provider.clone(),
-        confidence: bp.confidence.to_string(),
-        build_system: bp.build_system.label().to_string(),
-        framework: bp.framework.clone(),
-        target: FirmwareTarget {
-            board: bp.target.board.clone(),
-            mcu: bp.target.mcu.clone(),
-            arch: bp.target.arch.clone(),
-        },
-        gaps: bp.gaps.clone(),
-    }
-}
-
-/// Map a firmware detection to a target type. Framework/build-system signals
-/// distinguish RTOS from bare-metal from Yocto.
-pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
-    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
-    let build_system = det.build_system.to_lowercase();
-    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
-
-    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
-    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
-        TargetType::EmbeddedLinuxYocto
-    } else if RTOS.iter().any(|k| signal.contains(k)) {
-        TargetType::FirmwareRtos
-    } else {
-        TargetType::FirmwareBareMetal
-    }
-}
-
-/// Map tramiton's confidence label to a `[0,1]` score.
-fn confidence_score(label: &str) -> f32 {
-    match label.to_lowercase().as_str() {
-        "high" => 0.9,
-        "medium" => 0.6,
-        "low" => 0.3,
-        _ => 0.4,
-    }
-}
-
-/// Turn a firmware detection into a classifier verdict, carrying the MCU / board
-/// / build-system as facts.
-pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
-    let target_type = detection_to_target_type(det);
-    let mut facts = vec![DetectedFact::new(
-        "build_system",
-        det.build_system.clone(),
-        "tramiton",
-    )];
-    if let Some(fw) = &det.framework {
-        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
-    }
-    if let Some(mcu) = &det.target.mcu {
-        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
-    }
-    if let Some(board) = &det.target.board {
-        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
-    }
-    if let Some(arch) = &det.target.arch {
-        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
-    }
-    ClassifierVerdict {
-        target_type,
-        confidence: confidence_score(&det.confidence),
-        facts,
-        rationale: format!(
-            "tramiton detected build system '{}'{}",
-            det.build_system,
-            det.framework
-                .as_ref()
-                .map(|f| format!(" (framework {f})"))
-                .unwrap_or_default()
-        ),
-    }
-}
-
-/// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
-pub struct MockFirmwareDetector {
-    /// The detection to return (or `None` for "no detection").
-    pub detection: Option<FirmwareDetection>,
-}
-
-impl FirmwareDetector for MockFirmwareDetector {
-    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
-        Ok(self.detection.clone())
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
-        FirmwareDetection {
-            provider: build_system.to_string(),
-            confidence: "high".to_string(),
-            build_system: build_system.to_string(),
-            framework: framework.map(|s| s.to_string()),
-            target: FirmwareTarget {
-                mcu: Some("stm32f429".to_string()),
-                ..Default::default()
-            },
-            gaps: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn zephyr_maps_to_rtos() {
-        assert_eq!(
-            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
-            TargetType::FirmwareRtos
-        );
-    }
-
-    #[test]
-    fn bare_cmake_maps_to_bare_metal() {
-        assert_eq!(
-            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
-            TargetType::FirmwareBareMetal
-        );
-    }
-
-    #[test]
-    fn bitbake_maps_to_yocto() {
-        assert_eq!(
-            detection_to_target_type(&detection("bitbake", None)),
-            TargetType::EmbeddedLinuxYocto
-        );
-    }
-
-    #[test]
-    fn verdict_carries_mcu_fact_and_confidence() {
-        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
-        assert_eq!(v.target_type, TargetType::FirmwareRtos);
-        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
-        assert!(v
-            .facts
-            .iter()
-            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
-    }
-}

compliance-agent/src/classify/language.rs

@@ -1,357 +0,0 @@
-//! Heuristic target-type classification from artifact kinds and source markers.
-//!
-//! Complements the tramiton firmware detector: this handles web / backend /
-//! mobile / desktop / PLC by sniffing manifest files and file extensions in the
-//! ingested code trees, plus strong priors from the artifact kinds themselves
-//! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
-
-use std::collections::HashSet;
-use std::fs;
-use std::path::Path;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
-use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-
-/// Max directory depth scanned for marker files.
-const SCAN_DEPTH: usize = 2;
-
-/// Markers collected from a code tree.
-#[derive(Default)]
-struct Markers {
-    files: HashSet<String>,
-    dirs: HashSet<String>,
-    exts: HashSet<String>,
-}
-
-impl Markers {
-    fn has_file(&self, name: &str) -> bool {
-        self.files.contains(name)
-    }
-    fn has_ext(&self, ext: &str) -> bool {
-        self.exts.contains(ext)
-    }
-    fn any_dir_ends_with(&self, suffix: &str) -> bool {
-        self.dirs.iter().any(|d| d.ends_with(suffix))
-    }
-}
-
-/// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
-fn collect_markers(root: &Path) -> Markers {
-    let mut m = Markers::default();
-    scan_dir(root, 0, &mut m);
-    m
-}
-
-fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
-    let Ok(entries) = fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        let name = entry.file_name().to_string_lossy().to_lowercase();
-        if path.is_dir() {
-            m.dirs.insert(name);
-            if depth < SCAN_DEPTH {
-                scan_dir(&path, depth + 1, m);
-            }
-        } else {
-            if let Some(ext) = path.extension() {
-                m.exts.insert(ext.to_string_lossy().to_lowercase());
-            }
-            m.files.insert(name);
-        }
-    }
-}
-
-/// Whether a `package.json` at `root` looks like a front-end app.
-fn package_json_is_frontend(root: &Path) -> bool {
-    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
-        return false;
-    };
-    let c = content.to_lowercase();
-    ["react", "next", "vue", "@angular", "svelte", "vite"]
-        .iter()
-        .any(|f| c.contains(f))
-}
-
-/// The heuristic classifier: artifact-kind priors + source-tree markers.
-pub struct HeuristicClassifier;
-
-impl HeuristicClassifier {
-    /// Verdicts from the artifact kinds alone (no filesystem needed).
-    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
-        let mut out = Vec::new();
-        for a in input.artifacts {
-            let lower = a.source_ref.to_lowercase();
-            match a.kind {
-                ArtifactKind::PlcProject => out.push(verdict(
-                    TargetType::PlcSps,
-                    0.85,
-                    "PLC project artifact",
-                    vec![],
-                )),
-                ArtifactKind::MobilePackage => {
-                    let (tt, why) = if lower.ends_with(".ipa") {
-                        (TargetType::IosApp, "iOS package (.ipa)")
-                    } else {
-                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
-                    };
-                    out.push(verdict(tt, 0.85, why, vec![]));
-                }
-                ArtifactKind::ContainerImage => out.push(verdict(
-                    TargetType::BackendService,
-                    0.4,
-                    "container image",
-                    vec![],
-                )),
-                ArtifactKind::FirmwareImage => out.push(verdict(
-                    TargetType::FirmwareBareMetal,
-                    0.35,
-                    "firmware image (pending tramiton detection)",
-                    vec![],
-                )),
-                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
-                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
-                }
-                _ => {}
-            }
-        }
-        out
-    }
-
-    /// Verdicts from scanning the ingested code trees for manifest markers.
-    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
-        let mut out = Vec::new();
-        for a in input.artifacts {
-            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
-                continue;
-            }
-            let Some(path) = input.working_paths.get(&a.id) else {
-                continue;
-            };
-            let m = collect_markers(path);
-
-            // Mobile (checked first — strongest signal).
-            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
-                out.push(verdict(
-                    TargetType::AndroidApp,
-                    0.8,
-                    "Android manifest / gradle",
-                    facts_lang("kotlin/java"),
-                ));
-            }
-            if m.any_dir_ends_with(".xcodeproj")
-                || m.has_file("info.plist")
-                || m.has_file("podfile")
-                || m.has_ext("ipa")
-            {
-                out.push(verdict(
-                    TargetType::IosApp,
-                    0.8,
-                    "Xcode project / Info.plist",
-                    facts_lang("swift/objc"),
-                ));
-            }
-            // Desktop.
-            if m.has_ext("sln")
-                || m.has_ext("csproj")
-                || m.has_ext("vcxproj")
-                || m.has_ext("desktop")
-            {
-                out.push(verdict(
-                    TargetType::DesktopApp,
-                    0.7,
-                    "desktop project files",
-                    facts_lang("dotnet/native"),
-                ));
-            }
-            // PLC.
-            if m.has_ext("st") {
-                out.push(verdict(
-                    TargetType::PlcSps,
-                    0.8,
-                    "Structured Text sources",
-                    facts_lang("iec-61131-3"),
-                ));
-            }
-            // Web vs backend from package.json.
-            if m.has_file("package.json") {
-                if package_json_is_frontend(path) {
-                    out.push(verdict(
-                        TargetType::WebApp,
-                        0.65,
-                        "package.json with a front-end framework",
-                        facts_lang("javascript"),
-                    ));
-                } else {
-                    out.push(verdict(
-                        TargetType::BackendService,
-                        0.55,
-                        "package.json (no front-end framework)",
-                        facts_lang("javascript"),
-                    ));
-                }
-            }
-            // Backend languages.
-            for (file, lang) in [
-                ("cargo.toml", "rust"),
-                ("go.mod", "go"),
-                ("pom.xml", "java"),
-                ("requirements.txt", "python"),
-                ("pyproject.toml", "python"),
-            ] {
-                if m.has_file(file) {
-                    out.push(verdict(
-                        TargetType::BackendService,
-                        0.6,
-                        "backend build manifest",
-                        facts_lang(lang),
-                    ));
-                }
-            }
-            // Container-only.
-            if m.has_file("dockerfile") && out.is_empty() {
-                out.push(verdict(
-                    TargetType::BackendService,
-                    0.4,
-                    "Dockerfile",
-                    facts_lang("container"),
-                ));
-            }
-        }
-        out
-    }
-}
-
-impl TargetClassifier for HeuristicClassifier {
-    fn name(&self) -> &str {
-        "heuristic"
-    }
-
-    async fn classify(
-        &self,
-        input: &ClassificationInput<'_>,
-    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
-        let mut out = self.kind_priors(input);
-        out.extend(self.source_verdicts(input));
-        Ok(out)
-    }
-}
-
-fn verdict(
-    target_type: TargetType,
-    confidence: f32,
-    rationale: &str,
-    facts: Vec<DetectedFact>,
-) -> ClassifierVerdict {
-    ClassifierVerdict {
-        target_type,
-        confidence,
-        facts,
-        rationale: rationale.to_string(),
-    }
-}
-
-fn facts_lang(lang: &str) -> Vec<DetectedFact> {
-    vec![DetectedFact::new("language", lang, "heuristic")]
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Artifact;
-    use std::collections::HashMap;
-    use std::path::PathBuf;
-
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
-        let scratch = Scratch::new();
-        setup(&scratch.0);
-        let artifact = Artifact::git_repo("https://git/x", "main");
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let artifacts = vec![artifact];
-        let input = ClassificationInput {
-            artifacts: &artifacts,
-            working_paths: &wp,
-            description: None,
-        };
-        HeuristicClassifier
-            .classify(&input)
-            .await
-            .expect("classify")
-    }
-
-    #[tokio::test]
-    async fn frontend_package_json_is_webapp() {
-        let v = classify_tree(|root| {
-            fs::write(
-                root.join("package.json"),
-                r#"{"dependencies":{"react":"18"}}"#,
-            )
-            .unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
-    }
-
-    #[tokio::test]
-    async fn cargo_toml_is_backend() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
-        })
-        .await;
-        assert!(v
-            .iter()
-            .any(|x| x.target_type == TargetType::BackendService));
-    }
-
-    #[tokio::test]
-    async fn android_manifest_is_android() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
-    }
-
-    #[tokio::test]
-    async fn structured_text_is_plc() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
-    }
-
-    #[tokio::test]
-    async fn ipa_artifact_prior_is_ios() {
-        let artifacts = vec![Artifact::mobile_package("app.ipa")];
-        let wp = HashMap::new();
-        let input = ClassificationInput {
-            artifacts: &artifacts,
-            working_paths: &wp,
-            description: None,
-        };
-        let v = HeuristicClassifier
-            .classify(&input)
-            .await
-            .expect("classify");
-        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
-    }
-}

compliance-agent/src/classify/mod.rs

@@ -1,226 +0,0 @@
-//! Target classification.
-//!
-//! Runs the classifier registry over a target's artifacts and their ingested
-//! working paths, then merges and ranks the verdicts into a [`Classification`].
-//! The registry is the heuristic classifier (artifact kinds + source markers)
-//! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
-
-mod firmware;
-mod language;
-
-pub use firmware::{
-    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
-};
-pub use language::HeuristicClassifier;
-
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{
-    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
-};
-use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-
-use firmware::detection_to_verdict;
-
-/// Classify a target from its artifacts and their ingested working paths, using
-/// the heuristic classifier plus the tramiton firmware detector. Verdicts are
-/// merged (max confidence per target type) and ranked into a [`Classification`].
-pub async fn classify_target<D: FirmwareDetector>(
-    target: &OnboardedTarget,
-    working_paths: &HashMap<String, PathBuf>,
-    firmware_detector: &D,
-) -> Result<Classification, CoreError> {
-    let input = ClassificationInput {
-        artifacts: &target.artifacts,
-        working_paths,
-        description: target.description.as_deref(),
-    };
-
-    let mut verdicts = Vec::new();
-    let mut detected_by = Vec::new();
-
-    let heuristic = HeuristicClassifier.classify(&input).await?;
-    if !heuristic.is_empty() {
-        detected_by.push("heuristic".to_string());
-    }
-    verdicts.extend(heuristic);
-
-    // Tramiton firmware detection over firmware / code working paths.
-    let mut tramiton_used = false;
-    for artifact in &target.artifacts {
-        if !matches!(
-            artifact.kind,
-            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-        ) {
-            continue;
-        }
-        let Some(path) = working_paths.get(&artifact.id) else {
-            continue;
-        };
-        if let Some(detection) = firmware_detector.detect(path).await? {
-            verdicts.push(detection_to_verdict(&detection));
-            tramiton_used = true;
-        }
-    }
-    if tramiton_used {
-        detected_by.push("tramiton".to_string());
-    }
-
-    Ok(rank(verdicts, detected_by, target.target_type))
-}
-
-/// Merge verdicts by target type (keeping the max confidence and its rationale),
-/// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
-/// Falls back to the declared type when no verdict is produced.
-fn rank(
-    verdicts: Vec<ClassifierVerdict>,
-    detected_by: Vec<String>,
-    fallback: TargetType,
-) -> Classification {
-    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
-    let mut facts: Vec<DetectedFact> = Vec::new();
-    for verdict in verdicts {
-        for fact in verdict.facts {
-            if !facts
-                .iter()
-                .any(|e| e.key == fact.key && e.value == fact.value)
-            {
-                facts.push(fact);
-            }
-        }
-        let entry = best
-            .entry(verdict.target_type)
-            .or_insert((0.0, String::new()));
-        if verdict.confidence > entry.0 {
-            *entry = (verdict.confidence, verdict.rationale);
-        }
-    }
-
-    let mut candidates: Vec<TargetTypeCandidate> = best
-        .into_iter()
-        .map(
-            |(target_type, (confidence, rationale))| TargetTypeCandidate {
-                target_type,
-                confidence,
-                rationale,
-            },
-        )
-        .collect();
-    // Descending confidence; ties broken by type name for deterministic ordering.
-    candidates.sort_by(|a, b| {
-        b.confidence
-            .partial_cmp(&a.confidence)
-            .unwrap_or(std::cmp::Ordering::Equal)
-            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
-    });
-
-    let suggested = candidates
-        .first()
-        .map(|c| c.target_type)
-        .unwrap_or(fallback);
-
-    Classification {
-        suggested,
-        candidates,
-        facts,
-        detected_by,
-        detected_at: chrono::Utc::now(),
-        confirmed: false,
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Artifact;
-    use std::fs;
-    use std::path::Path;
-
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    fn no_firmware() -> MockFirmwareDetector {
-        MockFirmwareDetector { detection: None }
-    }
-
-    #[tokio::test]
-    async fn backend_repo_classifies_as_backend() {
-        let scratch = Scratch::new();
-        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
-
-        let artifact = Artifact::git_repo("https://git/x", "main");
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
-        target.artifacts.push(artifact);
-
-        let c = classify_target(&target, &wp, &no_firmware())
-            .await
-            .expect("classify");
-        assert_eq!(c.suggested, TargetType::BackendService);
-        assert!(c.detected_by.contains(&"heuristic".to_string()));
-        assert!(!c.confirmed);
-    }
-
-    #[tokio::test]
-    async fn firmware_detector_verdict_ranks_top() {
-        let scratch = Scratch::new();
-        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
-
-        let artifact =
-            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
-        target.artifacts.push(artifact);
-
-        let detector = MockFirmwareDetector {
-            detection: Some(FirmwareDetection {
-                provider: "zephyr".to_string(),
-                confidence: "high".to_string(),
-                build_system: "zephyr".to_string(),
-                framework: Some("zephyr".to_string()),
-                target: FirmwareTarget {
-                    mcu: Some("nrf52840".to_string()),
-                    ..Default::default()
-                },
-                gaps: vec![],
-            }),
-        };
-
-        let c = classify_target(&target, &wp, &detector)
-            .await
-            .expect("classify");
-        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
-        assert_eq!(c.suggested, TargetType::FirmwareRtos);
-        assert!(c.detected_by.contains(&"tramiton".to_string()));
-        assert!(c.facts.iter().any(|f| f.key == "mcu"));
-    }
-
-    #[tokio::test]
-    async fn no_signal_falls_back_to_declared_type() {
-        let scratch = Scratch::new();
-        let _ = Path::new(&scratch.0);
-        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
-        let wp = HashMap::new();
-        let c = classify_target(&target, &wp, &no_firmware())
-            .await
-            .expect("classify");
-        assert_eq!(c.suggested, TargetType::DesktopApp);
-        assert!(c.candidates.is_empty());
-    }
-}

compliance-agent/src/config.rs

@@ -42,26 +42,12 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or(3001),
         scan_schedule: env_var_opt("SCAN_SCHEDULE").unwrap_or_else(|| "0 0 */6 * * *".to_string()),
         cve_monitor_schedule: env_var_opt("CVE_MONITOR_SCHEDULE")
-            .unwrap_or_else(|| "0 0 * * * *".to_string()),
+            .unwrap_or_else(|| "0 0 0 * * *".to_string()),
         git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
             .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
-        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
-            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
         ssh_key_path: env_var_opt("SSH_KEY_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),
         keycloak_realm: env_var_opt("KEYCLOAK_REALM"),
-        keycloak_admin_username: env_var_opt("KEYCLOAK_ADMIN_USERNAME"),
-        keycloak_admin_password: env_secret_opt("KEYCLOAK_ADMIN_PASSWORD"),
-        pentest_verification_email: env_var_opt("PENTEST_VERIFICATION_EMAIL"),
-        pentest_imap_host: env_var_opt("PENTEST_IMAP_HOST"),
-        pentest_imap_port: env_var_opt("PENTEST_IMAP_PORT").and_then(|p| p.parse().ok()),
-        pentest_imap_tls: env_var_opt("PENTEST_IMAP_TLS")
-            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
-            .unwrap_or(true),
-        pentest_imap_username: env_var_opt("PENTEST_IMAP_USERNAME"),
-        pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
-        admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
-        tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
     })
 }

compliance-agent/src/database.rs

@@ -1,233 +1,11 @@
-use std::sync::Arc;
-
-use dashmap::DashMap;
 use mongodb::bson::doc;
 use mongodb::options::IndexOptions;
 use mongodb::{Client, Collection, IndexModel};
-use sha2::{Digest, Sha256};
 
 use compliance_core::models::*;
-use compliance_core::TenantContext;
 
 use crate::error::AgentError;
 
-/// Mongo enforces a 63-byte cap on database names (older clusters: 64
-/// on Linux, 63 on Windows; we target the conservative limit).
-const MAX_DB_NAME_LEN: usize = 63;
-
-/// Hex length of the SHA-256 truncation used for the hash fallback
-/// tenant DB name (16 bytes → 32 hex chars). 16 bytes gives ~2^64
-/// birthday-collision resistance — at our 10s-100s tenant scale this
-/// is effectively impossible to hit.
-const HASH_HEX_LEN: usize = 32;
-
-/// Largest `db_prefix` that still guarantees the hash-fallback name
-/// fits in the 63-byte cap: `prefix + "_" + 32 hex chars`.
-const MAX_PREFIX_LEN: usize = MAX_DB_NAME_LEN - 1 - HASH_HEX_LEN;
-
-/// Per-tenant Mongo connection broker (M7.2 isolation model).
-///
-/// Holds one [`Client`] and hands out [`Database`] handles physically
-/// scoped to `<db_prefix>_<tenant_id>`. The driver is the isolation
-/// boundary — a handle for tenant A cannot see tenant B's documents
-/// because it is connected to a different database, not because of an
-/// application-level filter.
-///
-/// Index creation runs idempotently the first time each tenant is seen
-/// in the process's lifetime. Mongo's `createIndex` is itself idempotent
-/// by index name; the in-memory `ensured` set just skips the round-trip.
-#[derive(Clone, Debug)]
-pub struct DatabasePool {
-    client: Client,
-    db_prefix: String,
-    ensured: Arc<DashMap<String, ()>>,
-}
-
-impl DatabasePool {
-    /// Connect to the cluster and prepare to hand out tenant databases
-    /// named `<db_prefix>_<tenant_id>`.
-    ///
-    /// Validates `db_prefix.len() <= MAX_PREFIX_LEN` so the
-    /// hash-fallback path is provably within Mongo's 63-byte db-name
-    /// cap. Refuses to construct a pool that could ever produce an
-    /// over-long name.
-    pub async fn connect(uri: &str, db_prefix: &str) -> Result<Self, AgentError> {
-        if db_prefix.len() > MAX_PREFIX_LEN {
-            return Err(AgentError::Other(format!(
-                "db_prefix '{db_prefix}' is {} chars; max is {MAX_PREFIX_LEN} so the \
-                 hash-fallback tenant DB name fits Mongo's {MAX_DB_NAME_LEN}-byte cap",
-                db_prefix.len()
-            )));
-        }
-        let client = Client::with_uri_str(uri).await?;
-        client
-            .database("admin")
-            .run_command(doc! { "ping": 1 })
-            .await?;
-        tracing::info!(
-            "MongoDB cluster reachable; per-tenant pool ready (db prefix '{db_prefix}')"
-        );
-        Ok(Self {
-            client,
-            db_prefix: db_prefix.to_string(),
-            ensured: Arc::new(DashMap::new()),
-        })
-    }
-
-    /// Return a [`Database`] scoped to this tenant. Ensures indexes on
-    /// first call per tenant (per process). Cheap on the hot path —
-    /// subsequent calls skip the round-trip.
-    pub async fn for_tenant(&self, ctx: &TenantContext) -> Result<Database, AgentError> {
-        self.for_tenant_id(&ctx.tenant_id).await
-    }
-
-    /// Like [`Self::for_tenant`] but accepts a bare tenant_id.
-    /// For background paths (scheduler, webhooks, pipeline orchestrators)
-    /// that don't have a full [`TenantContext`] but know which tenant
-    /// they're operating on (typically resolved from a URL path, a job
-    /// argument, or the registry).
-    pub async fn for_tenant_id(&self, tenant_id: &str) -> Result<Database, AgentError> {
-        let db_name = self.tenant_db_name(tenant_id);
-        let db = Database::from_database(self.client.database(&db_name));
-        // `DashMap::insert` returns the previous value; `None` means we
-        // were the first writer for this tenant_id and own the
-        // index-ensure work.
-        if self.ensured.insert(tenant_id.to_string(), ()).is_none() {
-            if let Err(e) = db.ensure_indexes().await {
-                // Roll the marker back so the next request retries.
-                self.ensured.remove(tenant_id);
-                return Err(e);
-            }
-            tracing::debug!(
-                tenant_id = %tenant_id,
-                db_name = %db_name,
-                "Indexes ensured for tenant database"
-            );
-        }
-        Ok(db)
-    }
-
-    /// Compute the Mongo database name for a tenant. Public for tests
-    /// and tenant offboarding (`pool.client().database(name).drop()`).
-    ///
-    /// Format: `<prefix>_<sanitized_tenant_id>` if it fits the 63-byte
-    /// cap, else `<prefix>_<sha256-16-byte-hex-of-tenant_id>`. The
-    /// `db_prefix` length invariant established at [`Self::connect`]
-    /// guarantees the hash-fallback name always fits — no runtime
-    /// assertion needed.
-    ///
-    /// Collision resistance: the hash fallback is a 16-byte SHA-256
-    /// truncation, which gives ~2^64 birthday-collision resistance. At
-    /// our 10s–100s tenant scale the probability of two tenant_ids
-    /// colliding is effectively zero. (8-byte truncation would have
-    /// been ~2^32 — too close for comfort on a regulated product.)
-    pub fn tenant_db_name(&self, tenant_id: &str) -> String {
-        let sanitized = sanitize_tenant_id(tenant_id);
-        let natural = format!("{}_{}", self.db_prefix, sanitized);
-        if natural.len() <= MAX_DB_NAME_LEN {
-            natural
-        } else {
-            let mut hasher = Sha256::new();
-            hasher.update(tenant_id.as_bytes());
-            let digest = hasher.finalize();
-            let suffix = hex::encode(&digest[..HASH_HEX_LEN / 2]);
-            format!("{}_{}", self.db_prefix, suffix)
-        }
-    }
-
-    /// Raw client handle. Reserved for cross-tenant admin flows that
-    /// must opt in explicitly (tenant listing, drop-on-offboard).
-    pub fn client(&self) -> &Client {
-        &self.client
-    }
-
-    /// Cross-tenant admin database used by features that intentionally
-    /// span tenants (today: MCP bearer tokens — each token row carries
-    /// a `tenant_id` and the MCP server reads them to route requests).
-    ///
-    /// The name `<db_prefix>__admin` (double underscore) is reserved —
-    /// the sanitizer never produces it for a normal tenant DB because
-    /// the natural format is `<db_prefix>_<sanitized_tenant_id>` (one
-    /// underscore) and tenant_ids would have to start with `_admin` to
-    /// collide. New tenant provisioning should reject such ids.
-    pub fn admin_db(&self) -> mongodb::Database {
-        self.client.database(&self.admin_db_name())
-    }
-
-    /// Name of the admin database — public so tests / operators can
-    /// drop it via the raw client.
-    pub fn admin_db_name(&self) -> String {
-        format!("{}__admin", self.db_prefix)
-    }
-
-    /// List every Mongo database currently belonging to this pool,
-    /// identified by the `<db_prefix>_` prefix. The result is the raw
-    /// database names — opening one for offboarding/cleanup goes
-    /// through [`Self::client`].
-    ///
-    /// Note: hashed-fallback names (very long tenant_ids) lose the
-    /// original tenant_id at the cluster level — we know a database
-    /// exists for *some* tenant but not which one. In practice
-    /// tenant_ids are UUIDs (36 chars) and never hit the fallback,
-    /// so this is a theoretical concern, not an operational one.
-    pub async fn list_tenant_db_names(&self) -> Result<Vec<String>, AgentError> {
-        let prefix = format!("{}_", self.db_prefix);
-        let names = self.client.list_database_names().await?;
-        Ok(names
-            .into_iter()
-            .filter(|n| n.starts_with(&prefix))
-            .collect())
-    }
-
-    /// Tenant ids for every provisioned tenant database, derived by stripping
-    /// the `<prefix>_` from the database names. Skips the admin database
-    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
-    /// at the cluster level and cannot be recovered here — in practice tenant
-    /// ids are UUIDs and never hit that path. Used by the migration CLI's
-    /// `--all` mode.
-    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
-        let prefix = format!("{}_", self.db_prefix);
-        Ok(self
-            .list_tenant_db_names()
-            .await?
-            .into_iter()
-            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
-            .filter(|id| !id.starts_with('_'))
-            .collect())
-    }
-
-    /// Drop the database for a specific tenant. Used by GDPR delete
-    /// and tenant offboarding. Idempotent — dropping a non-existent
-    /// database is a no-op at the driver level.
-    ///
-    /// Also evicts the tenant from the in-memory `ensured` set so a
-    /// later re-provision triggers fresh `ensure_indexes`.
-    pub async fn drop_tenant(&self, tenant_id: &str) -> Result<(), AgentError> {
-        let db_name = self.tenant_db_name(tenant_id);
-        self.client.database(&db_name).drop().await?;
-        self.ensured.remove(tenant_id);
-        tracing::info!(
-            tenant_id = %tenant_id,
-            db_name = %db_name,
-            "Dropped tenant database"
-        );
-        Ok(())
-    }
-}
-
-/// Mongo database names disallow `/`, `\`, `.`, `"`, `$`, ` `, and NUL.
-/// breakpilot-dev tenant_ids are UUIDs so this is belt-and-braces, but
-/// it lets the pool tolerate any future tenant_id shape without surprise.
-fn sanitize_tenant_id(tenant_id: &str) -> String {
-    tenant_id
-        .chars()
-        .map(|c| match c {
-            '/' | '\\' | '.' | '"' | '$' | ' ' | '\0' => '_',
-            c => c,
-        })
-        .collect()
-}
-
 #[derive(Clone, Debug)]
 pub struct Database {
     inner: mongodb::Database,
@@ -242,12 +20,6 @@ impl Database {
         Ok(Self { inner: db })
     }
 
-    /// Wrap an already-resolved Mongo database. Used by [`DatabasePool`]
-    /// to hand out tenant-scoped handles without a fresh client per tenant.
-    pub(crate) fn from_database(inner: mongodb::Database) -> Self {
-        Self { inner }
-    }
-
     pub async fn ensure_indexes(&self) -> Result<(), AgentError> {
         // repositories: unique git_url
         self.repositories()
@@ -306,25 +78,6 @@ impl Database {
             )
             .await?;
 
-        // cve_notifications: unique cve_id + repo_id + package, status filter
-        self.cve_notifications()
-            .create_index(
-                IndexModel::builder()
-                    .keys(
-                        doc! { "cve_id": 1, "repo_id": 1, "package_name": 1, "package_version": 1 },
-                    )
-                    .options(IndexOptions::builder().unique(true).build())
-                    .build(),
-            )
-            .await?;
-        self.cve_notifications()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "created_at": -1 })
-                    .build(),
-            )
-            .await?;
-
         // tracker_issues: unique finding_id
         self.tracker_issues()
             .create_index(
@@ -445,36 +198,6 @@ impl Database {
             )
             .await?;
 
-        // onboarded_targets: multikey on artifact source ref (webhook + dedupe
-        // lookup). Non-unique — "one git URL per tenant" is enforced in the
-        // create handler, since a unique multikey index on an array field has
-        // null-collision caveats.
-        self.onboarded_targets()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "artifacts.source_ref": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // onboarded_targets: multikey on artifact kind
-        self.onboarded_targets()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "artifacts.kind": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // onboarded_targets: target_type filter
-        self.onboarded_targets()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "target_type": 1 })
-                    .build(),
-            )
-            .await?;
-
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -499,12 +222,6 @@ impl Database {
         self.inner.collection("cve_alerts")
     }
 
-    pub fn cve_notifications(
-        &self,
-    ) -> Collection<compliance_core::models::notification::CveNotification> {
-        self.inner.collection("cve_notifications")
-    }
-
     pub fn tracker_issues(&self) -> Collection<TrackerIssue> {
         self.inner.collection("tracker_issues")
     }
@@ -531,20 +248,6 @@ impl Database {
         self.inner.collection("dast_targets")
     }
 
-    /// The unified onboarding targets that replace `repositories` and
-    /// `dast_targets`. Ids are preserved from the legacy collections during
-    /// migration so downstream `repo_id` / `target_id` references keep resolving.
-    pub fn onboarded_targets(&self) -> Collection<OnboardedTarget> {
-        self.inner.collection("onboarded_targets")
-    }
-
-    /// A typed handle to an arbitrary collection by name. For bookkeeping
-    /// collections without a dedicated model (e.g. `schema_migrations`,
-    /// `onboarding_migration_log`).
-    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
-        self.inner.collection(name)
-    }
-
     pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
         self.inner.collection("dast_scan_runs")
     }

compliance-agent/src/ingest/blob.rs

@@ -1,154 +0,0 @@
-//! Content-addressed blob storage and archive extraction for ingest.
-//!
-//! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
-//! digest; per-run working directories live under `<base>/work/`.
-
-use std::fs::{self, File};
-use std::io::{self, Read};
-use std::path::{Path, PathBuf};
-
-use sha2::{Digest, Sha256};
-
-use crate::error::AgentError;
-
-/// Read buffer size for streaming hashes/copies (64 KiB).
-const BUF_LEN: usize = 64 * 1024;
-
-/// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
-/// byte length. Streams so large firmware images never load fully into memory.
-pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
-    let mut file = File::open(path)?;
-    let mut hasher = Sha256::new();
-    let mut buf = [0u8; BUF_LEN];
-    let mut total: u64 = 0;
-    loop {
-        let n = file.read(&mut buf)?;
-        if n == 0 {
-            break;
-        }
-        hasher.update(&buf[..n]);
-        total += n as u64;
-    }
-    Ok((hex::encode(hasher.finalize()), total))
-}
-
-/// Copy `src` into the content-addressed blob store under `base`, returning the
-/// stored path. Idempotent: an already-present blob is not rewritten.
-pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
-    if sha.len() < 2 {
-        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
-    }
-    let dir = base.join("blobs").join(&sha[0..2]);
-    fs::create_dir_all(&dir)?;
-    let dest = dir.join(sha);
-    if !dest.exists() {
-        fs::copy(src, &dest)?;
-    }
-    Ok(dest)
-}
-
-/// Extract a zip archive into `dest` (created if needed). `enclosed_name`
-/// sanitizes each entry path, so this is safe against zip-slip traversal.
-pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
-    let file = File::open(archive)?;
-    let mut zip =
-        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
-    fs::create_dir_all(dest)?;
-    for i in 0..zip.len() {
-        let mut entry = zip
-            .by_index(i)
-            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
-        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
-        let Some(rel) = entry.enclosed_name() else {
-            continue;
-        };
-        let out = dest.join(rel);
-        if entry.is_dir() {
-            fs::create_dir_all(&out)?;
-        } else {
-            if let Some(parent) = out.parent() {
-                fs::create_dir_all(parent)?;
-            }
-            let mut outfile = File::create(&out)?;
-            io::copy(&mut entry, &mut outfile)?;
-        }
-    }
-    Ok(())
-}
-
-/// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
-pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
-    base.join("work").join(target_id).join(artifact_id)
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    /// A unique scratch directory, removed on drop.
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir scratch");
-            Self(p)
-        }
-        fn path(&self) -> &Path {
-            &self.0
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    #[test]
-    fn hash_is_stable_and_reports_size() {
-        let dir = Scratch::new();
-        let f = dir.path().join("a.bin");
-        fs::write(&f, b"hello world").expect("write");
-        let (sha, size) = hash_file(&f).expect("hash");
-        assert_eq!(size, 11);
-        // Known SHA-256 of "hello world".
-        assert_eq!(
-            sha,
-            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
-        );
-    }
-
-    #[test]
-    fn store_is_content_addressed_and_idempotent() {
-        let base = Scratch::new();
-        let src = base.path().join("src.bin");
-        fs::write(&src, b"payload").expect("write");
-        let (sha, _) = hash_file(&src).expect("hash");
-        let p1 = store_file(base.path(), &src, &sha).expect("store");
-        let p2 = store_file(base.path(), &src, &sha).expect("store again");
-        assert_eq!(p1, p2);
-        assert!(p1.ends_with(&sha));
-        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
-        assert_eq!(fs::read(&p1).expect("read"), b"payload");
-    }
-
-    #[test]
-    fn extract_zip_writes_entries() {
-        let base = Scratch::new();
-        let archive = base.path().join("a.zip");
-        {
-            let file = File::create(&archive).expect("create");
-            let mut w = zip::ZipWriter::new(file);
-            let opts: zip::write::SimpleFileOptions = Default::default();
-            w.start_file("dir/hello.txt", opts).expect("start");
-            io::Write::write_all(&mut w, b"hi").expect("write");
-            w.finish().expect("finish");
-        }
-        let dest = base.path().join("out");
-        extract_zip(&archive, &dest).expect("extract");
-        assert_eq!(
-            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
-            "hi"
-        );
-    }
-}

compliance-agent/src/ingest/mod.rs

@@ -1,334 +0,0 @@
-//! Artifact ingest.
-//!
-//! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
-//! path plus recorded metadata (content hash, size, discovered facts) that the
-//! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
-//! is also the reconciliation key against sibling products (a firmware sha256
-//! matches tramiton's `Artifact.sha256`).
-
-mod blob;
-
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-
-use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
-use compliance_core::AgentConfig;
-
-use crate::error::AgentError;
-use crate::pipeline::git::{GitOps, RepoCredentials};
-
-/// The paths and identifiers an ingest needs. Decoupled from the full
-/// [`AgentConfig`] so ingest is testable without a complete config.
-pub struct IngestContext<'a> {
-    /// Base directory for content-addressed blobs and working dirs.
-    pub artifact_store_base: &'a Path,
-    /// Base directory for git clones.
-    pub git_clone_base: &'a str,
-    /// Default SSH key path (used when an artifact provides none).
-    pub ssh_key_path: &'a str,
-    /// The id of the target these artifacts belong to (namespaces working dirs).
-    pub target_id: &'a str,
-}
-
-impl<'a> IngestContext<'a> {
-    /// Build an ingest context from the agent config for a given target.
-    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
-        Self {
-            artifact_store_base: Path::new(&config.artifact_store_base_path),
-            git_clone_base: &config.git_clone_base_path,
-            ssh_key_path: &config.ssh_key_path,
-            target_id,
-        }
-    }
-}
-
-/// The result of ingesting one artifact.
-pub struct IngestedArtifact {
-    /// The artifact this corresponds to ([`Artifact::id`]).
-    pub artifact_id: String,
-    /// The artifact kind.
-    pub kind: ArtifactKind,
-    /// Local working path (clone dir, extracted dir, or blob file). `None` for
-    /// artifacts with no on-disk form (live URL, plaintext, container ref).
-    pub working_path: Option<PathBuf>,
-    /// SHA-256 of the content (blobs) or git head SHA (git repos).
-    pub content_hash: Option<String>,
-    /// Stored blob size in bytes, when applicable.
-    pub size_bytes: Option<u64>,
-    /// Facts discovered during ingest.
-    pub facts: Vec<DetectedFact>,
-}
-
-/// All ingested artifacts for a target, keyed by artifact id.
-pub struct IngestSet {
-    /// The ingested artifacts, keyed by [`Artifact::id`].
-    pub by_artifact: HashMap<String, IngestedArtifact>,
-}
-
-impl IngestSet {
-    /// The working paths of every ingested artifact that has one — the input the
-    /// classifier expects.
-    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
-        self.by_artifact
-            .iter()
-            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
-            .collect()
-    }
-
-    /// The ingest result for a specific artifact.
-    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
-        self.by_artifact.get(artifact_id)
-    }
-}
-
-/// Ingest every artifact on a target.
-pub fn ingest_all(
-    target: &OnboardedTarget,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestSet, AgentError> {
-    let mut by_artifact = HashMap::new();
-    for artifact in &target.artifacts {
-        let ingested = ingest_artifact(artifact, ctx)?;
-        by_artifact.insert(artifact.id.clone(), ingested);
-    }
-    Ok(IngestSet { by_artifact })
-}
-
-/// Ingest a single artifact, dispatching on its kind.
-pub fn ingest_artifact(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestedArtifact, AgentError> {
-    match artifact.kind {
-        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
-        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
-            ingest_blob(artifact, ctx, true)
-        }
-        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
-        ArtifactKind::ContainerImage => Ok(metadata_only(
-            artifact,
-            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
-        )),
-        ArtifactKind::LiveUrl => Ok(metadata_only(
-            artifact,
-            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
-        )),
-        ArtifactKind::PlaintextDescription => Ok(metadata_only(
-            artifact,
-            DetectedFact::new(
-                "description_len",
-                artifact.source_ref.len().to_string(),
-                "ingest",
-            ),
-        )),
-    }
-}
-
-/// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
-fn ingest_git(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestedArtifact, AgentError> {
-    let creds = credentials_for(artifact, ctx.ssh_key_path);
-    let git_ops = GitOps::new(ctx.git_clone_base, creds);
-    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
-    let head = GitOps::get_head_sha(&repo_path).ok();
-    Ok(IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: Some(repo_path),
-        content_hash: head,
-        size_bytes: None,
-        facts: Vec::new(),
-    })
-}
-
-/// Store a blob artifact content-addressed. When `extract` is set and the blob
-/// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
-/// working directory; otherwise the working path is the stored blob.
-fn ingest_blob(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-    extract: bool,
-) -> Result<IngestedArtifact, AgentError> {
-    let base = ctx.artifact_store_base;
-    let src = local_source(artifact)?;
-    let (sha, size) = blob::hash_file(&src)?;
-    let stored = blob::store_file(base, &src, &sha)?;
-
-    let mut facts = Vec::new();
-    let working_path = if extract {
-        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
-        match blob::extract_zip(&stored, &dest) {
-            Ok(()) => dest,
-            Err(e) => {
-                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
-                // note it so later stages can decide what to do.
-                facts.push(DetectedFact::new(
-                    "archive_unextracted",
-                    e.to_string(),
-                    "ingest",
-                ));
-                stored.clone()
-            }
-        }
-    } else {
-        stored.clone()
-    };
-
-    Ok(IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: Some(working_path),
-        content_hash: Some(sha),
-        size_bytes: Some(size),
-        facts,
-    })
-}
-
-/// An artifact with no on-disk form: record a single fact, no hash/path.
-fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
-    IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: None,
-        content_hash: None,
-        size_bytes: None,
-        facts: vec![fact],
-    }
-}
-
-/// The local file backing a blob artifact: its `stored_path` if already
-/// uploaded, else its `source_ref` interpreted as a filesystem path.
-fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
-    let path = artifact
-        .stored_path
-        .as_deref()
-        .unwrap_or(artifact.source_ref.as_str());
-    let path = PathBuf::from(path);
-    if !path.exists() {
-        return Err(AgentError::Other(format!(
-            "artifact {} source not found at {}",
-            artifact.id,
-            path.display()
-        )));
-    }
-    Ok(path)
-}
-
-/// Build git credentials from an artifact's auth plus a default SSH key path.
-fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
-    let auth = artifact.auth.as_ref();
-    RepoCredentials {
-        ssh_key_path: auth
-            .and_then(|a| a.ssh_key_path.clone())
-            .or_else(|| Some(default_ssh_key_path.to_string())),
-        auth_token: auth.and_then(|a| a.secret.clone()),
-        auth_username: auth.and_then(|a| a.username.clone()),
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{ArtifactAuth, TargetType};
-
-    /// A unique scratch directory, removed on drop.
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
-            std::fs::create_dir_all(&p).expect("mkdir scratch");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
-        IngestContext {
-            artifact_store_base: store,
-            git_clone_base: "/tmp/cs-ingest-test-repos",
-            ssh_key_path: "/tmp/cs-ingest-test-ssh",
-            target_id,
-        }
-    }
-
-    #[test]
-    fn firmware_blob_is_hashed_and_stored() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let fw = scratch.0.join("fw.bin");
-        std::fs::write(&fw, b"firmware-bytes").expect("write");
-
-        let ctx = ctx_for(&store, "t1");
-        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-
-        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
-        assert_eq!(out.size_bytes, Some(14));
-        let sha = out.content_hash.expect("hash");
-        assert_eq!(sha.len(), 64);
-        // working path is the content-addressed blob
-        let wp = out.working_path.expect("working path");
-        assert!(wp.starts_with(store.join("blobs")));
-    }
-
-    #[test]
-    fn live_url_has_no_blob() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let ctx = ctx_for(&store, "t1");
-        let artifact = Artifact::live_url("https://example.com");
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-        assert!(out.working_path.is_none());
-        assert!(out.content_hash.is_none());
-        assert!(out.facts.iter().any(|f| f.key == "live_url"));
-    }
-
-    #[test]
-    fn ingest_all_collects_working_paths() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let fw = scratch.0.join("fw.bin");
-        std::fs::write(&fw, b"abc").expect("write");
-        let ctx = ctx_for(&store, "t1");
-
-        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
-        target
-            .artifacts
-            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
-        target.artifacts.push(Artifact::live_url("https://x"));
-
-        let set = ingest_all(&target, &ctx).expect("ingest all");
-        assert_eq!(set.by_artifact.len(), 2);
-        // Only the firmware artifact yields a working path.
-        assert_eq!(set.working_paths().len(), 1);
-    }
-
-    #[test]
-    fn credentials_prefer_artifact_auth() {
-        let mut artifact = Artifact::git_repo("https://git/x", "main");
-        artifact.auth = Some(ArtifactAuth {
-            method: "token".to_string(),
-            username: Some("bob".to_string()),
-            secret: Some("pat".to_string()),
-            ..Default::default()
-        });
-        let creds = credentials_for(&artifact, "/default/ssh/key");
-        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
-        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
-    }
-
-    #[test]
-    fn credentials_fall_back_to_default_ssh_key() {
-        let artifact = Artifact::git_repo("git@host:x.git", "main");
-        let creds = credentials_for(&artifact, "/default/ssh/key");
-        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
-        assert!(creds.auth_token.is_none());
-    }
-}

compliance-agent/src/lib.rs

@@ -1,19 +0,0 @@
-// Library entrypoint — re-exports for integration tests and the binary.
-
-pub mod agent;
-pub mod api;
-pub mod classify;
-pub mod config;
-pub mod database;
-pub mod error;
-pub mod ingest;
-pub mod llm;
-pub mod migrate;
-pub mod pentest;
-pub mod pipeline;
-pub mod rag;
-pub mod scheduler;
-pub mod ssh;
-#[allow(dead_code)]
-pub mod trackers;
-pub mod webhooks;

compliance-agent/src/llm/client.rs

@@ -1,17 +1,147 @@
 use secrecy::{ExposeSecret, SecretString};
+use serde::{Deserialize, Serialize};
 
-use super::types::*;
 use crate::error::AgentError;
 
 #[derive(Clone)]
 pub struct LlmClient {
-    pub(crate) base_url: String,
+    base_url: String,
-    pub(crate) api_key: SecretString,
+    api_key: SecretString,
-    pub(crate) model: String,
+    model: String,
-    pub(crate) embed_model: String,
+    embed_model: String,
-    pub(crate) http: reqwest::Client,
+    http: reqwest::Client,
 }
 
+// ── Request types ──────────────────────────────────────────────
+
+#[derive(Serialize, Clone, Debug)]
+pub struct ChatMessage {
+    pub role: String,
+    pub content: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_calls: Option<Vec<ToolCallRequest>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tool_call_id: Option<String>,
+}
+
+#[derive(Serialize)]
+struct ChatCompletionRequest {
+    model: String,
+    messages: Vec<ChatMessage>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    temperature: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    max_tokens: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    tools: Option<Vec<ToolDefinitionPayload>>,
+}
+
+#[derive(Serialize)]
+struct ToolDefinitionPayload {
+    r#type: String,
+    function: ToolFunctionPayload,
+}
+
+#[derive(Serialize)]
+struct ToolFunctionPayload {
+    name: String,
+    description: String,
+    parameters: serde_json::Value,
+}
+
+// ── Response types ─────────────────────────────────────────────
+
+#[derive(Deserialize)]
+struct ChatCompletionResponse {
+    choices: Vec<ChatChoice>,
+}
+
+#[derive(Deserialize)]
+struct ChatChoice {
+    message: ChatResponseMessage,
+}
+
+#[derive(Deserialize)]
+struct ChatResponseMessage {
+    #[serde(default)]
+    content: Option<String>,
+    #[serde(default)]
+    tool_calls: Option<Vec<ToolCallResponse>>,
+}
+
+#[derive(Deserialize)]
+struct ToolCallResponse {
+    id: String,
+    function: ToolCallFunction,
+}
+
+#[derive(Deserialize)]
+struct ToolCallFunction {
+    name: String,
+    arguments: String,
+}
+
+// ── Public types for tool calling ──────────────────────────────
+
+/// Definition of a tool that the LLM can invoke
+#[derive(Debug, Clone, Serialize)]
+pub struct ToolDefinition {
+    pub name: String,
+    pub description: String,
+    pub parameters: serde_json::Value,
+}
+
+/// A tool call request from the LLM
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct LlmToolCall {
+    pub id: String,
+    pub name: String,
+    pub arguments: serde_json::Value,
+}
+
+/// A tool call in the request message format (for sending back tool_calls in assistant messages)
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ToolCallRequest {
+    pub id: String,
+    pub r#type: String,
+    pub function: ToolCallRequestFunction,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ToolCallRequestFunction {
+    pub name: String,
+    pub arguments: String,
+}
+
+/// Response from the LLM — either content or tool calls
+#[derive(Debug, Clone)]
+pub enum LlmResponse {
+    Content(String),
+    /// Tool calls with optional reasoning text from the LLM
+    ToolCalls { calls: Vec<LlmToolCall>, reasoning: String },
+}
+
+// ── Embedding types ────────────────────────────────────────────
+
+#[derive(Serialize)]
+struct EmbeddingRequest {
+    model: String,
+    input: Vec<String>,
+}
+
+#[derive(Deserialize)]
+struct EmbeddingResponse {
+    data: Vec<EmbeddingData>,
+}
+
+#[derive(Deserialize)]
+struct EmbeddingData {
+    embedding: Vec<f64>,
+    index: usize,
+}
+
+// ── Implementation ─────────────────────────────────────────────
+
 impl LlmClient {
     pub fn new(
         base_url: String,
@@ -19,28 +149,27 @@ impl LlmClient {
         model: String,
         embed_model: String,
     ) -> Self {
-        let http = reqwest::Client::builder()
-            .timeout(std::time::Duration::from_secs(300))
-            .connect_timeout(std::time::Duration::from_secs(10))
-            .build()
-            .unwrap_or_default();
         Self {
             base_url,
             api_key,
             model,
             embed_model,
-            http,
+            http: reqwest::Client::new(),
         }
     }
 
-    pub(crate) fn chat_url(&self) -> String {
+    pub fn embed_model(&self) -> &str {
+        &self.embed_model
+    }
+
+    fn chat_url(&self) -> String {
         format!(
             "{}/v1/chat/completions",
             self.base_url.trim_end_matches('/')
         )
     }
 
-    pub(crate) fn auth_header(&self) -> Option<String> {
+    fn auth_header(&self) -> Option<String> {
         let key = self.api_key.expose_secret();
         if key.is_empty() {
             None
@@ -112,12 +241,12 @@ impl LlmClient {
             tools: None,
         };
 
-        self.send_chat_request(&request_body)
+        self.send_chat_request(&request_body).await.map(|resp| {
-            .await
+            match resp {
-            .map(|resp| match resp {
                 LlmResponse::Content(c) => c,
                 LlmResponse::ToolCalls { .. } => String::new(),
-            })
+            }
+        })
     }
 
     /// Chat with tool definitions — returns either content or tool calls.
@@ -163,7 +292,7 @@ impl LlmClient {
     ) -> Result<LlmResponse, AgentError> {
         let mut req = self
             .http
-            .post(self.chat_url())
+            .post(&self.chat_url())
             .header("content-type", "application/json")
             .json(request_body);
 
@@ -216,7 +345,54 @@ impl LlmClient {
         }
 
         // Otherwise return content
-        let content = choice.message.content.clone().unwrap_or_default();
+        let content = choice
+            .message
+            .content
+            .clone()
+            .unwrap_or_default();
         Ok(LlmResponse::Content(content))
     }
+
+    /// Generate embeddings for a batch of texts
+    pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
+        let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));
+
+        let request_body = EmbeddingRequest {
+            model: self.embed_model.clone(),
+            input: texts,
+        };
+
+        let mut req = self
+            .http
+            .post(&url)
+            .header("content-type", "application/json")
+            .json(&request_body);
+
+        if let Some(auth) = self.auth_header() {
+            req = req.header("Authorization", auth);
+        }
+
+        let resp = req
+            .send()
+            .await
+            .map_err(|e| AgentError::Other(format!("Embedding request failed: {e}")))?;
+
+        if !resp.status().is_success() {
+            let status = resp.status();
+            let body = resp.text().await.unwrap_or_default();
+            return Err(AgentError::Other(format!(
+                "Embedding API returned {status}: {body}"
+            )));
+        }
+
+        let body: EmbeddingResponse = resp
+            .json()
+            .await
+            .map_err(|e| AgentError::Other(format!("Failed to parse embedding response: {e}")))?;
+
+        let mut data = body.data;
+        data.sort_by_key(|d| d.index);
+
+        Ok(data.into_iter().map(|d| d.embedding).collect())
+    }
 }

compliance-agent/src/llm/descriptions.rs

@@ -5,20 +5,15 @@ use compliance_core::models::Finding;
 use crate::error::AgentError;
 use crate::llm::LlmClient;
 
-const DESCRIPTION_SYSTEM_PROMPT: &str = r#"You are a security engineer writing a bug tracker issue for a developer to fix. Be direct and actionable — developers skim issue descriptions, so lead with what matters.
+const DESCRIPTION_SYSTEM_PROMPT: &str = r#"You are a security engineer writing issue descriptions for a bug tracker. Generate a clear, actionable issue body in Markdown format that includes:
 
-Format in Markdown:
+1. **Summary**: 1-2 sentence overview
+2. **Evidence**: Code location, snippet, and what was detected
+3. **Impact**: What could happen if not fixed
+4. **Remediation**: Step-by-step fix instructions
+5. **References**: Relevant CWE/CVE links if applicable
 
-1. **What**: 1 sentence — what's wrong and where (file:line)
+Keep it concise and professional. Use code blocks for code snippets."#;
-2. **Why it matters**: 1-2 sentences — concrete impact if not fixed. Avoid generic "could lead to" phrasing; describe the specific attack or failure scenario.
-3. **Fix**: The specific code change needed. Use a code block with the corrected code if possible. If the fix is configuration-based, show the exact config change.
-4. **References**: CWE/CVE link if applicable (one line, not a section)
-
-Rules:
-- No filler paragraphs or background explanations
-- No restating the finding title in the body
-- Code blocks should show the FIX, not the vulnerable code (the developer can see that in the diff)
-- If the remediation is a one-liner, just say it — don't wrap it in a section header"#;
 
 pub async fn generate_issue_description(
     llm: &Arc<LlmClient>,

compliance-agent/src/llm/embedding.rs

@@ -1,74 +0,0 @@
-use serde::{Deserialize, Serialize};
-
-use super::client::LlmClient;
-use crate::error::AgentError;
-
-// ── Embedding types ────────────────────────────────────────────
-
-#[derive(Serialize)]
-struct EmbeddingRequest {
-    model: String,
-    input: Vec<String>,
-}
-
-#[derive(Deserialize)]
-struct EmbeddingResponse {
-    data: Vec<EmbeddingData>,
-}
-
-#[derive(Deserialize)]
-struct EmbeddingData {
-    embedding: Vec<f64>,
-    index: usize,
-}
-
-// ── Embedding implementation ───────────────────────────────────
-
-impl LlmClient {
-    pub fn embed_model(&self) -> &str {
-        &self.embed_model
-    }
-
-    /// Generate embeddings for a batch of texts
-    pub async fn embed(&self, texts: Vec<String>) -> Result<Vec<Vec<f64>>, AgentError> {
-        let url = format!("{}/v1/embeddings", self.base_url.trim_end_matches('/'));
-
-        let request_body = EmbeddingRequest {
-            model: self.embed_model.clone(),
-            input: texts,
-        };
-
-        let mut req = self
-            .http
-            .post(&url)
-            .header("content-type", "application/json")
-            .json(&request_body);
-
-        if let Some(auth) = self.auth_header() {
-            req = req.header("Authorization", auth);
-        }
-
-        let resp = req
-            .send()
-            .await
-            .map_err(|e| AgentError::Other(format!("Embedding request failed: {e}")))?;
-
-        if !resp.status().is_success() {
-            let status = resp.status();
-            let body = resp.text().await.unwrap_or_default();
-            return Err(AgentError::Other(format!(
-                "Embedding API returned {status}: {body}"
-            )));
-        }
-
-        let body: EmbeddingResponse = resp
-            .json()
-            .await
-            .map_err(|e| AgentError::Other(format!("Failed to parse embedding response: {e}")))?;
-
-        let mut data = body.data;
-        data.sort_by_key(|d| d.index);
-
-        Ok(data.into_iter().map(|d| d.embedding).collect())
-    }
-}

compliance-agent/src/llm/fixes.rs

@@ -5,24 +5,7 @@ use compliance_core::models::Finding;
 use crate::error::AgentError;
 use crate::llm::LlmClient;
 
-const FIX_SYSTEM_PROMPT: &str = r#"You are a security engineer suggesting a code fix. Return ONLY the corrected code that replaces the vulnerable snippet — no explanations, no markdown fences, no before/after comparison.
+const FIX_SYSTEM_PROMPT: &str = r#"You are a security engineer. Given a security finding with code context, suggest a concrete code fix. Return ONLY the fixed code snippet that can directly replace the vulnerable code. Include brief inline comments explaining the fix."#;
-
-Rules:
-- The fix must be a drop-in replacement for the vulnerable code
-- Preserve the original code's style, indentation, and naming conventions
-- Add at most one brief inline comment on the changed line explaining the security fix
-- If the fix requires importing a new module, include the import on a separate line prefixed with the language's comment syntax + "Add import: "
-- Do not refactor, rename variables, or "improve" unrelated code
-- If the vulnerability is a false positive and the code is actually safe, return the original code unchanged with a comment explaining why no fix is needed
-
-Language-specific fix guidance:
-- Rust: use `?` for error propagation, prefer `SecretString` for secrets, use parameterized queries with `sqlx`/`diesel`
-- Python: use parameterized queries (never f-strings in SQL), use `secrets` module not `random`, use `subprocess.run([...])` list form, use `markupsafe.escape()` for HTML
-- Go: use `sql.Query` with `$1`/`?` placeholders, use `crypto/rand` not `math/rand`, use `html/template` not `text/template`, return errors don't panic
-- Java/Kotlin: use `PreparedStatement` with `?` params, use `SecureRandom`, use `Jsoup.clean()` for HTML sanitization, use `@Valid` for input validation
-- Ruby: use ActiveRecord parameterized finders, use `SecureRandom`, use `ERB::Util.html_escape`, use `strong_parameters`
-- PHP: use PDO prepared statements with `:param` or `?`, use `random_bytes()`/`random_int()`, use `htmlspecialchars()` with `ENT_QUOTES`, use `password_hash(PASSWORD_BCRYPT)`
-- C/C++: use `snprintf` not `sprintf`, use bounds-checked APIs, free resources in reverse allocation order, use `memset_s` for secret cleanup"#;
 
 pub async fn suggest_fix(llm: &Arc<LlmClient>, finding: &Finding) -> Result<String, AgentError> {
     let user_prompt = format!(

compliance-agent/src/llm/mod.rs

@@ -1,16 +1,11 @@
 pub mod client;
 #[allow(dead_code)]
 pub mod descriptions;
-pub mod embedding;
 #[allow(dead_code)]
 pub mod fixes;
 #[allow(dead_code)]
 pub mod pr_review;
 pub mod review_prompts;
 pub mod triage;
-pub mod types;
 
 pub use client::LlmClient;
-pub use types::{
-    ChatMessage, LlmResponse, ToolCallRequest, ToolCallRequestFunction, ToolDefinition,
-};

compliance-agent/src/llm/review_prompts.rs

@@ -1,138 +1,69 @@
 // System prompts for multi-pass LLM code review.
 // Each pass focuses on a different aspect to avoid overloading a single prompt.
 
-pub const LOGIC_REVIEW_PROMPT: &str = r#"You are a senior software engineer reviewing a code diff. Report ONLY genuine logic bugs that would cause incorrect behavior at runtime.
+pub const LOGIC_REVIEW_PROMPT: &str = r#"You are a senior software engineer reviewing code changes. Focus ONLY on logic and correctness issues.
 
-Report:
+Look for:
-- Off-by-one errors, wrong comparisons, missing edge cases that cause wrong results
+- Off-by-one errors, wrong comparisons, missing edge cases
-- Incorrect control flow that produces wrong output (not style preferences)
+- Incorrect control flow (unreachable code, missing returns, wrong loop conditions)
-- Actual race conditions with concrete shared-state mutation (not theoretical ones)
+- Race conditions or concurrency bugs
-- Resource leaks where cleanup is truly missing (not just "could be improved")
+- Resource leaks (unclosed handles, missing cleanup)
-- Wrong variable used (copy-paste errors) — must be provably wrong, not just suspicious
+- Wrong variable used (copy-paste errors)
-- Swallowed errors that silently hide failures in a way that matters
+- Incorrect error handling (swallowed errors, wrong error type)
 
-Do NOT report:
+Ignore: style, naming, formatting, documentation, minor improvements.
-- Style, naming, formatting, documentation, or code organization preferences
-- Theoretical issues without a concrete triggering scenario
-- "Potential" problems that require assumptions not supported by the visible code
-- Complexity or function length — that's a separate review pass
 
-Language-idiomatic patterns that are NOT bugs (do not flag these):
+For each issue found, respond with a JSON array:
-- Rust: `||`/`&&` short-circuit evaluation, variable shadowing, `let` rebinding, `clone()`, `impl` blocks, `match` arms with guards, `?` operator chaining, `unsafe` blocks with safety comments
-- Python: duck typing, EAFP pattern (try/except vs check-first), `*args`/`**kwargs`, walrus operator `:=`, truthiness checks on containers, bare `except:` in top-level handlers
-- Go: multiple return values for errors, `if err != nil` patterns, goroutine + channel patterns, blank identifier `_`, named returns, `defer` for cleanup, `init()` functions
-- Java/Kotlin: checked exception patterns, method overloading, `Optional` vs null checks, Kotlin `?.` safe calls, `!!` non-null assertions in tests, `when` exhaustive matching, companion objects, `lateinit`
-- Ruby: monkey patching in libraries, method_missing, blocks/procs/lambdas, `rescue => e` patterns, `send`/`respond_to?` metaprogramming, `nil` checks via `&.` safe navigation
-- PHP: loose comparisons with `==` (only flag if `===` was clearly intended), `@` error suppression in legacy code, `isset()`/`empty()` patterns, magic methods (`__get`, `__call`), array functions as callbacks
-- C/C++: RAII patterns, move semantics, `const_cast`/`static_cast` in appropriate contexts, macro usage for platform compat, pointer arithmetic in low-level code, `goto` for cleanup in C
-
-Severity guide:
-- high: Will cause incorrect behavior in normal usage
-- medium: Will cause incorrect behavior in edge cases
-- low: Minor correctness concern with limited blast radius
-
-Prefer returning [] over reporting low-confidence guesses. A false positive wastes more developer time than a missed low-severity issue.
-
-Respond with a JSON array (no markdown fences):
 [{"title": "...", "description": "...", "severity": "high|medium|low", "file": "...", "line": N, "suggestion": "..."}]
 
 If no issues found, respond with: []"#;
 
-pub const SECURITY_REVIEW_PROMPT: &str = r#"You are a security engineer reviewing a code diff. Report ONLY exploitable security vulnerabilities with a realistic attack scenario.
+pub const SECURITY_REVIEW_PROMPT: &str = r#"You are a security engineer reviewing code changes. Focus ONLY on security vulnerabilities.
 
-Report:
+Look for:
-- Injection vulnerabilities (SQL, command, XSS, template) where untrusted input reaches a sink
+- Injection vulnerabilities (SQL, command, XSS, template injection)
-- Authentication/authorization bypasses with a concrete exploit path
+- Authentication/authorization bypasses
-- Sensitive data exposure: secrets in code, credentials in logs, PII leaks
+- Sensitive data exposure (logging secrets, hardcoded credentials)
-- Insecure cryptography: weak algorithms, predictable randomness, hardcoded keys
+- Insecure cryptography (weak algorithms, predictable randomness)
-- Path traversal, SSRF, open redirects — only where user input reaches the vulnerable API
+- Path traversal, SSRF, open redirects
-- Unsafe deserialization of untrusted data
+- Unsafe deserialization
-- Missing input validation at EXTERNAL trust boundaries (user input, API responses)
+- Missing input validation at trust boundaries
 
-Do NOT report:
+Ignore: code style, performance, general quality.
-- Internal code that only handles trusted/validated data
-- Hash functions used for non-security purposes (dedup fingerprints, cache keys, content addressing)
-- Logging of non-sensitive operational data (finding titles, counts, performance metrics)
-- "Information disclosure" for data that is already public or user-facing
-- Code style, performance, or general quality issues
-- Missing validation on internal function parameters (trust the caller within the same module/crate/package)
-- Theoretical attacks that require preconditions not present in the code
 
-Language-specific patterns that are NOT vulnerabilities (do not flag these):
+For each issue found, respond with a JSON array:
-- Python: `pickle` used on trusted internal data, `eval()`/`exec()` on hardcoded strings, `subprocess` with hardcoded commands, Django `mark_safe()` on static content, `assert` in non-security contexts
-- Go: `crypto/rand` is secure (don't confuse with `math/rand`), `sql.DB` with parameterized queries is safe, `http.ListenAndServe` without TLS in dev/internal, error strings in responses (Go convention)
-- Java/Kotlin: Spring Security annotations are sufficient auth checks, `@Transactional` provides atomicity, JPA parameterized queries are safe, Kotlin `require()`/`check()` are assertion patterns not vulnerabilities
-- Ruby: Rails `params.permit()` is input validation, `render html:` with `html_safe` on generated content, ActiveRecord parameterized finders are safe, Devise/Warden patterns for auth
-- PHP: PDO prepared statements are safe, Laravel Eloquent is parameterized, `htmlspecialchars()` is XSS mitigation, Symfony security voters are auth checks, `password_hash()`/`password_verify()` are correct bcrypt usage
-- C/C++: `strncpy`/`snprintf` are bounds-checked (vs `strcpy`/`sprintf`), smart pointers manage memory, RAII handles cleanup, `static_assert` is compile-time only, OpenSSL with proper context setup
-- Rust: `sha2`/`blake3` for fingerprinting is not "weak crypto", `unsafe` with documented invariants, `secrecy::SecretString` properly handles secrets
-
-Severity guide:
-- critical: Remote code execution, auth bypass, or data breach with no preconditions
-- high: Exploitable vulnerability requiring minimal preconditions
-- medium: Vulnerability requiring specific conditions or limited impact
-
-Prefer returning [] over reporting speculative vulnerabilities. Every false positive erodes trust in the scanner.
-
-Respond with a JSON array (no markdown fences):
 [{"title": "...", "description": "...", "severity": "critical|high|medium", "file": "...", "line": N, "cwe": "CWE-XXX", "suggestion": "..."}]
 
 If no issues found, respond with: []"#;
 
-pub const CONVENTION_REVIEW_PROMPT: &str = r#"You are a code reviewer checking for convention violations that indicate likely bugs. Report ONLY deviations from the project's visible patterns that could cause real problems.
+pub const CONVENTION_REVIEW_PROMPT: &str = r#"You are a code reviewer checking adherence to project conventions. Focus ONLY on patterns that indicate likely bugs or maintenance problems.
 
-Report:
+Look for:
-- Inconsistent error handling within the same module where the inconsistency could hide failures
+- Inconsistent error handling patterns within the same module
-- Public API that breaks the module's established contract (not just different style)
+- Public API that doesn't follow the project's established patterns
-- Anti-patterns that are bugs in this language: e.g. `unwrap()` in Rust library code where the CI enforces `clippy::unwrap_used`, `any` defeating TypeScript's type system
+- Missing or incorrect type annotations that could cause runtime issues
+- Anti-patterns specific to the language (e.g. unwrap in Rust library code, any in TypeScript)
 
-Do NOT report:
+Do NOT report: minor style preferences, documentation gaps, formatting.
-- Style preferences, formatting, naming conventions, or documentation
+Only report issues with HIGH confidence that they deviate from the visible codebase conventions.
-- Code organization suggestions ("this function should be split")
-- Patterns that are valid in the language even if you'd write them differently
-- "Missing type annotations" unless the code literally won't compile or causes a type inference bug
 
-Language-specific patterns that are conventional (do not flag these):
+For each issue found, respond with a JSON array:
-- Rust: variable shadowing, `||`/`&&` short-circuit, `let` rebinding, builder patterns, `clone()`, `From`/`Into` impl chains, `#[allow(...)]` attributes
-- Python: `**kwargs` forwarding, `@property` setters, `__dunder__` methods, list comprehensions with conditions, `if TYPE_CHECKING` imports, `noqa` comments
-- Go: stuttering names (`http.HTTPClient`) discouraged but not a bug, `context.Context` as first param, init() functions, `//nolint` directives, returning concrete types vs interfaces in internal code
-- Java/Kotlin: builder pattern boilerplate, Lombok annotations (`@Data`, `@Builder`), Kotlin data classes, `companion object` factories, `@Suppress` annotations, checked exception wrapping
-- Ruby: `attr_accessor` usage, `Enumerable` mixin patterns, `module_function`, `class << self` syntax, DSL blocks (Rake, RSpec, Sinatra routes)
-- PHP: `__construct` with property promotion, Laravel facades, static factory methods, nullable types with `?`, attribute syntax `#[...]`
-- C/C++: header guards vs `#pragma once`, forward declarations, `const` correctness patterns, template specialization, `auto` type deduction
-
-Severity guide:
-- medium: Convention violation that will likely cause a bug or maintenance problem
-- low: Convention violation that is a minor concern
-
-Return at most 3 findings. Prefer [] over marginal findings.
-
-Respond with a JSON array (no markdown fences):
 [{"title": "...", "description": "...", "severity": "medium|low", "file": "...", "line": N, "suggestion": "..."}]
 
 If no issues found, respond with: []"#;
 
-pub const COMPLEXITY_REVIEW_PROMPT: &str = r#"You are reviewing code changes for complexity that is likely to cause bugs. Report ONLY complexity that makes the code demonstrably harder to reason about.
+pub const COMPLEXITY_REVIEW_PROMPT: &str = r#"You are reviewing code changes for excessive complexity that could lead to bugs.
 
-Report:
+Look for:
-- Functions over 80 lines with multiple interleaved responsibilities (not just long)
+- Functions over 50 lines that should be decomposed
-- Deeply nested control flow (5+ levels) where flattening would prevent bugs
+- Deeply nested control flow (4+ levels)
-- Complex boolean expressions that a reader would likely misinterpret
+- Complex boolean expressions that are hard to reason about
+- Functions with 5+ parameters
+- Code duplication within the changed files
 
-Do NOT report:
+Only report complexity issues that are HIGH risk for future bugs. Ignore acceptable complexity in configuration, CLI argument parsing, or generated code.
-- Functions that are long but linear and easy to follow
-- Acceptable complexity: configuration setup, CLI parsing, test helpers, builder patterns
-- Code that is complex because the problem is complex — only report if restructuring would reduce bug risk
-- "This function does multiple things" unless you can identify a specific bug risk from the coupling
-- Suggestions that would just move complexity elsewhere without reducing it
 
-Severity guide:
+For each issue found, respond with a JSON array:
-- medium: Complexity that has a concrete risk of causing bugs during future changes
-- low: Complexity that makes review harder but is unlikely to cause bugs
-
-Return at most 2 findings. Prefer [] over reporting complexity that is justified.
-
-Respond with a JSON array (no markdown fences):
 [{"title": "...", "description": "...", "severity": "medium|low", "file": "...", "line": N, "suggestion": "..."}]
 
 If no issues found, respond with: []"#;

compliance-agent/src/llm/triage.rs

@@ -5,49 +5,22 @@ use compliance_core::models::{Finding, FindingStatus};
 use crate::llm::LlmClient;
 use crate::pipeline::orchestrator::GraphContext;
 
-/// Maximum number of findings to include in a single LLM triage call.
+const TRIAGE_SYSTEM_PROMPT: &str = r#"You are a security finding triage expert. Analyze the following security finding with its code context and determine the appropriate action.
-const TRIAGE_CHUNK_SIZE: usize = 30;
-
-const TRIAGE_SYSTEM_PROMPT: &str = r#"You are a pragmatic security triage expert. Your job is to filter out noise and keep only findings that a developer should actually fix. Be aggressive about dismissing false positives — a clean, high-signal list is more valuable than a comprehensive one.
 
 Actions:
-- "confirm": True positive with real impact. Keep severity as-is.
+- "confirm": The finding is a true positive at the reported severity. Keep as-is.
-- "downgrade": Real issue but over-reported severity. Lower it.
+- "downgrade": The finding is real but over-reported. Lower severity recommended.
-- "upgrade": Under-reported — higher severity warranted.
+- "upgrade": The finding is under-reported. Higher severity recommended.
-- "dismiss": False positive, not exploitable, or not actionable. Remove it.
+- "dismiss": The finding is a false positive. Should be removed.
 
-Dismiss when:
+Consider:
-- The scanner flagged a language idiom as a bug (see examples below)
+- Is the code in a test, example, or generated file? (lower confidence for test code)
-- The finding is in test/example/generated/vendored code
+- Does the surrounding code context confirm or refute the finding?
-- The "vulnerability" requires preconditions that don't exist in the code
+- Is the finding actionable by a developer?
-- The finding is about code style, complexity, or theoretical concerns rather than actual bugs
+- Would a real attacker be able to exploit this?
-- A hash function is used for non-security purposes (dedup, caching, content addressing)
-- Internal logging of non-sensitive operational data is flagged as "information disclosure"
-- The finding duplicates another finding already in the list
-- Framework-provided security is already in place (e.g. ORM parameterized queries, CSRF middleware, auth decorators)
 
-Common false positive patterns by language (dismiss these):
+Respond in JSON format:
-- Rust: short-circuit `||`/`&&`, variable shadowing, `clone()`, `unsafe` with safety docs, `sha2` for fingerprinting
+{"action": "confirm|downgrade|upgrade|dismiss", "confidence": 0-10, "rationale": "brief explanation", "remediation": "optional fix suggestion"}"#;
-- Python: EAFP try/except, `subprocess` with hardcoded args, `pickle` on trusted data, Django `mark_safe` on static content
-- Go: `if err != nil` is not "swallowed error", `crypto/rand` is secure, returning errors is not "information disclosure"
-- Java/Kotlin: Spring Security annotations are valid auth, JPA parameterized queries are safe, Kotlin `!!` in tests is fine
-- Ruby: Rails `params.permit` is validation, ActiveRecord finders are parameterized, `html_safe` on generated content
-- PHP: PDO prepared statements are safe, Laravel Eloquent is parameterized, `htmlspecialchars` is XSS mitigation
-- C/C++: `strncpy`/`snprintf` are bounds-checked, smart pointers manage memory, RAII handles cleanup
-
-Confirm only when:
-- You can describe a concrete scenario where the bug manifests or the vulnerability is exploitable
-- The fix is actionable (developer can change specific code to resolve it)
-- The finding is in production code that handles external input or sensitive data
-
-Confidence scoring (0-10):
-- 8-10: Certain true positive with clear exploit/bug scenario
-- 5-7: Likely true positive, some assumptions required
-- 3-4: Uncertain, needs manual review
-- 0-2: Almost certainly a false positive
-
-Respond with a JSON array, one entry per finding in the same order presented (no markdown fences):
-[{"id": "<fingerprint>", "action": "confirm|downgrade|upgrade|dismiss", "confidence": 0-10, "rationale": "1-2 sentences", "remediation": "optional fix"}, ...]"#;
 
 pub async fn triage_findings(
     llm: &Arc<LlmClient>,
@@ -56,76 +29,60 @@ pub async fn triage_findings(
 ) -> usize {
     let mut passed = 0;
 
-    // Process findings in chunks to avoid overflowing the LLM context window.
+    for finding in findings.iter_mut() {
-    for chunk_start in (0..findings.len()).step_by(TRIAGE_CHUNK_SIZE) {
+        let file_classification = classify_file_path(finding.file_path.as_deref());
-        let chunk_end = (chunk_start + TRIAGE_CHUNK_SIZE).min(findings.len());
-        let chunk = &mut findings[chunk_start..chunk_end];
 
-        // Build a combined prompt for the entire chunk.
+        let mut user_prompt = format!(
-        let mut user_prompt = String::new();
+            "Scanner: {}\nRule: {}\nSeverity: {}\nTitle: {}\nDescription: {}\nFile: {}\nLine: {}\nCode: {}\nFile classification: {}",
-        let mut file_classifications: Vec<String> = Vec::new();
+            finding.scanner,
-
+            finding.rule_id.as_deref().unwrap_or("N/A"),
-        for (i, finding) in chunk.iter().enumerate() {
+            finding.severity,
-            let file_classification = classify_file_path(finding.file_path.as_deref());
+            finding.title,
+            finding.description,
+            finding.file_path.as_deref().unwrap_or("N/A"),
+            finding.line_number.map(|n| n.to_string()).unwrap_or_else(|| "N/A".to_string()),
+            finding.code_snippet.as_deref().unwrap_or("N/A"),
+            file_classification,
+        );
 
+        // Enrich with surrounding code context if possible
+        if let Some(context) = read_surrounding_context(finding) {
             user_prompt.push_str(&format!(
-                "\n--- Finding {} (id: {}) ---\nScanner: {}\nRule: {}\nSeverity: {}\nTitle: {}\nDescription: {}\nFile: {}\nLine: {}\nCode: {}\nFile classification: {}",
+                "\n\n--- Surrounding Code (50 lines) ---\n{context}"
-                i + 1,
-                finding.fingerprint,
-                finding.scanner,
-                finding.rule_id.as_deref().unwrap_or("N/A"),
-                finding.severity,
-                finding.title,
-                finding.description,
-                finding.file_path.as_deref().unwrap_or("N/A"),
-                finding.line_number.map(|n| n.to_string()).unwrap_or_else(|| "N/A".to_string()),
-                finding.code_snippet.as_deref().unwrap_or("N/A"),
-                file_classification,
             ));
-
-            // Enrich with surrounding code context if possible
-            if let Some(context) = read_surrounding_context(finding) {
-                user_prompt.push_str(&format!(
-                    "\n\n--- Surrounding Code (50 lines) ---\n{context}"
-                ));
-            }
-
-            // Enrich with graph context if available
-            if let Some(ctx) = graph_context {
-                if let Some(impact) = ctx
-                    .impacts
-                    .iter()
-                    .find(|im| im.finding_id == finding.fingerprint)
-                {
-                    user_prompt.push_str(&format!(
-                        "\n\n--- Code Graph Context ---\n\
-                         Blast radius: {} nodes affected\n\
-                         Entry points affected: {}\n\
-                         Direct callers: {}\n\
-                         Communities affected: {}\n\
-                         Call chains: {}",
-                        impact.blast_radius,
-                        if impact.affected_entry_points.is_empty() {
-                            "none".to_string()
-                        } else {
-                            impact.affected_entry_points.join(", ")
-                        },
-                        if impact.direct_callers.is_empty() {
-                            "none".to_string()
-                        } else {
-                            impact.direct_callers.join(", ")
-                        },
-                        impact.affected_communities.len(),
-                        impact.call_chains.len(),
-                    ));
-                }
-            }
-
-            user_prompt.push('\n');
-            file_classifications.push(file_classification);
         }
 
-        // Send the batch to the LLM.
+        // Enrich with graph context if available
+        if let Some(ctx) = graph_context {
+            if let Some(impact) = ctx
+                .impacts
+                .iter()
+                .find(|i| i.finding_id == finding.fingerprint)
+            {
+                user_prompt.push_str(&format!(
+                    "\n\n--- Code Graph Context ---\n\
+                     Blast radius: {} nodes affected\n\
+                     Entry points affected: {}\n\
+                     Direct callers: {}\n\
+                     Communities affected: {}\n\
+                     Call chains: {}",
+                    impact.blast_radius,
+                    if impact.affected_entry_points.is_empty() {
+                        "none".to_string()
+                    } else {
+                        impact.affected_entry_points.join(", ")
+                    },
+                    if impact.direct_callers.is_empty() {
+                        "none".to_string()
+                    } else {
+                        impact.direct_callers.join(", ")
+                    },
+                    impact.affected_communities.len(),
+                    impact.call_chains.len(),
+                ));
+            }
+        }
+
         match llm
             .chat(TRIAGE_SYSTEM_PROMPT, &user_prompt, Some(0.1))
             .await
@@ -141,77 +98,58 @@ pub async fn triage_findings(
                 } else {
                     cleaned
                 };
+                if let Ok(result) = serde_json::from_str::<TriageResult>(cleaned) {
+                    // Apply file-path confidence adjustment
+                    let adjusted_confidence =
+                        adjust_confidence(result.confidence, &file_classification);
+                    finding.confidence = Some(adjusted_confidence);
+                    finding.triage_action = Some(result.action.clone());
+                    finding.triage_rationale = Some(result.rationale);
 
-                match serde_json::from_str::<Vec<TriageResult>>(cleaned) {
+                    if let Some(remediation) = result.remediation {
-                    Ok(results) => {
+                        finding.remediation = Some(remediation);
-                        for (idx, finding) in chunk.iter_mut().enumerate() {
-                            // Match result by position; fall back to keeping the finding.
-                            let Some(result) = results.get(idx) else {
-                                finding.status = FindingStatus::Triaged;
-                                passed += 1;
-                                continue;
-                            };
-
-                            let file_classification = file_classifications
-                                .get(idx)
-                                .map(|s| s.as_str())
-                                .unwrap_or("unknown");
-
-                            let adjusted_confidence =
-                                adjust_confidence(result.confidence, file_classification);
-                            finding.confidence = Some(adjusted_confidence);
-                            finding.triage_action = Some(result.action.clone());
-                            finding.triage_rationale = Some(result.rationale.clone());
-
-                            if let Some(ref remediation) = result.remediation {
-                                finding.remediation = Some(remediation.clone());
-                            }
-
-                            match result.action.as_str() {
-                                "dismiss" => {
-                                    finding.status = FindingStatus::FalsePositive;
-                                }
-                                "downgrade" => {
-                                    finding.severity = downgrade_severity(&finding.severity);
-                                    finding.status = FindingStatus::Triaged;
-                                    passed += 1;
-                                }
-                                "upgrade" => {
-                                    finding.severity = upgrade_severity(&finding.severity);
-                                    finding.status = FindingStatus::Triaged;
-                                    passed += 1;
-                                }
-                                _ => {
-                                    // "confirm" or unknown — keep as-is
-                                    if adjusted_confidence >= 3.0 {
-                                        finding.status = FindingStatus::Triaged;
-                                        passed += 1;
-                                    } else {
-                                        finding.status = FindingStatus::FalsePositive;
-                                    }
-                                }
-                            }
-                        }
                     }
-                    Err(_) => {
+
-                        // Batch parse failure — keep all findings in the chunk.
+                    match result.action.as_str() {
-                        tracing::warn!(
+                        "dismiss" => {
-                            "Failed to parse batch triage response for chunk starting at {chunk_start}: {cleaned}"
+                            finding.status = FindingStatus::FalsePositive;
-                        );
+                        }
-                        for finding in chunk.iter_mut() {
+                        "downgrade" => {
+                            // Downgrade severity by one level
+                            finding.severity = downgrade_severity(&finding.severity);
                             finding.status = FindingStatus::Triaged;
                             passed += 1;
                         }
+                        "upgrade" => {
+                            finding.severity = upgrade_severity(&finding.severity);
+                            finding.status = FindingStatus::Triaged;
+                            passed += 1;
+                        }
+                        _ => {
+                            // "confirm" or unknown — keep as-is
+                            if adjusted_confidence >= 3.0 {
+                                finding.status = FindingStatus::Triaged;
+                                passed += 1;
+                            } else {
+                                finding.status = FindingStatus::FalsePositive;
+                            }
+                        }
                     }
+                } else {
+                    // Parse failure — keep the finding
+                    finding.status = FindingStatus::Triaged;
+                    passed += 1;
+                    tracing::warn!(
+                        "Failed to parse triage response for {}: {response}",
+                        finding.fingerprint
+                    );
                 }
             }
             Err(e) => {
-                // On LLM error, keep all findings in the chunk.
+                // On LLM error, keep the finding
-                tracing::warn!("LLM batch triage failed for chunk starting at {chunk_start}: {e}");
+                tracing::warn!("LLM triage failed for {}: {e}", finding.fingerprint);
-                for finding in chunk.iter_mut() {
+                finding.status = FindingStatus::Triaged;
-                    finding.status = FindingStatus::Triaged;
+                passed += 1;
-                    passed += 1;
-                }
             }
         }
     }
@@ -328,10 +266,6 @@ fn upgrade_severity(
 
 #[derive(serde::Deserialize)]
 struct TriageResult {
-    /// Finding fingerprint echoed back by the LLM (optional).
-    #[serde(default)]
-    #[allow(dead_code)]
-    id: String,
     #[serde(default = "default_action")]
     action: String,
     #[serde(default)]
@@ -344,220 +278,3 @@ struct TriageResult {
 fn default_action() -> String {
     "confirm".to_string()
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Severity;
-
-    // ── classify_file_path ───────────────────────────────────────
-
-    #[test]
-    fn classify_none_path() {
-        assert_eq!(classify_file_path(None), "unknown");
-    }
-
-    #[test]
-    fn classify_production_path() {
-        assert_eq!(classify_file_path(Some("src/main.rs")), "production");
-        assert_eq!(classify_file_path(Some("lib/core/engine.py")), "production");
-    }
-
-    #[test]
-    fn classify_test_paths() {
-        assert_eq!(classify_file_path(Some("src/test/helper.rs")), "test");
-        assert_eq!(classify_file_path(Some("src/tests/unit.rs")), "test");
-        assert_eq!(classify_file_path(Some("foo_test.go")), "test");
-        assert_eq!(classify_file_path(Some("bar.test.js")), "test");
-        assert_eq!(classify_file_path(Some("baz.spec.ts")), "test");
-        assert_eq!(
-            classify_file_path(Some("data/fixtures/sample.json")),
-            "test"
-        );
-        assert_eq!(classify_file_path(Some("src/testdata/input.txt")), "test");
-    }
-
-    #[test]
-    fn classify_example_paths() {
-        assert_eq!(
-            classify_file_path(Some("docs/examples/basic.rs")),
-            "example"
-        );
-        // /example matches because contains("/example")
-        assert_eq!(classify_file_path(Some("src/example/main.py")), "example");
-        assert_eq!(classify_file_path(Some("src/demo/run.sh")), "example");
-        assert_eq!(classify_file_path(Some("src/sample/lib.rs")), "example");
-    }
-
-    #[test]
-    fn classify_generated_paths() {
-        assert_eq!(
-            classify_file_path(Some("src/generated/api.rs")),
-            "generated"
-        );
-        assert_eq!(
-            classify_file_path(Some("proto/gen/service.go")),
-            "generated"
-        );
-        assert_eq!(classify_file_path(Some("api.generated.ts")), "generated");
-        assert_eq!(classify_file_path(Some("service.pb.go")), "generated");
-        assert_eq!(classify_file_path(Some("model_generated.rs")), "generated");
-    }
-
-    #[test]
-    fn classify_vendored_paths() {
-        // Implementation checks for /vendor/, /node_modules/, /third_party/ (with slashes)
-        assert_eq!(
-            classify_file_path(Some("src/vendor/lib/foo.go")),
-            "vendored"
-        );
-        assert_eq!(
-            classify_file_path(Some("src/node_modules/pkg/index.js")),
-            "vendored"
-        );
-        assert_eq!(
-            classify_file_path(Some("src/third_party/lib.c")),
-            "vendored"
-        );
-    }
-
-    #[test]
-    fn classify_is_case_insensitive() {
-        assert_eq!(classify_file_path(Some("src/TEST/Helper.rs")), "test");
-        assert_eq!(classify_file_path(Some("src/VENDOR/lib.go")), "vendored");
-        assert_eq!(
-            classify_file_path(Some("src/GENERATED/foo.ts")),
-            "generated"
-        );
-    }
-
-    // ── adjust_confidence ────────────────────────────────────────
-
-    #[test]
-    fn adjust_confidence_production() {
-        assert_eq!(adjust_confidence(8.0, "production"), 8.0);
-    }
-
-    #[test]
-    fn adjust_confidence_test() {
-        assert_eq!(adjust_confidence(10.0, "test"), 5.0);
-    }
-
-    #[test]
-    fn adjust_confidence_example() {
-        assert_eq!(adjust_confidence(10.0, "example"), 6.0);
-    }
-
-    #[test]
-    fn adjust_confidence_generated() {
-        assert_eq!(adjust_confidence(10.0, "generated"), 3.0);
-    }
-
-    #[test]
-    fn adjust_confidence_vendored() {
-        assert_eq!(adjust_confidence(10.0, "vendored"), 4.0);
-    }
-
-    #[test]
-    fn adjust_confidence_unknown_classification() {
-        assert_eq!(adjust_confidence(7.0, "unknown"), 7.0);
-        assert_eq!(adjust_confidence(7.0, "something_else"), 7.0);
-    }
-
-    #[test]
-    fn adjust_confidence_zero() {
-        assert_eq!(adjust_confidence(0.0, "test"), 0.0);
-        assert_eq!(adjust_confidence(0.0, "production"), 0.0);
-    }
-
-    // ── downgrade_severity ───────────────────────────────────────
-
-    #[test]
-    fn downgrade_severity_all_levels() {
-        assert_eq!(downgrade_severity(&Severity::Critical), Severity::High);
-        assert_eq!(downgrade_severity(&Severity::High), Severity::Medium);
-        assert_eq!(downgrade_severity(&Severity::Medium), Severity::Low);
-        assert_eq!(downgrade_severity(&Severity::Low), Severity::Info);
-        assert_eq!(downgrade_severity(&Severity::Info), Severity::Info);
-    }
-
-    #[test]
-    fn downgrade_severity_info_is_floor() {
-        // Downgrading Info twice should still be Info
-        let s = downgrade_severity(&Severity::Info);
-        assert_eq!(downgrade_severity(&s), Severity::Info);
-    }
-
-    // ── upgrade_severity ─────────────────────────────────────────
-
-    #[test]
-    fn upgrade_severity_all_levels() {
-        assert_eq!(upgrade_severity(&Severity::Info), Severity::Low);
-        assert_eq!(upgrade_severity(&Severity::Low), Severity::Medium);
-        assert_eq!(upgrade_severity(&Severity::Medium), Severity::High);
-        assert_eq!(upgrade_severity(&Severity::High), Severity::Critical);
-        assert_eq!(upgrade_severity(&Severity::Critical), Severity::Critical);
-    }
-
-    #[test]
-    fn upgrade_severity_critical_is_ceiling() {
-        let s = upgrade_severity(&Severity::Critical);
-        assert_eq!(upgrade_severity(&s), Severity::Critical);
-    }
-
-    // ── upgrade/downgrade roundtrip ──────────────────────────────
-
-    #[test]
-    fn upgrade_then_downgrade_is_identity_for_middle_values() {
-        for sev in [Severity::Low, Severity::Medium, Severity::High] {
-            assert_eq!(downgrade_severity(&upgrade_severity(&sev)), sev);
-        }
-    }
-
-    // ── TriageResult deserialization ─────────────────────────────
-
-    #[test]
-    fn triage_result_full() {
-        let json = r#"{"action":"dismiss","confidence":8.5,"rationale":"false positive","remediation":"remove code"}"#;
-        let r: TriageResult = serde_json::from_str(json).unwrap();
-        assert_eq!(r.action, "dismiss");
-        assert_eq!(r.confidence, 8.5);
-        assert_eq!(r.rationale, "false positive");
-        assert_eq!(r.remediation.as_deref(), Some("remove code"));
-    }
-
-    #[test]
-    fn triage_result_defaults() {
-        let json = r#"{}"#;
-        let r: TriageResult = serde_json::from_str(json).unwrap();
-        assert_eq!(r.action, "confirm");
-        assert_eq!(r.confidence, 0.0);
-        assert_eq!(r.rationale, "");
-        assert!(r.remediation.is_none());
-    }
-
-    #[test]
-    fn triage_result_partial() {
-        let json = r#"{"action":"downgrade","confidence":6.0}"#;
-        let r: TriageResult = serde_json::from_str(json).unwrap();
-        assert_eq!(r.action, "downgrade");
-        assert_eq!(r.confidence, 6.0);
-        assert_eq!(r.rationale, "");
-        assert!(r.remediation.is_none());
-    }
-
-    #[test]
-    fn triage_result_with_markdown_fences() {
-        // Simulate LLM wrapping response in markdown code fences
-        let raw = "```json\n{\"action\":\"upgrade\",\"confidence\":9,\"rationale\":\"critical\",\"remediation\":null}\n```";
-        let cleaned = raw
-            .trim()
-            .trim_start_matches("```json")
-            .trim_start_matches("```")
-            .trim_end_matches("```")
-            .trim();
-        let r: TriageResult = serde_json::from_str(cleaned).unwrap();
-        assert_eq!(r.action, "upgrade");
-        assert_eq!(r.confidence, 9.0);
-    }
-}

compliance-agent/src/llm/types.rs

@@ -1,369 +0,0 @@
-use serde::{Deserialize, Serialize};
-
-// ── Request types ──────────────────────────────────────────────
-
-#[derive(Serialize, Clone, Debug)]
-pub struct ChatMessage {
-    pub role: String,
-    pub content: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_calls: Option<Vec<ToolCallRequest>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub tool_call_id: Option<String>,
-}
-
-#[derive(Serialize)]
-pub(crate) struct ChatCompletionRequest {
-    pub(crate) model: String,
-    pub(crate) messages: Vec<ChatMessage>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) temperature: Option<f64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) max_tokens: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub(crate) tools: Option<Vec<ToolDefinitionPayload>>,
-}
-
-#[derive(Serialize)]
-pub(crate) struct ToolDefinitionPayload {
-    pub(crate) r#type: String,
-    pub(crate) function: ToolFunctionPayload,
-}
-
-#[derive(Serialize)]
-pub(crate) struct ToolFunctionPayload {
-    pub(crate) name: String,
-    pub(crate) description: String,
-    pub(crate) parameters: serde_json::Value,
-}
-
-// ── Response types ─────────────────────────────────────────────
-
-#[derive(Deserialize)]
-pub(crate) struct ChatCompletionResponse {
-    pub(crate) choices: Vec<ChatChoice>,
-}
-
-#[derive(Deserialize)]
-pub(crate) struct ChatChoice {
-    pub(crate) message: ChatResponseMessage,
-}
-
-#[derive(Deserialize)]
-pub(crate) struct ChatResponseMessage {
-    #[serde(default)]
-    pub(crate) content: Option<String>,
-    #[serde(default)]
-    pub(crate) tool_calls: Option<Vec<ToolCallResponse>>,
-}
-
-#[derive(Deserialize)]
-pub(crate) struct ToolCallResponse {
-    pub(crate) id: String,
-    pub(crate) function: ToolCallFunction,
-}
-
-#[derive(Deserialize)]
-pub(crate) struct ToolCallFunction {
-    pub(crate) name: String,
-    pub(crate) arguments: String,
-}
-
-// ── Public types for tool calling ──────────────────────────────
-
-/// Definition of a tool that the LLM can invoke
-#[derive(Debug, Clone, Serialize)]
-pub struct ToolDefinition {
-    pub name: String,
-    pub description: String,
-    pub parameters: serde_json::Value,
-}
-
-/// A tool call request from the LLM
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct LlmToolCall {
-    pub id: String,
-    pub name: String,
-    pub arguments: serde_json::Value,
-}
-
-/// A tool call in the request message format (for sending back tool_calls in assistant messages)
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ToolCallRequest {
-    pub id: String,
-    pub r#type: String,
-    pub function: ToolCallRequestFunction,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ToolCallRequestFunction {
-    pub name: String,
-    pub arguments: String,
-}
-
-/// Response from the LLM — either content or tool calls
-#[derive(Debug, Clone)]
-pub enum LlmResponse {
-    Content(String),
-    /// Tool calls with optional reasoning text from the LLM
-    ToolCalls {
-        calls: Vec<LlmToolCall>,
-        reasoning: String,
-    },
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    // ── ChatMessage ──────────────────────────────────────────────
-
-    #[test]
-    fn chat_message_serializes_minimal() {
-        let msg = ChatMessage {
-            role: "user".to_string(),
-            content: Some("hello".to_string()),
-            tool_calls: None,
-            tool_call_id: None,
-        };
-        let v = serde_json::to_value(&msg).unwrap();
-        assert_eq!(v["role"], "user");
-        assert_eq!(v["content"], "hello");
-        // None fields with skip_serializing_if should be absent
-        assert!(v.get("tool_calls").is_none());
-        assert!(v.get("tool_call_id").is_none());
-    }
-
-    #[test]
-    fn chat_message_serializes_with_tool_calls() {
-        let msg = ChatMessage {
-            role: "assistant".to_string(),
-            content: None,
-            tool_calls: Some(vec![ToolCallRequest {
-                id: "call_1".to_string(),
-                r#type: "function".to_string(),
-                function: ToolCallRequestFunction {
-                    name: "get_weather".to_string(),
-                    arguments: r#"{"city":"NYC"}"#.to_string(),
-                },
-            }]),
-            tool_call_id: None,
-        };
-        let v = serde_json::to_value(&msg).unwrap();
-        assert!(v["tool_calls"].is_array());
-        assert_eq!(v["tool_calls"][0]["function"]["name"], "get_weather");
-    }
-
-    #[test]
-    fn chat_message_content_null_when_none() {
-        let msg = ChatMessage {
-            role: "assistant".to_string(),
-            content: None,
-            tool_calls: None,
-            tool_call_id: None,
-        };
-        let v = serde_json::to_value(&msg).unwrap();
-        assert!(v["content"].is_null());
-    }
-
-    // ── ToolDefinition ───────────────────────────────────────────
-
-    #[test]
-    fn tool_definition_serializes() {
-        let td = ToolDefinition {
-            name: "search".to_string(),
-            description: "Search the web".to_string(),
-            parameters: json!({"type": "object", "properties": {"q": {"type": "string"}}}),
-        };
-        let v = serde_json::to_value(&td).unwrap();
-        assert_eq!(v["name"], "search");
-        assert_eq!(v["parameters"]["type"], "object");
-    }
-
-    #[test]
-    fn tool_definition_empty_parameters() {
-        let td = ToolDefinition {
-            name: "noop".to_string(),
-            description: "".to_string(),
-            parameters: json!({}),
-        };
-        let v = serde_json::to_value(&td).unwrap();
-        assert_eq!(v["parameters"], json!({}));
-    }
-
-    // ── LlmToolCall ──────────────────────────────────────────────
-
-    #[test]
-    fn llm_tool_call_roundtrip() {
-        let call = LlmToolCall {
-            id: "tc_42".to_string(),
-            name: "run_scan".to_string(),
-            arguments: json!({"path": "/tmp", "verbose": true}),
-        };
-        let serialized = serde_json::to_string(&call).unwrap();
-        let deserialized: LlmToolCall = serde_json::from_str(&serialized).unwrap();
-        assert_eq!(deserialized.id, "tc_42");
-        assert_eq!(deserialized.name, "run_scan");
-        assert_eq!(deserialized.arguments["path"], "/tmp");
-        assert_eq!(deserialized.arguments["verbose"], true);
-    }
-
-    #[test]
-    fn llm_tool_call_empty_arguments() {
-        let call = LlmToolCall {
-            id: "tc_0".to_string(),
-            name: "noop".to_string(),
-            arguments: json!({}),
-        };
-        let rt: LlmToolCall = serde_json::from_str(&serde_json::to_string(&call).unwrap()).unwrap();
-        assert!(rt.arguments.as_object().unwrap().is_empty());
-    }
-
-    // ── ToolCallRequest / ToolCallRequestFunction ────────────────
-
-    #[test]
-    fn tool_call_request_roundtrip() {
-        let req = ToolCallRequest {
-            id: "call_abc".to_string(),
-            r#type: "function".to_string(),
-            function: ToolCallRequestFunction {
-                name: "my_func".to_string(),
-                arguments: r#"{"x":1}"#.to_string(),
-            },
-        };
-        let json_str = serde_json::to_string(&req).unwrap();
-        let back: ToolCallRequest = serde_json::from_str(&json_str).unwrap();
-        assert_eq!(back.id, "call_abc");
-        assert_eq!(back.r#type, "function");
-        assert_eq!(back.function.name, "my_func");
-        assert_eq!(back.function.arguments, r#"{"x":1}"#);
-    }
-
-    #[test]
-    fn tool_call_request_type_field_serializes_as_type() {
-        let req = ToolCallRequest {
-            id: "id".to_string(),
-            r#type: "function".to_string(),
-            function: ToolCallRequestFunction {
-                name: "f".to_string(),
-                arguments: "{}".to_string(),
-            },
-        };
-        let v = serde_json::to_value(&req).unwrap();
-        // The field should be "type" in JSON, not "r#type"
-        assert!(v.get("type").is_some());
-        assert!(v.get("r#type").is_none());
-    }
-
-    // ── ChatCompletionRequest ────────────────────────────────────
-
-    #[test]
-    fn chat_completion_request_skips_none_fields() {
-        let req = ChatCompletionRequest {
-            model: "gpt-4".to_string(),
-            messages: vec![],
-            temperature: None,
-            max_tokens: None,
-            tools: None,
-        };
-        let v = serde_json::to_value(&req).unwrap();
-        assert_eq!(v["model"], "gpt-4");
-        assert!(v.get("temperature").is_none());
-        assert!(v.get("max_tokens").is_none());
-        assert!(v.get("tools").is_none());
-    }
-
-    #[test]
-    fn chat_completion_request_includes_set_fields() {
-        let req = ChatCompletionRequest {
-            model: "gpt-4".to_string(),
-            messages: vec![],
-            temperature: Some(0.7),
-            max_tokens: Some(1024),
-            tools: Some(vec![]),
-        };
-        let v = serde_json::to_value(&req).unwrap();
-        assert_eq!(v["temperature"], 0.7);
-        assert_eq!(v["max_tokens"], 1024);
-        assert!(v["tools"].is_array());
-    }
-
-    // ── ChatCompletionResponse deserialization ───────────────────
-
-    #[test]
-    fn chat_completion_response_deserializes_content() {
-        let json_str = r#"{"choices":[{"message":{"content":"Hello!"}}]}"#;
-        let resp: ChatCompletionResponse = serde_json::from_str(json_str).unwrap();
-        assert_eq!(resp.choices.len(), 1);
-        assert_eq!(resp.choices[0].message.content.as_deref(), Some("Hello!"));
-        assert!(resp.choices[0].message.tool_calls.is_none());
-    }
-
-    #[test]
-    fn chat_completion_response_deserializes_tool_calls() {
-        let json_str = r#"{
-            "choices": [{
-                "message": {
-                    "tool_calls": [{
-                        "id": "call_1",
-                        "function": {"name": "search", "arguments": "{\"q\":\"rust\"}"}
-                    }]
-                }
-            }]
-        }"#;
-        let resp: ChatCompletionResponse = serde_json::from_str(json_str).unwrap();
-        let tc = resp.choices[0].message.tool_calls.as_ref().unwrap();
-        assert_eq!(tc.len(), 1);
-        assert_eq!(tc[0].id, "call_1");
-        assert_eq!(tc[0].function.name, "search");
-    }
-
-    #[test]
-    fn chat_completion_response_defaults_missing_fields() {
-        // content and tool_calls are both missing — should default to None
-        let json_str = r#"{"choices":[{"message":{}}]}"#;
-        let resp: ChatCompletionResponse = serde_json::from_str(json_str).unwrap();
-        assert!(resp.choices[0].message.content.is_none());
-        assert!(resp.choices[0].message.tool_calls.is_none());
-    }
-
-    // ── LlmResponse ─────────────────────────────────────────────
-
-    #[test]
-    fn llm_response_content_variant() {
-        let resp = LlmResponse::Content("answer".to_string());
-        match resp {
-            LlmResponse::Content(s) => assert_eq!(s, "answer"),
-            _ => panic!("expected Content variant"),
-        }
-    }
-
-    #[test]
-    fn llm_response_tool_calls_variant() {
-        let resp = LlmResponse::ToolCalls {
-            calls: vec![LlmToolCall {
-                id: "1".to_string(),
-                name: "f".to_string(),
-                arguments: json!({}),
-            }],
-            reasoning: "because".to_string(),
-        };
-        match resp {
-            LlmResponse::ToolCalls { calls, reasoning } => {
-                assert_eq!(calls.len(), 1);
-                assert_eq!(reasoning, "because");
-            }
-            _ => panic!("expected ToolCalls variant"),
-        }
-    }
-
-    #[test]
-    fn llm_response_empty_content() {
-        let resp = LlmResponse::Content(String::new());
-        match resp {
-            LlmResponse::Content(s) => assert!(s.is_empty()),
-            _ => panic!("expected Content variant"),
-        }
-    }
-}

compliance-agent/src/main.rs

@@ -1,67 +1,25 @@
-use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
+mod agent;
-
+mod api;
-/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
+mod config;
-/// unified `onboarded_targets` collection per tenant.
+mod database;
-///
+mod error;
-/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
+mod llm;
-async fn run_migration(
+mod pentest;
-    args: &[String],
+mod pipeline;
-    pool: &database::DatabasePool,
+mod rag;
-) -> Result<(), compliance_agent::error::AgentError> {
+mod scheduler;
-    if args.get(2).map(String::as_str) != Some("onboarding") {
+mod ssh;
-        eprintln!(
+#[allow(dead_code)]
-            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
+mod trackers;
-        );
+mod webhooks;
-        std::process::exit(2);
-    }
-    let has = |flag: &str| args.iter().any(|a| a == flag);
-    let dry_run = has("--dry-run");
-    let revert = has("--revert");
-    let tenant = args
-        .iter()
-        .position(|a| a == "--tenant")
-        .and_then(|i| args.get(i + 1))
-        .cloned();
-
-    let tenants: Vec<String> = if has("--all") {
-        pool.list_tenant_ids().await?
-    } else if let Some(t) = tenant {
-        vec![t]
-    } else {
-        eprintln!("specify --all or --tenant <id>");
-        std::process::exit(2);
-    };
-
-    for tenant_id in tenants {
-        let db = pool.for_tenant_id(&tenant_id).await?;
-        if revert {
-            migrate::onboarding::revert(&db).await?;
-            println!("[{tenant_id}] reverted onboarding backfill");
-        } else {
-            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
-            let prefix = if dry_run { "(dry-run) " } else { "" };
-            println!("[{tenant_id}] {prefix}{report:?}");
-        }
-    }
-    Ok(())
-}
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
-    match dotenvy::dotenv() {
+    dotenvy::dotenv().ok();
-        Ok(path) => eprintln!("[dotenv] Loaded from: {}", path.display()),
-        Err(_) => eprintln!("[dotenv] No .env file found, using environment variables"),
-    }
 
     let _telemetry_guard = compliance_core::telemetry::init_telemetry("compliance-agent");
 
-    // Log critical env vars at startup
+    tracing::info!("Loading configuration...");
-    tracing::info!(
-        chrome_ws_url = std::env::var("CHROME_WS_URL").ok().as_deref(),
-        pentest_email = std::env::var("PENTEST_VERIFICATION_EMAIL").ok().as_deref(),
-        encryption_key_set = std::env::var("PENTEST_ENCRYPTION_KEY").is_ok(),
-        "Loading configuration..."
-    );
     let config = config::load_config()?;
 
     // Ensure SSH key pair exists for cloning private repos
@@ -71,20 +29,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     }
 
     tracing::info!("Connecting to MongoDB...");
-    // Per-tenant pool only — the agent has no shared "default" database
+    let db = database::Database::connect(&config.mongodb_uri, &config.mongodb_database).await?;
-    // after M7.2-D. `mongodb_database` is now the db-name prefix used
+    db.ensure_indexes().await?;
-    // for tenant databases (`<prefix>_<tenant_id>`).
-    let db_pool =
-        database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
-    // One-shot subcommands run and exit without starting the servers.
+    let agent = agent::ComplianceAgent::new(config.clone(), db.clone());
-    let args: Vec<String> = std::env::args().collect();
-    if args.get(1).map(String::as_str) == Some("migrate") {
-        run_migration(&args, &db_pool).await?;
-        return Ok(());
-    }
-
-    let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
 
     tracing::info!("Starting scheduler...");
     let scheduler_agent = agent.clone();

compliance-agent/src/migrate/mod.rs

@@ -1,8 +0,0 @@
-//! One-time data migrations.
-//!
-//! Currently just the onboarding backfill ([`onboarding`]), which folds the
-//! legacy `repositories` and `dast_targets` collections into the unified
-//! `onboarded_targets` collection, preserving `_id` so every downstream record
-//! keyed by `repo_id` / `target_id` keeps resolving.
-
-pub mod onboarding;

compliance-agent/src/migrate/onboarding.rs

@@ -1,406 +0,0 @@
-//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
-//!
-//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
-//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
-//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
-//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
-//! existing webhook URLs keep working. The mapping functions are pure and unit
-//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
-//! thin driver over them.
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
-    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
-};
-use futures_util::TryStreamExt;
-use mongodb::bson::{doc, Document};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// Marker id in `schema_migrations` recording that the backfill has run.
-const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
-
-/// Summary of a backfill run.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct MigrationReport {
-    /// Repositories turned into onboarded targets.
-    pub repos_migrated: u64,
-    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
-    pub dast_targets_folded: u64,
-    /// DAST targets with no repo link, migrated as standalone targets.
-    pub dast_targets_standalone: u64,
-    /// Records skipped because a target with that `_id` already existed.
-    pub skipped_existing: u64,
-}
-
-/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
-/// are backend services; a browser app is a web app.
-fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
-    match kind {
-        DastTargetType::WebApp => TargetType::WebApp,
-        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
-    }
-}
-
-/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
-/// auth). Shared by fold-in and standalone migration.
-pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
-    let mut artifact = Artifact::live_url(dast.base_url.clone());
-    artifact.web = Some(WebArtifactConfig {
-        target_kind: dast.target_type.clone(),
-        excluded_paths: dast.excluded_paths.clone(),
-        max_crawl_depth: dast.max_crawl_depth,
-        rate_limit: dast.rate_limit,
-        allow_destructive: dast.allow_destructive,
-    });
-    artifact.auth = dast.auth_config.clone().map(Into::into);
-    artifact
-}
-
-/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
-/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
-/// and auth; tracker config folds into `scan_config`.
-///
-/// `target_type` is a safe default (`BackendService`) — the classifier can
-/// refine it later; `classification` is left `None` (unconfirmed).
-pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
-    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
-    target.id = repo.id;
-
-    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
-    artifact.git = Some(GitArtifactConfig {
-        default_branch: repo.default_branch.clone(),
-        last_scanned_commit: repo.last_scanned_commit.clone(),
-        local_path: repo.local_path.clone(),
-    });
-    if repo.auth_token.is_some() || repo.auth_username.is_some() {
-        artifact.auth = Some(compliance_core::models::ArtifactAuth {
-            method: "token".to_string(),
-            username: repo.auth_username.clone(),
-            secret: repo.auth_token.clone(),
-            ..Default::default()
-        });
-    }
-    target.artifacts.push(artifact);
-
-    if repo.tracker_type.is_some() {
-        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
-            tracker_type: repo.tracker_type.clone(),
-            owner: repo.tracker_owner.clone(),
-            repo: repo.tracker_repo.clone(),
-            token: repo.tracker_token.clone(),
-        });
-    }
-
-    target.scan_schedule = repo.scan_schedule.clone();
-    target.webhook_enabled = repo.webhook_enabled;
-    target.webhook_secret = repo.webhook_secret.clone();
-    target.findings_count = repo.findings_count;
-    target.created_at = repo.created_at;
-    target.updated_at = repo.updated_at;
-    target
-}
-
-/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
-/// target. If the repo default was `BackendService` but the DAST target is a
-/// browser web app, promote the type to `WebApp`.
-pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
-    if matches!(dast.target_type, DastTargetType::WebApp)
-        && target.target_type == TargetType::BackendService
-    {
-        target.target_type = TargetType::WebApp;
-    }
-    if !target.has(ArtifactKind::LiveUrl) {
-        target.artifacts.push(dast_to_artifact(dast));
-    }
-}
-
-/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
-pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
-    let mut target =
-        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
-    target.id = dast.id;
-    target.artifacts.push(dast_to_artifact(dast));
-    target.created_at = dast.created_at;
-    target.updated_at = dast.updated_at;
-    target
-}
-
-/// Whether the onboarding backfill has already been applied to this database.
-pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
-    let found = db
-        .collection_named::<Document>("schema_migrations")
-        .find_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(found.is_some())
-}
-
-/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
-/// tenant database.
-///
-/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
-/// skipped, so re-running is safe. With `dry_run`, computes the report without
-/// writing. The legacy collections are never deleted; the only mutation outside
-/// `onboarded_targets` is the history relink of folded DAST targets, which is
-/// logged so [`revert`] can undo it.
-pub async fn backfill_onboarded_targets(
-    db: &Database,
-    dry_run: bool,
-) -> Result<MigrationReport, AgentError> {
-    let mut report = MigrationReport::default();
-
-    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
-    let mut repos = db.repositories().find(doc! {}).await?;
-    while let Some(repo) = repos.try_next().await? {
-        let Some(id) = repo.id else { continue };
-        if db
-            .onboarded_targets()
-            .find_one(doc! { "_id": id })
-            .await?
-            .is_some()
-        {
-            report.skipped_existing += 1;
-            continue;
-        }
-        if !dry_run {
-            db.onboarded_targets()
-                .insert_one(repo_to_target(&repo))
-                .await?;
-        }
-        report.repos_migrated += 1;
-    }
-
-    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
-    let mut dasts = db.dast_targets().find(doc! {}).await?;
-    while let Some(dast) = dasts.try_next().await? {
-        let Some(dast_id) = dast.id else { continue };
-        let repo_oid = dast
-            .repo_id
-            .as_deref()
-            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
-        let linked = match repo_oid {
-            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
-            None => None,
-        };
-
-        match (linked, repo_oid) {
-            // Fold into an existing repo-derived target.
-            (Some(mut target), Some(oid)) => {
-                if target.has(ArtifactKind::LiveUrl) {
-                    report.skipped_existing += 1; // already folded on a prior run
-                    continue;
-                }
-                fold_dast_into_target(&mut target, &dast);
-                if !dry_run {
-                    db.onboarded_targets()
-                        .replace_one(doc! { "_id": oid }, &target)
-                        .await?;
-                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
-                }
-                report.dast_targets_folded += 1;
-            }
-            // No linked repo target: migrate as a standalone target (keeps _id).
-            _ => {
-                if db
-                    .onboarded_targets()
-                    .find_one(doc! { "_id": dast_id })
-                    .await?
-                    .is_some()
-                {
-                    report.skipped_existing += 1;
-                    continue;
-                }
-                if !dry_run {
-                    db.onboarded_targets()
-                        .insert_one(dast_to_standalone_target(&dast))
-                        .await?;
-                }
-                report.dast_targets_standalone += 1;
-            }
-        }
-    }
-
-    if !dry_run {
-        db.collection_named::<Document>("schema_migrations")
-            .update_one(
-                doc! { "_id": MIGRATION_MARKER },
-                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
-            )
-            .upsert(true)
-            .await?;
-    }
-    Ok(report)
-}
-
-/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
-/// unified target id, logging each move so [`revert`] can undo it.
-///
-/// Note: if multiple DAST targets fold into the same repo target, revert
-/// restores only the last-logged mapping — a rare edge. The source collections
-/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
-async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
-    db.dast_scan_runs()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.pentest_sessions()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.collection_named::<Document>("onboarding_migration_log")
-        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
-        .await?;
-    Ok(())
-}
-
-/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
-/// and the log, and clear the marker. The legacy collections are untouched, so
-/// this restores the pre-migration state.
-pub async fn revert(db: &Database) -> Result<(), AgentError> {
-    let log = db.collection_named::<Document>("onboarding_migration_log");
-    let mut cursor = log.find(doc! {}).await?;
-    while let Some(entry) = cursor.try_next().await? {
-        if let (Ok(old), Ok(new)) = (
-            entry.get_str("old_target_id"),
-            entry.get_str("new_target_id"),
-        ) {
-            db.dast_scan_runs()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-            db.pentest_sessions()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-        }
-    }
-    db.onboarded_targets().drop().await?;
-    log.drop().await?;
-    db.collection_named::<Document>("schema_migrations")
-        .delete_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{DastAuthConfig, TrackerType};
-
-    fn repo() -> TrackedRepository {
-        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
-        r.id = Some(mongodb::bson::oid::ObjectId::new());
-        r.default_branch = "develop".to_string();
-        r.last_scanned_commit = Some("abc123".to_string());
-        r.auth_token = Some("pat".to_string());
-        r.auth_username = Some("bob".to_string());
-        r.tracker_type = Some(TrackerType::Gitea);
-        r.tracker_owner = Some("acme".to_string());
-        r.findings_count = 7;
-        r
-    }
-
-    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
-        let mut d = DastTarget::new(
-            "acme-web".to_string(),
-            "https://acme.example.com".to_string(),
-            kind,
-        );
-        d.id = Some(mongodb::bson::oid::ObjectId::new());
-        d.repo_id = repo_id;
-        d.max_crawl_depth = 5;
-        d.auth_config = Some(DastAuthConfig {
-            method: "bearer".to_string(),
-            login_url: None,
-            username: None,
-            password: None,
-            token: Some("tok".to_string()),
-            headers: None,
-        });
-        d
-    }
-
-    #[test]
-    fn repo_maps_preserving_id_and_git_artifact() {
-        let r = repo();
-        let t = repo_to_target(&r);
-        assert_eq!(t.id, r.id); // id preserved
-        assert_eq!(t.findings_count, 7);
-        assert_eq!(t.scan_schedule, r.scan_schedule);
-        let git = t.code_artifact().expect("git artifact");
-        assert_eq!(git.kind, ArtifactKind::GitRepo);
-        assert_eq!(git.source_ref, "https://git/acme.git");
-        let gc = git.git.as_ref().expect("git config");
-        assert_eq!(gc.default_branch, "develop");
-        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
-        let auth = git.auth.as_ref().expect("auth");
-        assert_eq!(auth.secret.as_deref(), Some("pat"));
-        assert_eq!(auth.username.as_deref(), Some("bob"));
-        assert_eq!(
-            t.scan_config
-                .issue_tracker
-                .as_ref()
-                .and_then(|it| it.tracker_type.clone()),
-            Some(TrackerType::Gitea)
-        );
-    }
-
-    #[test]
-    fn standalone_dast_maps_preserving_id_and_live_url() {
-        let d = dast(None, DastTargetType::WebApp);
-        let t = dast_to_standalone_target(&d);
-        assert_eq!(t.id, d.id);
-        assert_eq!(t.target_type, TargetType::WebApp);
-        let url = t.live_url().expect("live url");
-        assert_eq!(url.source_ref, "https://acme.example.com");
-        let web = url.web.as_ref().expect("web config");
-        assert_eq!(web.max_crawl_depth, 5);
-        assert_eq!(
-            url.auth.as_ref().and_then(|a| a.secret.clone()),
-            Some("tok".to_string())
-        );
-    }
-
-    #[test]
-    fn rest_api_dast_maps_to_backend_service() {
-        let d = dast(None, DastTargetType::RestApi);
-        assert_eq!(
-            dast_to_standalone_target(&d).target_type,
-            TargetType::BackendService
-        );
-    }
-
-    #[test]
-    fn fold_adds_live_url_and_promotes_webapp() {
-        let mut t = repo_to_target(&repo());
-        assert_eq!(t.target_type, TargetType::BackendService);
-        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
-        assert_eq!(t.target_type, TargetType::WebApp); // promoted
-        assert!(t.has(ArtifactKind::LiveUrl));
-        assert!(t.has(ArtifactKind::GitRepo));
-    }
-
-    #[test]
-    fn fold_is_idempotent_on_live_url() {
-        let mut t = repo_to_target(&repo());
-        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
-        fold_dast_into_target(&mut t, &d);
-        fold_dast_into_target(&mut t, &d);
-        let live_urls = t
-            .artifacts
-            .iter()
-            .filter(|a| a.kind == ArtifactKind::LiveUrl)
-            .count();
-        assert_eq!(live_urls, 1);
-    }
-}

compliance-agent/src/pentest/cleanup.rs

@@ -1,487 +0,0 @@
-use compliance_core::models::pentest::{IdentityProvider, TestUserRecord};
-use compliance_core::AgentConfig;
-use secrecy::ExposeSecret;
-use tracing::{info, warn};
-
-/// Attempt to delete a test user created during a pentest session.
-///
-/// Routes to the appropriate identity provider based on `TestUserRecord.provider`.
-/// Falls back to browser-based cleanup if no API credentials are available.
-///
-/// Returns `Ok(true)` if the user was deleted, `Ok(false)` if skipped, `Err` on failure.
-pub async fn cleanup_test_user(
-    user: &TestUserRecord,
-    config: &AgentConfig,
-    http: &reqwest::Client,
-) -> Result<bool, String> {
-    if user.cleaned_up {
-        return Ok(false);
-    }
-
-    let provider = user.provider.as_ref();
-
-    match provider {
-        Some(IdentityProvider::Keycloak) => cleanup_keycloak(user, config, http).await,
-        Some(IdentityProvider::Auth0) => cleanup_auth0(user, config, http).await,
-        Some(IdentityProvider::Okta) => cleanup_okta(user, config, http).await,
-        Some(IdentityProvider::Firebase) => {
-            warn!("Firebase user cleanup not yet implemented");
-            Ok(false)
-        }
-        Some(IdentityProvider::Custom) | None => {
-            // For custom/unknown providers, try Keycloak if configured, else skip
-            if config.keycloak_url.is_some() && config.keycloak_admin_username.is_some() {
-                cleanup_keycloak(user, config, http).await
-            } else {
-                warn!(
-                    username = user.username.as_deref(),
-                    "No identity provider configured for cleanup — skipping"
-                );
-                Ok(false)
-            }
-        }
-    }
-}
-
-/// Delete a user from Keycloak via the Admin REST API.
-///
-/// Flow: get admin token → search user by username → delete by ID.
-async fn cleanup_keycloak(
-    user: &TestUserRecord,
-    config: &AgentConfig,
-    http: &reqwest::Client,
-) -> Result<bool, String> {
-    let base_url = config
-        .keycloak_url
-        .as_deref()
-        .ok_or("KEYCLOAK_URL not configured")?;
-    let realm = config
-        .keycloak_realm
-        .as_deref()
-        .ok_or("KEYCLOAK_REALM not configured")?;
-    let admin_user = config
-        .keycloak_admin_username
-        .as_deref()
-        .ok_or("KEYCLOAK_ADMIN_USERNAME not configured")?;
-    let admin_pass = config
-        .keycloak_admin_password
-        .as_ref()
-        .ok_or("KEYCLOAK_ADMIN_PASSWORD not configured")?;
-
-    let username = user
-        .username
-        .as_deref()
-        .ok_or("No username in test user record")?;
-
-    info!(username, realm, "Cleaning up Keycloak test user");
-
-    // Step 1: Get admin access token
-    let token_url = format!("{base_url}/realms/master/protocol/openid-connect/token");
-    let token_resp = http
-        .post(&token_url)
-        .form(&[
-            ("grant_type", "password"),
-            ("client_id", "admin-cli"),
-            ("username", admin_user),
-            ("password", admin_pass.expose_secret()),
-        ])
-        .send()
-        .await
-        .map_err(|e| format!("Keycloak token request failed: {e}"))?;
-
-    if !token_resp.status().is_success() {
-        let status = token_resp.status();
-        let body = token_resp.text().await.unwrap_or_default();
-        return Err(format!("Keycloak admin auth failed ({status}): {body}"));
-    }
-
-    let token_body: serde_json::Value = token_resp
-        .json()
-        .await
-        .map_err(|e| format!("Failed to parse Keycloak token: {e}"))?;
-    let access_token = token_body
-        .get("access_token")
-        .and_then(|v| v.as_str())
-        .ok_or("No access_token in Keycloak response")?;
-
-    // Step 2: Search for user by username
-    let search_url =
-        format!("{base_url}/admin/realms/{realm}/users?username={username}&exact=true");
-    let search_resp = http
-        .get(&search_url)
-        .bearer_auth(access_token)
-        .send()
-        .await
-        .map_err(|e| format!("Keycloak user search failed: {e}"))?;
-
-    if !search_resp.status().is_success() {
-        let status = search_resp.status();
-        let body = search_resp.text().await.unwrap_or_default();
-        return Err(format!("Keycloak user search failed ({status}): {body}"));
-    }
-
-    let users: Vec<serde_json::Value> = search_resp
-        .json()
-        .await
-        .map_err(|e| format!("Failed to parse Keycloak users: {e}"))?;
-
-    let user_id = users
-        .first()
-        .and_then(|u| u.get("id"))
-        .and_then(|v| v.as_str())
-        .ok_or_else(|| format!("User '{username}' not found in Keycloak realm '{realm}'"))?;
-
-    // Step 3: Delete the user
-    let delete_url = format!("{base_url}/admin/realms/{realm}/users/{user_id}");
-    let delete_resp = http
-        .delete(&delete_url)
-        .bearer_auth(access_token)
-        .send()
-        .await
-        .map_err(|e| format!("Keycloak user delete failed: {e}"))?;
-
-    if delete_resp.status().is_success() || delete_resp.status().as_u16() == 204 {
-        info!(username, user_id, "Keycloak test user deleted");
-        Ok(true)
-    } else {
-        let status = delete_resp.status();
-        let body = delete_resp.text().await.unwrap_or_default();
-        Err(format!("Keycloak delete failed ({status}): {body}"))
-    }
-}
-
-/// Delete a user from Auth0 via the Management API.
-///
-/// Requires `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_CLIENT_SECRET` env vars.
-async fn cleanup_auth0(
-    user: &TestUserRecord,
-    _config: &AgentConfig,
-    http: &reqwest::Client,
-) -> Result<bool, String> {
-    let domain = std::env::var("AUTH0_DOMAIN").map_err(|_| "AUTH0_DOMAIN not set")?;
-    let client_id = std::env::var("AUTH0_CLIENT_ID").map_err(|_| "AUTH0_CLIENT_ID not set")?;
-    let client_secret =
-        std::env::var("AUTH0_CLIENT_SECRET").map_err(|_| "AUTH0_CLIENT_SECRET not set")?;
-
-    let email = user
-        .email
-        .as_deref()
-        .ok_or("No email in test user record for Auth0 lookup")?;
-
-    info!(email, "Cleaning up Auth0 test user");
-
-    // Get management API token
-    let token_resp = http
-        .post(format!("https://{domain}/oauth/token"))
-        .json(&serde_json::json!({
-            "grant_type": "client_credentials",
-            "client_id": client_id,
-            "client_secret": client_secret,
-            "audience": format!("https://{domain}/api/v2/"),
-        }))
-        .send()
-        .await
-        .map_err(|e| format!("Auth0 token request failed: {e}"))?;
-
-    let token_body: serde_json::Value = token_resp
-        .json()
-        .await
-        .map_err(|e| format!("Failed to parse Auth0 token: {e}"))?;
-    let access_token = token_body
-        .get("access_token")
-        .and_then(|v| v.as_str())
-        .ok_or("No access_token in Auth0 response")?;
-
-    // Search for user by email
-    let encoded_email = urlencoding::encode(email);
-    let search_url = format!("https://{domain}/api/v2/users-by-email?email={encoded_email}");
-    let search_resp = http
-        .get(&search_url)
-        .bearer_auth(access_token)
-        .send()
-        .await
-        .map_err(|e| format!("Auth0 user search failed: {e}"))?;
-
-    let users: Vec<serde_json::Value> = search_resp
-        .json()
-        .await
-        .map_err(|e| format!("Failed to parse Auth0 users: {e}"))?;
-
-    let user_id = users
-        .first()
-        .and_then(|u| u.get("user_id"))
-        .and_then(|v| v.as_str())
-        .ok_or_else(|| format!("User with email '{email}' not found in Auth0"))?;
-
-    // Delete
-    let encoded_id = urlencoding::encode(user_id);
-    let delete_resp = http
-        .delete(format!("https://{domain}/api/v2/users/{encoded_id}"))
-        .bearer_auth(access_token)
-        .send()
-        .await
-        .map_err(|e| format!("Auth0 user delete failed: {e}"))?;
-
-    if delete_resp.status().is_success() || delete_resp.status().as_u16() == 204 {
-        info!(email, user_id, "Auth0 test user deleted");
-        Ok(true)
-    } else {
-        let status = delete_resp.status();
-        let body = delete_resp.text().await.unwrap_or_default();
-        Err(format!("Auth0 delete failed ({status}): {body}"))
-    }
-}
-
-/// Delete a user from Okta via the Users API.
-///
-/// Requires `OKTA_DOMAIN`, `OKTA_API_TOKEN` env vars.
-async fn cleanup_okta(
-    user: &TestUserRecord,
-    _config: &AgentConfig,
-    http: &reqwest::Client,
-) -> Result<bool, String> {
-    let domain = std::env::var("OKTA_DOMAIN").map_err(|_| "OKTA_DOMAIN not set")?;
-    let api_token = std::env::var("OKTA_API_TOKEN").map_err(|_| "OKTA_API_TOKEN not set")?;
-
-    let username = user
-        .username
-        .as_deref()
-        .or(user.email.as_deref())
-        .ok_or("No username/email in test user record for Okta lookup")?;
-
-    info!(username, "Cleaning up Okta test user");
-
-    // Search user
-    let encoded = urlencoding::encode(username);
-    let search_url = format!("https://{domain}/api/v1/users?search=profile.login+eq+\"{encoded}\"");
-    let search_resp = http
-        .get(&search_url)
-        .header("Authorization", format!("SSWS {api_token}"))
-        .send()
-        .await
-        .map_err(|e| format!("Okta user search failed: {e}"))?;
-
-    let users: Vec<serde_json::Value> = search_resp
-        .json()
-        .await
-        .map_err(|e| format!("Failed to parse Okta users: {e}"))?;
-
-    let user_id = users
-        .first()
-        .and_then(|u| u.get("id"))
-        .and_then(|v| v.as_str())
-        .ok_or_else(|| format!("User '{username}' not found in Okta"))?;
-
-    // Deactivate first (required by Okta before delete)
-    let _ = http
-        .post(format!(
-            "https://{domain}/api/v1/users/{user_id}/lifecycle/deactivate"
-        ))
-        .header("Authorization", format!("SSWS {api_token}"))
-        .send()
-        .await;
-
-    // Delete
-    let delete_resp = http
-        .delete(format!("https://{domain}/api/v1/users/{user_id}"))
-        .header("Authorization", format!("SSWS {api_token}"))
-        .send()
-        .await
-        .map_err(|e| format!("Okta user delete failed: {e}"))?;
-
-    if delete_resp.status().is_success() || delete_resp.status().as_u16() == 204 {
-        info!(username, user_id, "Okta test user deleted");
-        Ok(true)
-    } else {
-        let status = delete_resp.status();
-        let body = delete_resp.text().await.unwrap_or_default();
-        Err(format!("Okta delete failed ({status}): {body}"))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::pentest::{IdentityProvider, TestUserRecord};
-    use secrecy::SecretString;
-
-    fn make_config_no_keycloak() -> AgentConfig {
-        AgentConfig {
-            mongodb_uri: String::new(),
-            mongodb_database: String::new(),
-            litellm_url: String::new(),
-            litellm_api_key: SecretString::from(String::new()),
-            litellm_model: String::new(),
-            litellm_embed_model: String::new(),
-            github_token: None,
-            github_webhook_secret: None,
-            gitlab_url: None,
-            gitlab_token: None,
-            gitlab_webhook_secret: None,
-            jira_url: None,
-            jira_email: None,
-            jira_api_token: None,
-            jira_project_key: None,
-            searxng_url: None,
-            nvd_api_key: None,
-            agent_port: 3001,
-            scan_schedule: String::new(),
-            cve_monitor_schedule: String::new(),
-            git_clone_base_path: String::new(),
-            artifact_store_base_path: String::new(),
-            ssh_key_path: String::new(),
-            keycloak_url: None,
-            keycloak_realm: None,
-            keycloak_admin_username: None,
-            keycloak_admin_password: None,
-            pentest_verification_email: None,
-            pentest_imap_host: None,
-            pentest_imap_port: None,
-            pentest_imap_tls: true,
-            pentest_imap_username: None,
-            pentest_imap_password: None,
-            admin_api_token: None,
-            tenant_registry_url: None,
-        }
-    }
-
-    #[tokio::test]
-    async fn already_cleaned_up_returns_false() {
-        let user = TestUserRecord {
-            username: Some("test".into()),
-            email: None,
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Keycloak),
-            cleaned_up: true,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert_eq!(result, Ok(false));
-    }
-
-    #[tokio::test]
-    async fn firebase_returns_false_not_implemented() {
-        let user = TestUserRecord {
-            username: Some("test".into()),
-            email: None,
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Firebase),
-            cleaned_up: false,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert_eq!(result, Ok(false));
-    }
-
-    #[tokio::test]
-    async fn no_provider_no_keycloak_skips() {
-        let user = TestUserRecord {
-            username: Some("test".into()),
-            email: None,
-            provider_user_id: None,
-            provider: None,
-            cleaned_up: false,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert_eq!(result, Ok(false));
-    }
-
-    #[tokio::test]
-    async fn custom_provider_no_keycloak_skips() {
-        let user = TestUserRecord {
-            username: Some("test".into()),
-            email: None,
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Custom),
-            cleaned_up: false,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert_eq!(result, Ok(false));
-    }
-
-    #[tokio::test]
-    async fn keycloak_missing_config_returns_error() {
-        let user = TestUserRecord {
-            username: Some("test".into()),
-            email: None,
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Keycloak),
-            cleaned_up: false,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert!(result.is_err());
-        assert!(result
-            .as_ref()
-            .err()
-            .is_some_and(|e| e.contains("KEYCLOAK_URL")));
-    }
-
-    #[tokio::test]
-    async fn keycloak_missing_username_returns_error() {
-        let user = TestUserRecord {
-            username: None,
-            email: Some("test@example.com".into()),
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Keycloak),
-            cleaned_up: false,
-        };
-        let mut config = make_config_no_keycloak();
-        config.keycloak_url = Some("http://localhost:8080".into());
-        config.keycloak_realm = Some("test".into());
-        config.keycloak_admin_username = Some("admin".into());
-        config.keycloak_admin_password = Some(SecretString::from("pass".to_string()));
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert!(result.is_err());
-        assert!(result
-            .as_ref()
-            .err()
-            .is_some_and(|e| e.contains("username")));
-    }
-
-    #[tokio::test]
-    async fn auth0_missing_env_returns_error() {
-        let user = TestUserRecord {
-            username: None,
-            email: Some("test@example.com".into()),
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Auth0),
-            cleaned_up: false,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert!(result.is_err());
-        assert!(result
-            .as_ref()
-            .err()
-            .is_some_and(|e| e.contains("AUTH0_DOMAIN")));
-    }
-
-    #[tokio::test]
-    async fn okta_missing_env_returns_error() {
-        let user = TestUserRecord {
-            username: Some("test".into()),
-            email: None,
-            provider_user_id: None,
-            provider: Some(IdentityProvider::Okta),
-            cleaned_up: false,
-        };
-        let config = make_config_no_keycloak();
-        let http = reqwest::Client::new();
-        let result = cleanup_test_user(&user, &config, &http).await;
-        assert!(result.is_err());
-        assert!(result
-            .as_ref()
-            .err()
-            .is_some_and(|e| e.contains("OKTA_DOMAIN")));
-    }
-}

compliance-agent/src/pentest/context.rs

@@ -1,150 +0,0 @@
-use futures_util::StreamExt;
-use mongodb::bson::doc;
-
-use compliance_core::models::dast::DastTarget;
-use compliance_core::models::finding::Finding;
-use compliance_core::models::pentest::CodeContextHint;
-use compliance_core::models::sbom::SbomEntry;
-
-use super::orchestrator::PentestOrchestrator;
-
-impl PentestOrchestrator {
-    /// Fetch SAST findings, SBOM entries (with CVEs), and code graph entry points
-    /// for the repo linked to this DAST target.
-    pub(crate) async fn gather_repo_context(
-        &self,
-        target: &DastTarget,
-    ) -> (Vec<Finding>, Vec<SbomEntry>, Vec<CodeContextHint>) {
-        let Some(repo_id) = &target.repo_id else {
-            return (Vec::new(), Vec::new(), Vec::new());
-        };
-
-        let sast_findings = self.fetch_sast_findings(repo_id).await;
-        let sbom_entries = self.fetch_vulnerable_sbom(repo_id).await;
-        let code_context = self.fetch_code_context(repo_id, &sast_findings).await;
-
-        tracing::info!(
-            repo_id,
-            sast_findings = sast_findings.len(),
-            vulnerable_deps = sbom_entries.len(),
-            code_hints = code_context.len(),
-            "Gathered code-awareness context for pentest"
-        );
-
-        (sast_findings, sbom_entries, code_context)
-    }
-
-    /// Fetch open/triaged SAST findings for the repo (not false positives or resolved)
-    async fn fetch_sast_findings(&self, repo_id: &str) -> Vec<Finding> {
-        let cursor = self
-            .db
-            .findings()
-            .find(doc! {
-                "repo_id": repo_id,
-                "status": { "$in": ["open", "triaged"] },
-            })
-            .sort(doc! { "severity": -1 })
-            .limit(100)
-            .await;
-
-        match cursor {
-            Ok(mut c) => {
-                let mut results = Vec::new();
-                while let Some(Ok(f)) = c.next().await {
-                    results.push(f);
-                }
-                results
-            }
-            Err(e) => {
-                tracing::warn!("Failed to fetch SAST findings for pentest: {e}");
-                Vec::new()
-            }
-        }
-    }
-
-    /// Fetch SBOM entries that have known vulnerabilities
-    async fn fetch_vulnerable_sbom(&self, repo_id: &str) -> Vec<SbomEntry> {
-        let cursor = self
-            .db
-            .sbom_entries()
-            .find(doc! {
-                "repo_id": repo_id,
-                "known_vulnerabilities": { "$exists": true, "$ne": [] },
-            })
-            .limit(50)
-            .await;
-
-        match cursor {
-            Ok(mut c) => {
-                let mut results = Vec::new();
-                while let Some(Ok(e)) = c.next().await {
-                    results.push(e);
-                }
-                results
-            }
-            Err(e) => {
-                tracing::warn!("Failed to fetch vulnerable SBOM entries: {e}");
-                Vec::new()
-            }
-        }
-    }
-
-    /// Build CodeContextHint objects from the code knowledge graph.
-    /// Maps entry points to their source files and links SAST findings.
-    async fn fetch_code_context(
-        &self,
-        repo_id: &str,
-        sast_findings: &[Finding],
-    ) -> Vec<CodeContextHint> {
-        // Get entry point nodes from the code graph
-        let cursor = self
-            .db
-            .graph_nodes()
-            .find(doc! {
-                "repo_id": repo_id,
-                "is_entry_point": true,
-            })
-            .limit(50)
-            .await;
-
-        let nodes = match cursor {
-            Ok(mut c) => {
-                let mut results = Vec::new();
-                while let Some(Ok(n)) = c.next().await {
-                    results.push(n);
-                }
-                results
-            }
-            Err(_) => return Vec::new(),
-        };
-
-        // Build hints by matching graph nodes to SAST findings by file path
-        nodes
-            .into_iter()
-            .map(|node| {
-                // Find SAST findings in the same file
-                let linked_vulns: Vec<String> = sast_findings
-                    .iter()
-                    .filter(|f| f.file_path.as_deref() == Some(&node.file_path))
-                    .map(|f| {
-                        format!(
-                            "[{}] {}: {} (line {})",
-                            f.severity,
-                            f.scanner,
-                            f.title,
-                            f.line_number.unwrap_or(0)
-                        )
-                    })
-                    .collect();
-
-                CodeContextHint {
-                    endpoint_pattern: node.qualified_name.clone(),
-                    handler_function: node.name.clone(),
-                    file_path: node.file_path.clone(),
-                    code_snippet: String::new(), // Could fetch from embeddings
-                    known_vulnerabilities: linked_vulns,
-                }
-            })
-            .collect()
-    }
-}

compliance-agent/src/pentest/crypto.rs

@@ -1,117 +0,0 @@
-use aes_gcm::aead::AeadCore;
-use aes_gcm::{
-    aead::{Aead, KeyInit, OsRng},
-    Aes256Gcm, Nonce,
-};
-use base64::Engine;
-
-/// Load the 32-byte encryption key from PENTEST_ENCRYPTION_KEY env var.
-/// Returns None if not set or invalid length.
-pub fn load_encryption_key() -> Option<[u8; 32]> {
-    let hex_key = std::env::var("PENTEST_ENCRYPTION_KEY").ok()?;
-    let bytes = hex::decode(hex_key).ok()?;
-    if bytes.len() != 32 {
-        return None;
-    }
-    let mut key = [0u8; 32];
-    key.copy_from_slice(&bytes);
-    Some(key)
-}
-
-/// Encrypt a plaintext string. Returns base64-encoded nonce+ciphertext.
-/// Returns the original string if no encryption key is available.
-pub fn encrypt(plaintext: &str) -> String {
-    let Some(key_bytes) = load_encryption_key() else {
-        return plaintext.to_string();
-    };
-    let Ok(cipher) = Aes256Gcm::new_from_slice(&key_bytes) else {
-        return plaintext.to_string();
-    };
-    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
-    let Ok(ciphertext) = cipher.encrypt(&nonce, plaintext.as_bytes()) else {
-        return plaintext.to_string();
-    };
-    let mut combined = nonce.to_vec();
-    combined.extend_from_slice(&ciphertext);
-    base64::engine::general_purpose::STANDARD.encode(&combined)
-}
-
-/// Decrypt a base64-encoded nonce+ciphertext string.
-/// Returns None if decryption fails.
-pub fn decrypt(encrypted: &str) -> Option<String> {
-    let key_bytes = load_encryption_key()?;
-    let cipher = Aes256Gcm::new_from_slice(&key_bytes).ok()?;
-    let combined = base64::engine::general_purpose::STANDARD
-        .decode(encrypted)
-        .ok()?;
-    if combined.len() < 12 {
-        return None;
-    }
-    let (nonce_bytes, ciphertext) = combined.split_at(12);
-    let nonce = Nonce::from_slice(nonce_bytes);
-    let plaintext = cipher.decrypt(nonce, ciphertext).ok()?;
-    String::from_utf8(plaintext).ok()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::sync::Mutex;
-
-    // Guard to serialize tests that touch env vars
-    static ENV_LOCK: Mutex<()> = Mutex::new(());
-
-    fn with_key<F: FnOnce()>(hex_key: &str, f: F) {
-        let _guard = ENV_LOCK.lock();
-        unsafe { std::env::set_var("PENTEST_ENCRYPTION_KEY", hex_key) };
-        f();
-        unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
-    }
-
-    #[test]
-    fn round_trip() {
-        let key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
-        with_key(key, || {
-            let plaintext = "my_secret_password";
-            let encrypted = encrypt(plaintext);
-            assert_ne!(encrypted, plaintext);
-            let decrypted = decrypt(&encrypted);
-            assert_eq!(decrypted, Some(plaintext.to_string()));
-        });
-    }
-
-    #[test]
-    fn wrong_key_fails() {
-        let _guard = ENV_LOCK.lock();
-        let key1 = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
-        let key2 = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789";
-        let encrypted = {
-            unsafe { std::env::set_var("PENTEST_ENCRYPTION_KEY", key1) };
-            let e = encrypt("secret");
-            unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
-            e
-        };
-        unsafe { std::env::set_var("PENTEST_ENCRYPTION_KEY", key2) };
-        assert!(decrypt(&encrypted).is_none());
-        unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
-    }
-
-    #[test]
-    fn no_key_passthrough() {
-        let _guard = ENV_LOCK.lock();
-        unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
-        let result = encrypt("plain");
-        assert_eq!(result, "plain");
-    }
-
-    #[test]
-    fn corrupted_ciphertext() {
-        let key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
-        with_key(key, || {
-            assert!(decrypt("not-valid-base64!!!").is_none());
-            // Valid base64 but wrong content
-            let garbage = base64::engine::general_purpose::STANDARD.encode(b"tooshort");
-            assert!(decrypt(&garbage).is_none());
-        });
-    }
-}

compliance-agent/src/pentest/mod.rs

@@ -1,8 +1,4 @@
-pub mod cleanup;
-mod context;
-pub mod crypto;
 pub mod orchestrator;
-mod prompt_builder;
 pub mod report;
 
 pub use orchestrator::PentestOrchestrator;

compliance-agent/src/pentest/orchestrator.rs

@@ -1,48 +1,52 @@
 use std::sync::Arc;
 use std::time::Duration;
 
+use futures_util::StreamExt;
 use mongodb::bson::doc;
-use tokio::sync::{broadcast, watch};
+use tokio::sync::broadcast;
 
 use compliance_core::models::dast::DastTarget;
+use compliance_core::models::finding::{Finding, FindingStatus, Severity};
 use compliance_core::models::pentest::*;
+use compliance_core::models::sbom::SbomEntry;
 use compliance_core::traits::pentest_tool::PentestToolContext;
 use compliance_dast::ToolRegistry;
 
 use crate::database::Database;
-use crate::llm::{
+use crate::llm::client::{
-    ChatMessage, LlmClient, LlmResponse, ToolCallRequest, ToolCallRequestFunction, ToolDefinition,
+    ChatMessage, LlmResponse, ToolCallRequest, ToolCallRequestFunction, ToolDefinition,
 };
+use crate::llm::LlmClient;
 
 /// Maximum duration for a single pentest session before timeout
 const SESSION_TIMEOUT: Duration = Duration::from_secs(30 * 60); // 30 minutes
 
 pub struct PentestOrchestrator {
-    pub(crate) tool_registry: ToolRegistry,
+    tool_registry: ToolRegistry,
-    pub(crate) llm: Arc<LlmClient>,
+    llm: Arc<LlmClient>,
-    pub(crate) db: Database,
+    db: Database,
-    pub(crate) event_tx: broadcast::Sender<PentestEvent>,
+    event_tx: broadcast::Sender<PentestEvent>,
-    pub(crate) pause_rx: Option<watch::Receiver<bool>>,
 }
 
 impl PentestOrchestrator {
-    /// Create a new orchestrator with an externally-provided broadcast sender
+    pub fn new(llm: Arc<LlmClient>, db: Database) -> Self {
-    /// and an optional pause receiver.
+        let (event_tx, _) = broadcast::channel(256);
-    pub fn new(
-        llm: Arc<LlmClient>,
-        db: Database,
-        event_tx: broadcast::Sender<PentestEvent>,
-        pause_rx: Option<watch::Receiver<bool>>,
-    ) -> Self {
         Self {
             tool_registry: ToolRegistry::new(),
             llm,
             db,
             event_tx,
-            pause_rx,
         }
     }
 
+    pub fn subscribe(&self) -> broadcast::Receiver<PentestEvent> {
+        self.event_tx.subscribe()
+    }
+
+    pub fn event_sender(&self) -> broadcast::Sender<PentestEvent> {
+        self.event_tx.clone()
+    }
+
     /// Run a pentest session with timeout and automatic failure marking on errors.
     pub async fn run_session_guarded(
         &self,
@@ -52,18 +56,8 @@ impl PentestOrchestrator {
     ) {
         let session_id = session.id;
 
-        // Use config-specified timeout or default
-        let timeout_duration = session
-            .config
-            .as_ref()
-            .and_then(|c| c.max_duration_minutes)
-            .map(|m| Duration::from_secs(m as u64 * 60))
-            .unwrap_or(SESSION_TIMEOUT);
-
-        let timeout_minutes = timeout_duration.as_secs() / 60;
-
         match tokio::time::timeout(
-            timeout_duration,
+            SESSION_TIMEOUT,
             self.run_session(session, target, initial_message),
         )
         .await
@@ -80,10 +74,12 @@ impl PentestOrchestrator {
                 });
             }
             Err(_) => {
-                let msg = format!("Session timed out after {timeout_minutes} minutes");
+                tracing::warn!(?session_id, "Pentest session timed out after 30 minutes");
-                tracing::warn!(?session_id, "{msg}");
+                self.mark_session_failed(session_id, "Session timed out after 30 minutes")
-                self.mark_session_failed(session_id, &msg).await;
+                    .await;
-                let _ = self.event_tx.send(PentestEvent::Error { message: msg });
+                let _ = self.event_tx.send(PentestEvent::Error {
+                    message: "Session timed out after 30 minutes".to_string(),
+                });
             }
         }
     }
@@ -109,65 +105,24 @@ impl PentestOrchestrator {
         }
     }
 
-    /// Check if the session is paused; if so, update DB status and wait until resumed.
-    async fn wait_if_paused(&self, session: &PentestSession) {
-        let Some(ref pause_rx) = self.pause_rx else {
-            return;
-        };
-        let mut rx = pause_rx.clone();
-
-        if !*rx.borrow() {
-            return;
-        }
-
-        // We are paused — update DB status
-        if let Some(sid) = session.id {
-            let _ = self
-                .db
-                .pentest_sessions()
-                .update_one(doc! { "_id": sid }, doc! { "$set": { "status": "paused" }})
-                .await;
-        }
-        let _ = self.event_tx.send(PentestEvent::Paused);
-
-        // Wait until unpaused
-        while *rx.borrow() {
-            if rx.changed().await.is_err() {
-                break;
-            }
-        }
-
-        // Resumed — update DB status back to running
-        if let Some(sid) = session.id {
-            let _ = self
-                .db
-                .pentest_sessions()
-                .update_one(doc! { "_id": sid }, doc! { "$set": { "status": "running" }})
-                .await;
-        }
-        let _ = self.event_tx.send(PentestEvent::Resumed);
-    }
-
     async fn run_session(
         &self,
         session: &PentestSession,
         target: &DastTarget,
         initial_message: &str,
     ) -> Result<(), crate::error::AgentError> {
-        let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+        let session_id = session
+            .id
+            .map(|oid| oid.to_hex())
+            .unwrap_or_default();
 
         // Gather code-awareness context from linked repo
-        let (sast_findings, sbom_entries, code_context) = self.gather_repo_context(target).await;
+        let (sast_findings, sbom_entries, code_context) =
+            self.gather_repo_context(target).await;
 
         // Build system prompt with code context
         let system_prompt = self
-            .build_system_prompt(
+            .build_system_prompt(session, target, &sast_findings, &sbom_entries, &code_context)
-                session,
-                target,
-                &sast_findings,
-                &sbom_entries,
-                &code_context,
-            )
             .await;
 
         // Build tool definitions for LLM
@@ -220,9 +175,6 @@ impl PentestOrchestrator {
         let mut prev_node_ids: Vec<String> = Vec::new();
 
         for _iteration in 0..max_iterations {
-            // Check pause state at top of each iteration
-            self.wait_if_paused(session).await;
-
             let response = self
                 .llm
                 .chat_with_tools(messages.clone(), &tool_defs, Some(0.2), Some(8192))
@@ -230,7 +182,8 @@ impl PentestOrchestrator {
 
             match response {
                 LlmResponse::Content(content) => {
-                    let msg = PentestMessage::assistant(session_id.clone(), content.clone());
+                    let msg =
+                        PentestMessage::assistant(session_id.clone(), content.clone());
                     let _ = self.db.pentest_messages().insert_one(&msg).await;
                     let _ = self.event_tx.send(PentestEvent::Message {
                         content: content.clone(),
@@ -260,10 +213,7 @@ impl PentestOrchestrator {
                     }
                     break;
                 }
-                LlmResponse::ToolCalls {
+                LlmResponse::ToolCalls { calls: tool_calls, reasoning } => {
-                    calls: tool_calls,
-                    reasoning,
-                } => {
                     let tc_requests: Vec<ToolCallRequest> = tool_calls
                         .iter()
                         .map(|tc| ToolCallRequest {
@@ -271,18 +221,15 @@ impl PentestOrchestrator {
                             r#type: "function".to_string(),
                             function: ToolCallRequestFunction {
                                 name: tc.name.clone(),
-                                arguments: serde_json::to_string(&tc.arguments).unwrap_or_default(),
+                                arguments: serde_json::to_string(&tc.arguments)
+                                    .unwrap_or_default(),
                             },
                         })
                         .collect();
 
                     messages.push(ChatMessage {
                         role: "assistant".to_string(),
-                        content: if reasoning.is_empty() {
+                        content: if reasoning.is_empty() { None } else { Some(reasoning.clone()) },
-                            None
-                        } else {
-                            Some(reasoning.clone())
-                        },
                         tool_calls: Some(tc_requests),
                         tool_call_id: None,
                     });
@@ -321,65 +268,30 @@ impl PentestOrchestrator {
                                     total_findings += findings_count;
 
                                     let mut finding_ids: Vec<String> = Vec::new();
-                                    // Dedup findings within this tool result before inserting
+                                    for mut finding in result.findings {
-                                    let deduped_findings =
-                                        crate::pipeline::dedup::dedup_dast_findings(
-                                            result.findings,
-                                        );
-                                    for mut finding in deduped_findings {
                                         finding.scan_run_id = session_id.clone();
                                         finding.session_id = Some(session_id.clone());
-
-                                        // Check for existing duplicate in this session
-                                        let fp = crate::pipeline::dedup::compute_dast_fingerprint(
-                                            &finding,
-                                        );
-                                        let existing = self
-                                            .db
-                                            .dast_findings()
-                                            .find_one(doc! {
-                                                "session_id": &session_id,
-                                                "title": &finding.title,
-                                                "endpoint": &finding.endpoint,
-                                                "method": &finding.method,
-                                            })
-                                            .await;
-                                        if matches!(existing, Ok(Some(_))) {
-                                            tracing::debug!(
-                                                "Skipping duplicate DAST finding: {} (fp={:.12})",
-                                                finding.title,
-                                                fp,
-                                            );
-                                            continue;
-                                        }
-
                                         let insert_result =
                                             self.db.dast_findings().insert_one(&finding).await;
                                         if let Ok(res) = &insert_result {
-                                            finding_ids.push(
+                                            finding_ids.push(res.inserted_id.as_object_id().map(|oid| oid.to_hex()).unwrap_or_default());
-                                                res.inserted_id
+                                        }
-                                                    .as_object_id()
+                                        let _ =
+                                            self.event_tx.send(PentestEvent::Finding {
+                                                finding_id: finding
+                                                    .id
                                                     .map(|oid| oid.to_hex())
                                                     .unwrap_or_default(),
-                                            );
+                                                title: finding.title.clone(),
-                                        }
+                                                severity: finding.severity.to_string(),
-                                        let _ = self.event_tx.send(PentestEvent::Finding {
+                                            });
-                                            finding_id: finding
-                                                .id
-                                                .map(|oid| oid.to_hex())
-                                                .unwrap_or_default(),
-                                            title: finding.title.clone(),
-                                            severity: finding.severity.to_string(),
-                                        });
                                     }
 
                                     // Compute risk score based on findings severity
                                     let risk_score: Option<u8> = if findings_count > 0 {
                                         Some(std::cmp::min(
                                             100,
-                                            (findings_count as u8)
+                                            (findings_count as u8).saturating_mul(15).saturating_add(20),
-                                                .saturating_mul(15)
-                                                .saturating_add(20),
                                         ))
                                     } else {
                                         None
@@ -419,13 +331,10 @@ impl PentestOrchestrator {
                                         )
                                         .await;
 
-                                    // Build LLM-facing summary: strip large fields
-                                    // (screenshots, raw HTML) to save context window
-                                    let llm_data = summarize_tool_output(&result.data);
                                     serde_json::json!({
                                         "summary": result.summary,
                                         "findings_count": findings_count,
-                                        "data": llm_data,
+                                        "data": result.data,
                                     })
                                     .to_string()
                                 }
@@ -497,61 +406,6 @@ impl PentestOrchestrator {
                 .await;
         }
 
-        // Clean up test user via identity provider API if requested
-        if session
-            .config
-            .as_ref()
-            .is_some_and(|c| c.auth.cleanup_test_user)
-        {
-            if let Some(ref test_user) = session.test_user {
-                let http = reqwest::Client::new();
-                // We need the AgentConfig — read from env since orchestrator doesn't hold it
-                let config = crate::config::load_config();
-                match config {
-                    Ok(cfg) => {
-                        match crate::pentest::cleanup::cleanup_test_user(test_user, &cfg, &http)
-                            .await
-                        {
-                            Ok(true) => {
-                                tracing::info!(
-                                    username = test_user.username.as_deref(),
-                                    "Test user cleaned up via provider API"
-                                );
-                                // Mark as cleaned up in DB
-                                if let Some(sid) = session.id {
-                                    let _ = self
-                                        .db
-                                        .pentest_sessions()
-                                        .update_one(
-                                            doc! { "_id": sid },
-                                            doc! { "$set": { "test_user.cleaned_up": true } },
-                                        )
-                                        .await;
-                                }
-                            }
-                            Ok(false) => {
-                                tracing::info!(
-                                    "Test user cleanup skipped (no provider configured)"
-                                );
-                            }
-                            Err(e) => {
-                                tracing::warn!(error = %e, "Test user cleanup failed");
-                                let _ = self.event_tx.send(PentestEvent::Error {
-                                    message: format!("Test user cleanup failed: {e}"),
-                                });
-                            }
-                        }
-                    }
-                    Err(e) => {
-                        tracing::warn!(error = %e, "Could not load config for cleanup");
-                    }
-                }
-            }
-        }
-
-        // Clean up the persistent browser session for this pentest
-        compliance_dast::tools::browser::cleanup_browser_session(&session_id).await;
-
         let _ = self.event_tx.send(PentestEvent::Complete {
             summary: format!(
                 "Pentest complete. {} findings from {} tool invocations.",
@@ -561,175 +415,347 @@ impl PentestOrchestrator {
 
         Ok(())
     }
-}
 
-/// Strip large fields from tool output before sending to the LLM.
+    // ── Code-Awareness: Gather context from linked repo ─────────
-/// Screenshots, raw HTML, and other bulky data are replaced with short summaries.
-/// The full data is still stored in the DB for the report.
-fn summarize_tool_output(data: &serde_json::Value) -> serde_json::Value {
-    let Some(obj) = data.as_object() else {
-        return data.clone();
-    };
 
-    let mut summarized = serde_json::Map::new();
+    /// Fetch SAST findings, SBOM entries (with CVEs), and code graph entry points
-    for (key, value) in obj {
+    /// for the repo linked to this DAST target.
-        match key.as_str() {
+    async fn gather_repo_context(
-            // Replace screenshot base64 with a placeholder
+        &self,
-            "screenshot_base64" => {
+        target: &DastTarget,
-                if let Some(s) = value.as_str() {
+    ) -> (Vec<Finding>, Vec<SbomEntry>, Vec<CodeContextHint>) {
-                    if !s.is_empty() {
+        let Some(repo_id) = &target.repo_id else {
-                        summarized.insert(
+            return (Vec::new(), Vec::new(), Vec::new());
-                            key.clone(),
+        };
-                            serde_json::Value::String(
+
-                                "[screenshot captured and saved to report]".to_string(),
+        let sast_findings = self.fetch_sast_findings(repo_id).await;
-                            ),
+        let sbom_entries = self.fetch_vulnerable_sbom(repo_id).await;
-                        );
+        let code_context = self.fetch_code_context(repo_id, &sast_findings).await;
-                        continue;
+
-                    }
+        tracing::info!(
+            repo_id,
+            sast_findings = sast_findings.len(),
+            vulnerable_deps = sbom_entries.len(),
+            code_hints = code_context.len(),
+            "Gathered code-awareness context for pentest"
+        );
+
+        (sast_findings, sbom_entries, code_context)
+    }
+
+    /// Fetch open/triaged SAST findings for the repo (not false positives or resolved)
+    async fn fetch_sast_findings(&self, repo_id: &str) -> Vec<Finding> {
+        let cursor = self
+            .db
+            .findings()
+            .find(doc! {
+                "repo_id": repo_id,
+                "status": { "$in": ["open", "triaged"] },
+            })
+            .sort(doc! { "severity": -1 })
+            .limit(100)
+            .await;
+
+        match cursor {
+            Ok(mut c) => {
+                let mut results = Vec::new();
+                while let Some(Ok(f)) = c.next().await {
+                    results.push(f);
                 }
-                summarized.insert(key.clone(), value.clone());
+                results
             }
-            // Truncate raw HTML content
+            Err(e) => {
-            "html" => {
+                tracing::warn!("Failed to fetch SAST findings for pentest: {e}");
-                if let Some(s) = value.as_str() {
+                Vec::new()
-                    if s.len() > 2000 {
-                        summarized.insert(
-                            key.clone(),
-                            serde_json::Value::String(format!(
-                                "{}... [truncated, {} chars total]",
-                                &s[..2000],
-                                s.len()
-                            )),
-                        );
-                        continue;
-                    }
-                }
-                summarized.insert(key.clone(), value.clone());
-            }
-            // Truncate page text
-            "text" if value.as_str().is_some_and(|s| s.len() > 1500) => {
-                let s = value.as_str().unwrap_or_default();
-                summarized.insert(
-                    key.clone(),
-                    serde_json::Value::String(format!("{}... [truncated]", &s[..1500])),
-                );
-            }
-            // Trim large arrays (e.g., "elements", "links", "inputs")
-            "elements" | "links" | "inputs" => {
-                if let Some(arr) = value.as_array() {
-                    if arr.len() > 15 {
-                        let mut trimmed: Vec<serde_json::Value> = arr[..15].to_vec();
-                        trimmed.push(serde_json::json!(format!(
-                            "... and {} more",
-                            arr.len() - 15
-                        )));
-                        summarized.insert(key.clone(), serde_json::Value::Array(trimmed));
-                        continue;
-                    }
-                }
-                summarized.insert(key.clone(), value.clone());
-            }
-            // Recursively summarize nested objects (e.g., "page" in get_content)
-            _ if value.is_object() => {
-                summarized.insert(key.clone(), summarize_tool_output(value));
-            }
-            // Keep everything else as-is
-            _ => {
-                summarized.insert(key.clone(), value.clone());
             }
         }
     }
-    serde_json::Value::Object(summarized)
-}
 
-#[cfg(test)]
+    /// Fetch SBOM entries that have known vulnerabilities
-mod tests {
+    async fn fetch_vulnerable_sbom(&self, repo_id: &str) -> Vec<SbomEntry> {
-    use super::*;
+        let cursor = self
-    use serde_json::json;
+            .db
+            .sbom_entries()
+            .find(doc! {
+                "repo_id": repo_id,
+                "known_vulnerabilities": { "$exists": true, "$ne": [] },
+            })
+            .limit(50)
+            .await;
 
-    #[test]
+        match cursor {
-    fn test_summarize_strips_screenshot() {
+            Ok(mut c) => {
-        let input = json!({
+                let mut results = Vec::new();
-            "screenshot_base64": "iVBOR...",
+                while let Some(Ok(e)) = c.next().await {
-            "url": "https://example.com"
+                    results.push(e);
-        });
+                }
-        let result = summarize_tool_output(&input);
+                results
-        assert_eq!(
+            }
-            result["screenshot_base64"],
+            Err(e) => {
-            "[screenshot captured and saved to report]"
+                tracing::warn!("Failed to fetch vulnerable SBOM entries: {e}");
-        );
+                Vec::new()
-        assert_eq!(result["url"], "https://example.com");
+            }
-    }
-
-    #[test]
-    fn test_summarize_truncates_html() {
-        let long_html = "x".repeat(3000);
-        let input = json!({ "html": long_html });
-        let result = summarize_tool_output(&input);
-        let s = result["html"].as_str().unwrap_or_default();
-        assert!(s.contains("[truncated, 3000 chars total]"));
-        assert!(s.starts_with(&"x".repeat(2000)));
-        assert!(s.len() < 3000);
-    }
-
-    #[test]
-    fn test_summarize_truncates_text() {
-        let long_text = "a".repeat(2000);
-        let input = json!({ "text": long_text });
-        let result = summarize_tool_output(&input);
-        let s = result["text"].as_str().unwrap_or_default();
-        assert!(s.contains("[truncated]"));
-        assert!(s.starts_with(&"a".repeat(1500)));
-        assert!(s.len() < 2000);
-    }
-
-    #[test]
-    fn test_summarize_trims_large_arrays() {
-        let elements: Vec<serde_json::Value> = (0..20).map(|i| json!(format!("el-{i}"))).collect();
-        let input = json!({ "elements": elements });
-        let result = summarize_tool_output(&input);
-        let arr = result["elements"].as_array();
-        assert!(arr.is_some());
-        if let Some(arr) = arr {
-            // 15 kept + 1 summary entry
-            assert_eq!(arr.len(), 16);
-            assert_eq!(arr[15], json!("... and 5 more"));
         }
     }
 
-    #[test]
+    /// Build CodeContextHint objects from the code knowledge graph.
-    fn test_summarize_preserves_small_data() {
+    /// Maps entry points to their source files and links SAST findings.
-        let input = json!({
+    async fn fetch_code_context(
-            "url": "https://example.com",
+        &self,
-            "status": 200,
+        repo_id: &str,
-            "title": "Example"
+        sast_findings: &[Finding],
-        });
+    ) -> Vec<CodeContextHint> {
-        let result = summarize_tool_output(&input);
+        // Get entry point nodes from the code graph
-        assert_eq!(result, input);
+        let cursor = self
-    }
+            .db
+            .graph_nodes()
+            .find(doc! {
+                "repo_id": repo_id,
+                "is_entry_point": true,
+            })
+            .limit(50)
+            .await;
 
-    #[test]
+        let nodes = match cursor {
-    fn test_summarize_recursive() {
+            Ok(mut c) => {
-        let input = json!({
+                let mut results = Vec::new();
-            "page": {
+                while let Some(Ok(n)) = c.next().await {
-                "screenshot_base64": "iVBORw0KGgoAAAA...",
+                    results.push(n);
-                "url": "https://example.com"
+                }
+                results
             }
-        });
+            Err(_) => return Vec::new(),
-        let result = summarize_tool_output(&input);
+        };
-        assert_eq!(
+
-            result["page"]["screenshot_base64"],
+        // Build hints by matching graph nodes to SAST findings by file path
-            "[screenshot captured and saved to report]"
+        nodes
-        );
+            .into_iter()
-        assert_eq!(result["page"]["url"], "https://example.com");
+            .map(|node| {
+                // Find SAST findings in the same file
+                let linked_vulns: Vec<String> = sast_findings
+                    .iter()
+                    .filter(|f| {
+                        f.file_path.as_deref() == Some(&node.file_path)
+                    })
+                    .map(|f| {
+                        format!(
+                            "[{}] {}: {} (line {})",
+                            f.severity,
+                            f.scanner,
+                            f.title,
+                            f.line_number.unwrap_or(0)
+                        )
+                    })
+                    .collect();
+
+                CodeContextHint {
+                    endpoint_pattern: node.qualified_name.clone(),
+                    handler_function: node.name.clone(),
+                    file_path: node.file_path.clone(),
+                    code_snippet: String::new(), // Could fetch from embeddings
+                    known_vulnerabilities: linked_vulns,
+                }
+            })
+            .collect()
     }
 
-    #[test]
+    // ── System Prompt Builder ───────────────────────────────────
-    fn test_summarize_non_object() {
-        let string_val = json!("just a string");
-        assert_eq!(summarize_tool_output(&string_val), string_val);
 
-        let num_val = json!(42);
+    async fn build_system_prompt(
-        assert_eq!(summarize_tool_output(&num_val), num_val);
+        &self,
+        session: &PentestSession,
+        target: &DastTarget,
+        sast_findings: &[Finding],
+        sbom_entries: &[SbomEntry],
+        code_context: &[CodeContextHint],
+    ) -> String {
+        let tool_names = self.tool_registry.list_names().join(", ");
+        let strategy_guidance = match session.strategy {
+            PentestStrategy::Quick => {
+                "Focus on the most common and impactful vulnerabilities. Run a quick recon, then target the highest-risk areas."
+            }
+            PentestStrategy::Comprehensive => {
+                "Perform a thorough assessment covering all vulnerability types. Start with recon, then systematically test each attack surface."
+            }
+            PentestStrategy::Targeted => {
+                "Focus specifically on areas highlighted by SAST findings and known CVEs. Prioritize exploiting known weaknesses."
+            }
+            PentestStrategy::Aggressive => {
+                "Use all available tools aggressively. Test with maximum payloads and attempt full exploitation."
+            }
+            PentestStrategy::Stealth => {
+                "Minimize noise. Use fewer requests, avoid aggressive payloads. Focus on passive analysis and targeted probes."
+            }
+        };
+
+        // Build SAST findings section
+        let sast_section = if sast_findings.is_empty() {
+            String::from("No SAST findings available for this target.")
+        } else {
+            let critical = sast_findings
+                .iter()
+                .filter(|f| f.severity == Severity::Critical)
+                .count();
+            let high = sast_findings
+                .iter()
+                .filter(|f| f.severity == Severity::High)
+                .count();
+
+            let mut section = format!(
+                "{} open findings ({} critical, {} high):\n",
+                sast_findings.len(),
+                critical,
+                high
+            );
+
+            // List the most important findings (critical/high first, up to 20)
+            for f in sast_findings.iter().take(20) {
+                let file_info = f
+                    .file_path
+                    .as_ref()
+                    .map(|p| {
+                        format!(
+                            " in {}:{}",
+                            p,
+                            f.line_number.unwrap_or(0)
+                        )
+                    })
+                    .unwrap_or_default();
+                let status_note = match f.status {
+                    FindingStatus::Triaged => " [TRIAGED]",
+                    _ => "",
+                };
+                section.push_str(&format!(
+                    "- [{sev}] {title}{file}{status}\n",
+                    sev = f.severity,
+                    title = f.title,
+                    file = file_info,
+                    status = status_note,
+                ));
+                if let Some(cwe) = &f.cwe {
+                    section.push_str(&format!("  CWE: {cwe}\n"));
+                }
+            }
+            if sast_findings.len() > 20 {
+                section.push_str(&format!(
+                    "... and {} more findings\n",
+                    sast_findings.len() - 20
+                ));
+            }
+            section
+        };
+
+        // Build SBOM/CVE section
+        let sbom_section = if sbom_entries.is_empty() {
+            String::from("No vulnerable dependencies identified.")
+        } else {
+            let mut section = format!(
+                "{} dependencies with known vulnerabilities:\n",
+                sbom_entries.len()
+            );
+            for entry in sbom_entries.iter().take(15) {
+                let cve_ids: Vec<&str> = entry
+                    .known_vulnerabilities
+                    .iter()
+                    .map(|v| v.id.as_str())
+                    .collect();
+                section.push_str(&format!(
+                    "- {} {} ({}): {}\n",
+                    entry.name,
+                    entry.version,
+                    entry.package_manager,
+                    cve_ids.join(", ")
+                ));
+            }
+            if sbom_entries.len() > 15 {
+                section.push_str(&format!(
+                    "... and {} more vulnerable dependencies\n",
+                    sbom_entries.len() - 15
+                ));
+            }
+            section
+        };
+
+        // Build code context section
+        let code_section = if code_context.is_empty() {
+            String::from("No code knowledge graph available for this target.")
+        } else {
+            let with_vulns = code_context
+                .iter()
+                .filter(|c| !c.known_vulnerabilities.is_empty())
+                .count();
+
+            let mut section = format!(
+                "{} entry points identified ({} with linked SAST findings):\n",
+                code_context.len(),
+                with_vulns
+            );
+
+            for hint in code_context.iter().take(20) {
+                section.push_str(&format!(
+                    "- {} ({})\n",
+                    hint.endpoint_pattern, hint.file_path
+                ));
+                for vuln in &hint.known_vulnerabilities {
+                    section.push_str(&format!("  SAST: {vuln}\n"));
+                }
+            }
+            section
+        };
+
+        format!(
+            r#"You are an expert penetration tester conducting an authorized security assessment.
+
+## Target
+- **Name**: {target_name}
+- **URL**: {base_url}
+- **Type**: {target_type}
+- **Rate Limit**: {rate_limit} req/s
+- **Destructive Tests Allowed**: {allow_destructive}
+- **Linked Repository**: {repo_linked}
+
+## Strategy
+{strategy_guidance}
+
+## SAST Findings (Static Analysis)
+{sast_section}
+
+## Vulnerable Dependencies (SBOM)
+{sbom_section}
+
+## Code Entry Points (Knowledge Graph)
+{code_section}
+
+## Available Tools
+{tool_names}
+
+## Instructions
+1. Start by running reconnaissance (recon tool) to fingerprint the target and discover technologies.
+2. Run the OpenAPI parser to discover API endpoints from specs.
+3. Check infrastructure: DNS, DMARC, TLS, security headers, cookies, CSP, CORS.
+4. Based on SAST findings, prioritize testing endpoints where vulnerabilities were found in code.
+5. For each vulnerability type found in SAST, use the corresponding DAST tool to verify exploitability.
+6. If vulnerable dependencies are listed, try to trigger known CVE conditions against the running application.
+7. Test rate limiting on critical endpoints (login, API).
+8. Check for console.log leakage in frontend JavaScript.
+9. Analyze tool results and chain findings — if one vulnerability enables others, explore the chain.
+10. When testing is complete, provide a structured summary with severity and remediation.
+11. Always explain your reasoning before invoking each tool.
+12. When done, say "Testing complete" followed by a final summary.
+
+## Important
+- This is an authorized penetration test. All testing is permitted within the target scope.
+- Respect the rate limit of {rate_limit} requests per second.
+- Only use destructive tests if explicitly allowed ({allow_destructive}).
+- Use SAST findings to guide your testing — they tell you WHERE in the code vulnerabilities exist.
+- Use SBOM data to understand what technologies and versions the target runs.
+"#,
+            target_name = target.name,
+            base_url = target.base_url,
+            target_type = target.target_type,
+            rate_limit = target.rate_limit,
+            allow_destructive = target.allow_destructive,
+            repo_linked = target.repo_id.as_deref().unwrap_or("None"),
+        )
     }
 }

compliance-agent/src/pentest/prompt_builder.rs

@@ -1,637 +0,0 @@
-use compliance_core::models::dast::DastTarget;
-use compliance_core::models::finding::{Finding, FindingStatus, Severity};
-use compliance_core::models::pentest::*;
-use compliance_core::models::sbom::SbomEntry;
-
-use super::orchestrator::PentestOrchestrator;
-
-/// Attempt to decrypt a field; if decryption fails, return the original value
-/// (which may be plaintext from before encryption was enabled).
-fn decrypt_field(value: &str) -> String {
-    super::crypto::decrypt(value).unwrap_or_else(|| value.to_string())
-}
-
-/// Build additional prompt sections from PentestConfig when present.
-fn build_config_sections(config: &PentestConfig) -> String {
-    let mut sections = String::new();
-
-    // Authentication section
-    match config.auth.mode {
-        AuthMode::Manual => {
-            sections.push_str("\n## Authentication\n");
-            sections.push_str("- **Mode**: Manual credentials\n");
-            if let Some(ref u) = config.auth.username {
-                let decrypted = decrypt_field(u);
-                sections.push_str(&format!("- **Username**: {decrypted}\n"));
-            }
-            if let Some(ref p) = config.auth.password {
-                let decrypted = decrypt_field(p);
-                sections.push_str(&format!("- **Password**: {decrypted}\n"));
-            }
-            sections.push_str(
-                "Use these credentials to log in before testing authenticated endpoints.\n",
-            );
-        }
-        AuthMode::AutoRegister => {
-            sections.push_str("\n## Authentication\n");
-            sections.push_str("- **Mode**: Auto-register\n");
-            if let Some(ref url) = config.auth.registration_url {
-                sections.push_str(&format!("- **Registration URL**: {url}\n"));
-            } else {
-                sections.push_str(
-                    "- **Registration URL**: Not provided — use Playwright to discover the registration page.\n",
-                );
-            }
-            if let Some(ref email) = config.auth.verification_email {
-                sections.push_str(&format!(
-                    "- **Verification Email**: Use plus-addressing from `{email}` \
-                     (e.g. `{base}+{{session_id}}@{domain}`) for email verification. \
-                     The system will poll the IMAP mailbox for verification links.\n",
-                    base = email.split('@').next().unwrap_or(email),
-                    domain = email.split('@').nth(1).unwrap_or("example.com"),
-                ));
-            }
-            sections.push_str(
-                "Register a new test account using the registration page, then use it for testing.\n",
-            );
-        }
-        AuthMode::None => {}
-    }
-
-    // Custom headers
-    if !config.custom_headers.is_empty() {
-        sections.push_str("\n## Custom HTTP Headers\n");
-        sections.push_str("Include these headers in all HTTP requests:\n");
-        for (k, v) in &config.custom_headers {
-            sections.push_str(&format!("- `{k}: {v}`\n"));
-        }
-    }
-
-    // Scope exclusions
-    if !config.scope_exclusions.is_empty() {
-        sections.push_str("\n## Scope Exclusions\n");
-        sections.push_str("Do NOT test the following paths:\n");
-        for path in &config.scope_exclusions {
-            sections.push_str(&format!("- `{path}`\n"));
-        }
-    }
-
-    // Git context
-    if config.git_repo_url.is_some() || config.branch.is_some() || config.commit_hash.is_some() {
-        sections.push_str("\n## Git Context\n");
-        if let Some(ref url) = config.git_repo_url {
-            sections.push_str(&format!("- **Repository**: {url}\n"));
-        }
-        if let Some(ref branch) = config.branch {
-            sections.push_str(&format!("- **Branch**: {branch}\n"));
-        }
-        if let Some(ref commit) = config.commit_hash {
-            sections.push_str(&format!("- **Commit**: {commit}\n"));
-        }
-    }
-
-    // Environment
-    sections.push_str(&format!(
-        "\n## Environment\n- **Target environment**: {}\n",
-        config.environment
-    ));
-
-    sections
-}
-
-/// Return strategy guidance text for the given strategy.
-fn strategy_guidance(strategy: &PentestStrategy) -> &'static str {
-    match strategy {
-        PentestStrategy::Quick => {
-            "Focus on the most common and impactful vulnerabilities. Run a quick recon, then target the highest-risk areas."
-        }
-        PentestStrategy::Comprehensive => {
-            "Perform a thorough assessment covering all vulnerability types. Start with recon, then systematically test each attack surface."
-        }
-        PentestStrategy::Targeted => {
-            "Focus specifically on areas highlighted by SAST findings and known CVEs. Prioritize exploiting known weaknesses."
-        }
-        PentestStrategy::Aggressive => {
-            "Use all available tools aggressively. Test with maximum payloads and attempt full exploitation."
-        }
-        PentestStrategy::Stealth => {
-            "Minimize noise. Use fewer requests, avoid aggressive payloads. Focus on passive analysis and targeted probes."
-        }
-    }
-}
-
-/// Build the SAST findings section for the system prompt.
-fn build_sast_section(sast_findings: &[Finding]) -> String {
-    if sast_findings.is_empty() {
-        return String::from("No SAST findings available for this target.");
-    }
-
-    let critical = sast_findings
-        .iter()
-        .filter(|f| f.severity == Severity::Critical)
-        .count();
-    let high = sast_findings
-        .iter()
-        .filter(|f| f.severity == Severity::High)
-        .count();
-
-    let mut section = format!(
-        "{} open findings ({} critical, {} high):\n",
-        sast_findings.len(),
-        critical,
-        high
-    );
-
-    // List the most important findings (critical/high first, up to 20)
-    for f in sast_findings.iter().take(20) {
-        let file_info = f
-            .file_path
-            .as_ref()
-            .map(|p| format!(" in {}:{}", p, f.line_number.unwrap_or(0)))
-            .unwrap_or_default();
-        let status_note = match f.status {
-            FindingStatus::Triaged => " [TRIAGED]",
-            _ => "",
-        };
-        section.push_str(&format!(
-            "- [{sev}] {title}{file}{status}\n",
-            sev = f.severity,
-            title = f.title,
-            file = file_info,
-            status = status_note,
-        ));
-        if let Some(cwe) = &f.cwe {
-            section.push_str(&format!("  CWE: {cwe}\n"));
-        }
-    }
-    if sast_findings.len() > 20 {
-        section.push_str(&format!(
-            "... and {} more findings\n",
-            sast_findings.len() - 20
-        ));
-    }
-    section
-}
-
-/// Build the SBOM/CVE section for the system prompt.
-fn build_sbom_section(sbom_entries: &[SbomEntry]) -> String {
-    if sbom_entries.is_empty() {
-        return String::from("No vulnerable dependencies identified.");
-    }
-
-    let mut section = format!(
-        "{} dependencies with known vulnerabilities:\n",
-        sbom_entries.len()
-    );
-    for entry in sbom_entries.iter().take(15) {
-        let cve_ids: Vec<&str> = entry
-            .known_vulnerabilities
-            .iter()
-            .map(|v| v.id.as_str())
-            .collect();
-        section.push_str(&format!(
-            "- {} {} ({}): {}\n",
-            entry.name,
-            entry.version,
-            entry.package_manager,
-            cve_ids.join(", ")
-        ));
-    }
-    if sbom_entries.len() > 15 {
-        section.push_str(&format!(
-            "... and {} more vulnerable dependencies\n",
-            sbom_entries.len() - 15
-        ));
-    }
-    section
-}
-
-/// Build the code context section for the system prompt.
-fn build_code_section(code_context: &[CodeContextHint]) -> String {
-    if code_context.is_empty() {
-        return String::from("No code knowledge graph available for this target.");
-    }
-
-    let with_vulns = code_context
-        .iter()
-        .filter(|c| !c.known_vulnerabilities.is_empty())
-        .count();
-
-    let mut section = format!(
-        "{} entry points identified ({} with linked SAST findings):\n",
-        code_context.len(),
-        with_vulns
-    );
-
-    for hint in code_context.iter().take(20) {
-        section.push_str(&format!(
-            "- {} ({})\n",
-            hint.endpoint_pattern, hint.file_path
-        ));
-        for vuln in &hint.known_vulnerabilities {
-            section.push_str(&format!("  SAST: {vuln}\n"));
-        }
-    }
-    section
-}
-
-impl PentestOrchestrator {
-    pub(crate) async fn build_system_prompt(
-        &self,
-        session: &PentestSession,
-        target: &DastTarget,
-        sast_findings: &[Finding],
-        sbom_entries: &[SbomEntry],
-        code_context: &[CodeContextHint],
-    ) -> String {
-        let tool_names = self.tool_registry.list_names().join(", ");
-        let guidance = strategy_guidance(&session.strategy);
-        let sast_section = build_sast_section(sast_findings);
-        let sbom_section = build_sbom_section(sbom_entries);
-        let code_section = build_code_section(code_context);
-        let config_sections = session
-            .config
-            .as_ref()
-            .map(build_config_sections)
-            .unwrap_or_default();
-
-        format!(
-            r#"You are an expert penetration tester conducting an authorized security assessment.
-
-## Target
-- **Name**: {target_name}
-- **URL**: {base_url}
-- **Type**: {target_type}
-- **Rate Limit**: {rate_limit} req/s
-- **Destructive Tests Allowed**: {allow_destructive}
-- **Linked Repository**: {repo_linked}
-
-## Strategy
-{strategy_guidance}
-
-## SAST Findings (Static Analysis)
-{sast_section}
-
-## Vulnerable Dependencies (SBOM)
-{sbom_section}
-
-## Code Entry Points (Knowledge Graph)
-{code_section}
-{config_sections}
-## Available Tools
-{tool_names}
-
-## Instructions
-1. Start by running reconnaissance (recon tool) to fingerprint the target and discover technologies.
-2. Run the OpenAPI parser to discover API endpoints from specs.
-3. Check infrastructure: DNS, DMARC, TLS, security headers, cookies, CSP, CORS.
-4. If the target requires authentication (auto-register mode), use the browser tool to:
-   a. Navigate to the target — it will redirect to the login page.
-   b. Click the "Register" link to reach the registration form.
-   c. Fill all form fields (username, email with plus-addressing, password, name) one by one.
-   d. Click submit. If a Terms & Conditions page appears, accept it.
-   e. After registration, use the browser to navigate through the application pages.
-   f. **Take a screenshot after each major page** for evidence in the report.
-5. Use the browser tool to explore the authenticated application — navigate to each section,
-   use get_content to understand the page structure, and take screenshots.
-6. Based on SAST findings, prioritize testing endpoints where vulnerabilities were found in code.
-7. For each vulnerability type found in SAST, use the corresponding DAST tool to verify exploitability.
-8. If vulnerable dependencies are listed, try to trigger known CVE conditions against the running application.
-9. Test rate limiting on critical endpoints (login, API).
-10. Check for console.log leakage in frontend JavaScript.
-11. Analyze tool results and chain findings — if one vulnerability enables others, explore the chain.
-12. When testing is complete, provide a structured summary with severity and remediation.
-13. Always explain your reasoning before invoking each tool.
-14. When done, say "Testing complete" followed by a final summary.
-
-## Browser Tool Usage
-- The browser tab **persists** between calls — cookies and login state are preserved.
-- After navigate, the response includes `elements` (links, inputs, buttons on the page).
-- Use `get_content` to see forms, links, buttons, headings, and page text.
-- Use `click` with CSS selectors to interact (e.g., `a:text('Register')`, `input[type='submit']`).
-- Use `fill` with selector + value to fill form fields (e.g., `input[name='email']`).
-- **Take screenshots** (`action: screenshot`) after important actions for evidence.
-- For SPA apps: a 200 HTTP status does NOT mean the page is accessible — check the actual
-  page content with the browser tool to verify if it shows real data or a login redirect.
-
-## Finding Quality Rules
-- **Do not report the same issue twice.** If multiple tools detect the same missing header or
-  vulnerability on the same endpoint, report it ONCE with the most specific tool's output.
-  For example, if the recon tool and the header scanner both find missing HSTS, report it only
-  from the header scanner (more specific).
-- **Group related findings.** Missing security headers on the same endpoint are ONE finding
-  ("Missing security headers") listing all missing headers, not separate findings per header.
-- **Severity must match real impact:**
-  - critical/high: Exploitable vulnerability (you can demonstrate the exploit)
-  - medium: Real misconfiguration with security implications but not directly exploitable
-  - low: Best-practice recommendation, defense-in-depth, or informational
-- **Missing headers are medium at most** unless you can demonstrate a concrete exploit enabled
-  by the missing header (e.g., missing CSP + confirmed XSS = high for CSP finding).
-- Console.log in third-party/vendored JS (node_modules, minified libraries) is informational only.
-
-## Important
-- This is an authorized penetration test. All testing is permitted within the target scope.
-- Respect the rate limit of {rate_limit} requests per second.
-- Only use destructive tests if explicitly allowed ({allow_destructive}).
-- Use SAST findings to guide your testing — they tell you WHERE in the code vulnerabilities exist.
-- Use SBOM data to understand what technologies and versions the target runs.
-"#,
-            target_name = target.name,
-            base_url = target.base_url,
-            target_type = target.target_type,
-            rate_limit = target.rate_limit,
-            allow_destructive = target.allow_destructive,
-            repo_linked = target.repo_id.as_deref().unwrap_or("None"),
-            strategy_guidance = guidance,
-        )
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-    use compliance_core::models::sbom::VulnRef;
-    use compliance_core::models::scan::ScanType;
-
-    fn make_finding(
-        severity: Severity,
-        title: &str,
-        file_path: Option<&str>,
-        line: Option<u32>,
-        status: FindingStatus,
-        cwe: Option<&str>,
-    ) -> Finding {
-        let mut f = Finding::new(
-            "repo-1".into(),
-            format!("fp-{title}"),
-            "semgrep".into(),
-            ScanType::Sast,
-            title.into(),
-            "desc".into(),
-            severity,
-        );
-        f.file_path = file_path.map(|s| s.to_string());
-        f.line_number = line;
-        f.status = status;
-        f.cwe = cwe.map(|s| s.to_string());
-        f
-    }
-
-    fn make_sbom_entry(name: &str, version: &str, cves: &[&str]) -> SbomEntry {
-        let mut entry = SbomEntry::new("repo-1".into(), name.into(), version.into(), "npm".into());
-        entry.known_vulnerabilities = cves
-            .iter()
-            .map(|id| VulnRef {
-                id: id.to_string(),
-                source: "nvd".into(),
-                severity: None,
-                url: None,
-            })
-            .collect();
-        entry
-    }
-
-    fn make_code_hint(endpoint: &str, file: &str, vulns: Vec<String>) -> CodeContextHint {
-        CodeContextHint {
-            endpoint_pattern: endpoint.into(),
-            handler_function: "handler".into(),
-            file_path: file.into(),
-            code_snippet: String::new(),
-            known_vulnerabilities: vulns,
-        }
-    }
-
-    // ── strategy_guidance ────────────────────────────────────────────
-
-    #[test]
-    fn strategy_guidance_quick() {
-        let g = strategy_guidance(&PentestStrategy::Quick);
-        assert!(g.contains("most common"));
-        assert!(g.contains("quick recon"));
-    }
-
-    #[test]
-    fn strategy_guidance_comprehensive() {
-        let g = strategy_guidance(&PentestStrategy::Comprehensive);
-        assert!(g.contains("thorough assessment"));
-    }
-
-    #[test]
-    fn strategy_guidance_targeted() {
-        let g = strategy_guidance(&PentestStrategy::Targeted);
-        assert!(g.contains("SAST findings"));
-        assert!(g.contains("known CVEs"));
-    }
-
-    #[test]
-    fn strategy_guidance_aggressive() {
-        let g = strategy_guidance(&PentestStrategy::Aggressive);
-        assert!(g.contains("aggressively"));
-        assert!(g.contains("full exploitation"));
-    }
-
-    #[test]
-    fn strategy_guidance_stealth() {
-        let g = strategy_guidance(&PentestStrategy::Stealth);
-        assert!(g.contains("Minimize noise"));
-        assert!(g.contains("passive analysis"));
-    }
-
-    // ── build_sast_section ───────────────────────────────────────────
-
-    #[test]
-    fn sast_section_empty() {
-        let section = build_sast_section(&[]);
-        assert_eq!(section, "No SAST findings available for this target.");
-    }
-
-    #[test]
-    fn sast_section_single_critical() {
-        let findings = vec![make_finding(
-            Severity::Critical,
-            "SQL Injection",
-            Some("src/db.rs"),
-            Some(42),
-            FindingStatus::Open,
-            Some("CWE-89"),
-        )];
-        let section = build_sast_section(&findings);
-        assert!(section.contains("1 open findings (1 critical, 0 high)"));
-        assert!(section.contains("[critical] SQL Injection in src/db.rs:42"));
-        assert!(section.contains("CWE: CWE-89"));
-    }
-
-    #[test]
-    fn sast_section_triaged_finding_shows_marker() {
-        let findings = vec![make_finding(
-            Severity::High,
-            "XSS",
-            None,
-            None,
-            FindingStatus::Triaged,
-            None,
-        )];
-        let section = build_sast_section(&findings);
-        assert!(section.contains("[TRIAGED]"));
-    }
-
-    #[test]
-    fn sast_section_no_file_path_omits_location() {
-        let findings = vec![make_finding(
-            Severity::Medium,
-            "Open Redirect",
-            None,
-            None,
-            FindingStatus::Open,
-            None,
-        )];
-        let section = build_sast_section(&findings);
-        assert!(section.contains("- [medium] Open Redirect\n"));
-        assert!(!section.contains(" in "));
-    }
-
-    #[test]
-    fn sast_section_counts_critical_and_high() {
-        let findings = vec![
-            make_finding(
-                Severity::Critical,
-                "F1",
-                None,
-                None,
-                FindingStatus::Open,
-                None,
-            ),
-            make_finding(
-                Severity::Critical,
-                "F2",
-                None,
-                None,
-                FindingStatus::Open,
-                None,
-            ),
-            make_finding(Severity::High, "F3", None, None, FindingStatus::Open, None),
-            make_finding(
-                Severity::Medium,
-                "F4",
-                None,
-                None,
-                FindingStatus::Open,
-                None,
-            ),
-        ];
-        let section = build_sast_section(&findings);
-        assert!(section.contains("4 open findings (2 critical, 1 high)"));
-    }
-
-    #[test]
-    fn sast_section_truncates_at_20() {
-        let findings: Vec<Finding> = (0..25)
-            .map(|i| {
-                make_finding(
-                    Severity::Low,
-                    &format!("Finding {i}"),
-                    None,
-                    None,
-                    FindingStatus::Open,
-                    None,
-                )
-            })
-            .collect();
-        let section = build_sast_section(&findings);
-        assert!(section.contains("... and 5 more findings"));
-        // Should contain Finding 19 (the 20th) but not Finding 20 (the 21st)
-        assert!(section.contains("Finding 19"));
-        assert!(!section.contains("Finding 20"));
-    }
-
-    // ── build_sbom_section ───────────────────────────────────────────
-
-    #[test]
-    fn sbom_section_empty() {
-        let section = build_sbom_section(&[]);
-        assert_eq!(section, "No vulnerable dependencies identified.");
-    }
-
-    #[test]
-    fn sbom_section_single_entry() {
-        let entries = vec![make_sbom_entry("lodash", "4.17.20", &["CVE-2021-23337"])];
-        let section = build_sbom_section(&entries);
-        assert!(section.contains("1 dependencies with known vulnerabilities"));
-        assert!(section.contains("- lodash 4.17.20 (npm): CVE-2021-23337"));
-    }
-
-    #[test]
-    fn sbom_section_multiple_cves() {
-        let entries = vec![make_sbom_entry(
-            "openssl",
-            "1.1.1",
-            &["CVE-2022-0001", "CVE-2022-0002"],
-        )];
-        let section = build_sbom_section(&entries);
-        assert!(section.contains("CVE-2022-0001, CVE-2022-0002"));
-    }
-
-    #[test]
-    fn sbom_section_truncates_at_15() {
-        let entries: Vec<SbomEntry> = (0..18)
-            .map(|i| make_sbom_entry(&format!("pkg-{i}"), "1.0.0", &["CVE-2024-0001"]))
-            .collect();
-        let section = build_sbom_section(&entries);
-        assert!(section.contains("... and 3 more vulnerable dependencies"));
-        assert!(section.contains("pkg-14"));
-        assert!(!section.contains("pkg-15"));
-    }
-
-    // ── build_code_section ───────────────────────────────────────────
-
-    #[test]
-    fn code_section_empty() {
-        let section = build_code_section(&[]);
-        assert_eq!(
-            section,
-            "No code knowledge graph available for this target."
-        );
-    }
-
-    #[test]
-    fn code_section_single_entry_no_vulns() {
-        let hints = vec![make_code_hint("GET /api/users", "src/routes.rs", vec![])];
-        let section = build_code_section(&hints);
-        assert!(section.contains("1 entry points identified (0 with linked SAST findings)"));
-        assert!(section.contains("- GET /api/users (src/routes.rs)"));
-    }
-
-    #[test]
-    fn code_section_with_linked_vulns() {
-        let hints = vec![make_code_hint(
-            "POST /login",
-            "src/auth.rs",
-            vec!["[critical] semgrep: SQL Injection (line 15)".into()],
-        )];
-        let section = build_code_section(&hints);
-        assert!(section.contains("1 entry points identified (1 with linked SAST findings)"));
-        assert!(section.contains("SAST: [critical] semgrep: SQL Injection (line 15)"));
-    }
-
-    #[test]
-    fn code_section_counts_entries_with_vulns() {
-        let hints = vec![
-            make_code_hint("GET /a", "a.rs", vec!["vuln1".into()]),
-            make_code_hint("GET /b", "b.rs", vec![]),
-            make_code_hint("GET /c", "c.rs", vec!["vuln2".into(), "vuln3".into()]),
-        ];
-        let section = build_code_section(&hints);
-        assert!(section.contains("3 entry points identified (2 with linked SAST findings)"));
-    }
-
-    #[test]
-    fn code_section_truncates_at_20() {
-        let hints: Vec<CodeContextHint> = (0..25)
-            .map(|i| make_code_hint(&format!("GET /ep{i}"), &format!("f{i}.rs"), vec![]))
-            .collect();
-        let section = build_code_section(&hints);
-        assert!(section.contains("GET /ep19"));
-        assert!(!section.contains("GET /ep20"));
-    }
-}

compliance-agent/src/pentest/report/archive.rs

@@ -1,43 +0,0 @@
-use std::io::{Cursor, Write};
-
-use zip::write::SimpleFileOptions;
-use zip::AesMode;
-
-use super::ReportContext;
-
-pub(super) fn build_zip(
-    ctx: &ReportContext,
-    password: &str,
-    html: &str,
-    pdf: &[u8],
-) -> Result<Vec<u8>, zip::result::ZipError> {
-    let buf = Cursor::new(Vec::new());
-    let mut zip = zip::ZipWriter::new(buf);
-
-    let options = SimpleFileOptions::default()
-        .compression_method(zip::CompressionMethod::Deflated)
-        .with_aes_encryption(AesMode::Aes256, password);
-
-    // report.pdf (primary)
-    zip.start_file("report.pdf", options)?;
-    zip.write_all(pdf)?;
-
-    // report.html (fallback)
-    zip.start_file("report.html", options)?;
-    zip.write_all(html.as_bytes())?;
-
-    // findings.json
-    let findings_json =
-        serde_json::to_string_pretty(&ctx.findings).unwrap_or_else(|_| "[]".to_string());
-    zip.start_file("findings.json", options)?;
-    zip.write_all(findings_json.as_bytes())?;
-
-    // attack-chain.json
-    let chain_json =
-        serde_json::to_string_pretty(&ctx.attack_chain).unwrap_or_else(|_| "[]".to_string());
-    zip.start_file("attack-chain.json", options)?;
-    zip.write_all(chain_json.as_bytes())?;
-
-    let cursor = zip.finish()?;
-    Ok(cursor.into_inner())
-}

compliance-agent/src/pentest/report/html/appendix.rs

@@ -1,40 +0,0 @@
-use super::html_escape;
-
-pub(super) fn appendix(session_id: &str) -> String {
-    format!(
-        r##"<!-- ═══════════════ 5. APPENDIX ═══════════════ -->
-<div class="page-break"></div>
-<h2><span class="section-num">5.</span> Appendix</h2>
-
-<h3>Severity Definitions</h3>
-<table class="info">
-    <tr><td style="color: var(--sev-critical); font-weight: 700;">Critical</td><td>Vulnerabilities that can be exploited remotely without authentication to execute arbitrary code, exfiltrate sensitive data, or fully compromise the system.</td></tr>
-    <tr><td style="color: var(--sev-high); font-weight: 700;">High</td><td>Vulnerabilities that allow significant unauthorized access or data exposure, typically requiring minimal user interaction or privileges.</td></tr>
-    <tr><td style="color: var(--sev-medium); font-weight: 700;">Medium</td><td>Vulnerabilities that may lead to limited data exposure or require specific conditions to exploit, but still represent meaningful risk.</td></tr>
-    <tr><td style="color: var(--sev-low); font-weight: 700;">Low</td><td>Minor issues with limited direct impact. May contribute to broader attack chains or indicate defense-in-depth weaknesses.</td></tr>
-    <tr><td style="color: var(--sev-info); font-weight: 700;">Info</td><td>Observations and best-practice recommendations that do not represent direct security vulnerabilities.</td></tr>
-</table>
-
-<h3>Disclaimer</h3>
-<p style="font-size: 9pt; color: var(--text-secondary);">
-    This report was generated by an automated AI-powered penetration testing engine. While the system
-    employs advanced techniques to identify vulnerabilities, no automated assessment can guarantee
-    complete coverage. The results should be reviewed by qualified security professionals and validated
-    in the context of the target application's threat model. Findings are point-in-time observations
-    and may change as the application evolves.
-</p>
-
-<!-- ═══════════════ FOOTER ═══════════════ -->
-<div class="report-footer">
-    <div class="footer-company">Compliance Scanner</div>
-    <div>AI-Powered Security Assessment Platform</div>
-    <div style="margin-top: 6px;">This document is confidential and intended solely for the named recipient.</div>
-    <div>Report ID: {session_id}</div>
-</div>
-
-</div><!-- .report-body -->
-</body>
-</html>"##,
-        session_id = html_escape(session_id),
-    )
-}

compliance-agent/src/pentest/report/html/attack_chain.rs

@@ -1,193 +0,0 @@
-use super::html_escape;
-use compliance_core::models::pentest::AttackChainNode;
-
-pub(super) fn attack_chain(chain: &[AttackChainNode]) -> String {
-    let chain_section = if chain.is_empty() {
-        r#"<p style="color: var(--text-muted);">No attack chain steps recorded.</p>"#.to_string()
-    } else {
-        build_chain_html(chain)
-    };
-
-    format!(
-        r##"<!-- ═══════════════ 4. ATTACK CHAIN ═══════════════ -->
-<div class="page-break"></div>
-<h2><span class="section-num">4.</span> Attack Chain Timeline</h2>
-
-<p>
-    The following sequence shows each tool invocation made by the AI orchestrator during the assessment,
-    grouped by phase. Each step includes the tool's name, execution status, and the AI's reasoning
-    for choosing that action.
-</p>
-
-<div style="margin-top: 16px;">
-    {chain_section}
-</div>"##
-    )
-}
-
-fn build_chain_html(chain: &[AttackChainNode]) -> String {
-    let mut chain_html = String::new();
-
-    // Compute phases via BFS from root nodes
-    let mut phase_map: std::collections::HashMap<String, usize> = std::collections::HashMap::new();
-    let mut queue: std::collections::VecDeque<String> = std::collections::VecDeque::new();
-
-    for node in chain {
-        if node.parent_node_ids.is_empty() {
-            let nid = node.node_id.clone();
-            if !nid.is_empty() {
-                phase_map.insert(nid.clone(), 0);
-                queue.push_back(nid);
-            }
-        }
-    }
-
-    while let Some(nid) = queue.pop_front() {
-        let parent_phase = phase_map.get(&nid).copied().unwrap_or(0);
-        for node in chain {
-            if node.parent_node_ids.contains(&nid) {
-                let child_id = node.node_id.clone();
-                if !child_id.is_empty() && !phase_map.contains_key(&child_id) {
-                    phase_map.insert(child_id.clone(), parent_phase + 1);
-                    queue.push_back(child_id);
-                }
-            }
-        }
-    }
-
-    // Assign phase 0 to any unassigned nodes
-    for node in chain {
-        let nid = node.node_id.clone();
-        if !nid.is_empty() && !phase_map.contains_key(&nid) {
-            phase_map.insert(nid, 0);
-        }
-    }
-
-    // Group nodes by phase
-    let max_phase = phase_map.values().copied().max().unwrap_or(0);
-    let phase_labels = [
-        "Reconnaissance",
-        "Enumeration",
-        "Exploitation",
-        "Validation",
-        "Post-Exploitation",
-    ];
-
-    for phase_idx in 0..=max_phase {
-        let phase_nodes: Vec<&AttackChainNode> = chain
-            .iter()
-            .filter(|n| {
-                let nid = n.node_id.clone();
-                phase_map.get(&nid).copied().unwrap_or(0) == phase_idx
-            })
-            .collect();
-
-        if phase_nodes.is_empty() {
-            continue;
-        }
-
-        let label = if phase_idx < phase_labels.len() {
-            phase_labels[phase_idx]
-        } else {
-            "Additional Testing"
-        };
-
-        chain_html.push_str(&format!(
-            r#"<div class="phase-block">
-                    <div class="phase-header">
-                        <span class="phase-num">Phase {}</span>
-                        <span class="phase-label">{}</span>
-                        <span class="phase-count">{} step{}</span>
-                    </div>
-                    <div class="phase-steps">"#,
-            phase_idx + 1,
-            label,
-            phase_nodes.len(),
-            if phase_nodes.len() == 1 { "" } else { "s" },
-        ));
-
-        for (i, node) in phase_nodes.iter().enumerate() {
-            let status_label = format!("{:?}", node.status);
-            let status_class = match status_label.to_lowercase().as_str() {
-                "completed" => "step-completed",
-                "failed" => "step-failed",
-                _ => "step-running",
-            };
-            let findings_badge = if !node.findings_produced.is_empty() {
-                format!(
-                    r#"<span class="step-findings">{} finding{}</span>"#,
-                    node.findings_produced.len(),
-                    if node.findings_produced.len() == 1 {
-                        ""
-                    } else {
-                        "s"
-                    },
-                )
-            } else {
-                String::new()
-            };
-            let risk_badge = node
-                .risk_score
-                .map(|r| {
-                    let risk_class = if r >= 70 {
-                        "risk-high"
-                    } else if r >= 40 {
-                        "risk-med"
-                    } else {
-                        "risk-low"
-                    };
-                    format!(r#"<span class="step-risk {risk_class}">Risk: {r}</span>"#)
-                })
-                .unwrap_or_default();
-
-            let reasoning_html = if node.llm_reasoning.is_empty() {
-                String::new()
-            } else {
-                format!(
-                    r#"<div class="step-reasoning">{}</div>"#,
-                    html_escape(&node.llm_reasoning)
-                )
-            };
-
-            // Render inline screenshot if this is a browser screenshot action
-            let screenshot_html = if node.tool_name == "browser" {
-                node.tool_output
-                    .as_ref()
-                    .and_then(|out| out.get("screenshot_base64"))
-                    .and_then(|v| v.as_str())
-                    .filter(|s| !s.is_empty())
-                    .map(|b64| {
-                        format!(
-                            r#"<div class="step-screenshot"><img src="data:image/png;base64,{b64}" alt="Browser screenshot" style="max-width:100%;border:1px solid #e2e8f0;border-radius:6px;margin-top:8px;"/></div>"#
-                        )
-                    })
-                    .unwrap_or_default()
-            } else {
-                String::new()
-            };
-
-            chain_html.push_str(&format!(
-                r#"<div class="step-row">
-                        <div class="step-num">{num}</div>
-                        <div class="step-connector"></div>
-                        <div class="step-content">
-                            <div class="step-header">
-                                <span class="step-tool">{tool_name}</span>
-                                <span class="step-status {status_class}">{status_label}</span>
-                                {findings_badge}
-                                {risk_badge}
-                            </div>
-                            {reasoning_html}
-                            {screenshot_html}
-                        </div>
-                    </div>"#,
-                num = i + 1,
-                tool_name = html_escape(&node.tool_name),
-            ));
-        }
-
-        chain_html.push_str("</div></div>");
-    }
-
-    chain_html
-}

compliance-agent/src/pentest/report/html/cover.rs

@@ -1,69 +0,0 @@
-use super::html_escape;
-
-pub(super) fn cover(
-    target_name: &str,
-    session_id: &str,
-    date_short: &str,
-    target_url: &str,
-    requester_name: &str,
-    requester_email: &str,
-    app_screenshot_b64: Option<&str>,
-) -> String {
-    let screenshot_html = app_screenshot_b64
-        .filter(|s| !s.is_empty())
-        .map(|b64| {
-            format!(
-                r#"<div style="margin: 20px auto; max-width: 560px; border: 1px solid #cbd5e1; border-radius: 8px; overflow: hidden; box-shadow: 0 4px 12px rgba(0,0,0,0.08);">
-    <img src="data:image/png;base64,{b64}" alt="Application screenshot" style="width:100%;display:block;"/>
-</div>"#
-            )
-        })
-        .unwrap_or_default();
-    format!(
-        r##"<!-- ═══════════════ COVER PAGE ═══════════════ -->
-<div class="cover">
-    <svg class="cover-shield" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96">
-        <defs>
-            <linearGradient id="sg" x1="0%" y1="0%" x2="100%" y2="100%">
-                <stop offset="0%" stop-color="#0d2137"/>
-                <stop offset="100%" stop-color="#1a56db"/>
-            </linearGradient>
-        </defs>
-        <path d="M48 6 L22 22 L22 48 C22 66 34 80 48 86 C62 80 74 66 74 48 L74 22 Z"
-              fill="none" stroke="url(#sg)" stroke-width="3.5" stroke-linejoin="round"/>
-        <path d="M48 12 L26 26 L26 47 C26 63 36 76 48 82 C60 76 70 63 70 47 L70 26 Z"
-              fill="url(#sg)" opacity="0.07"/>
-        <circle cx="44" cy="44" r="11" fill="none" stroke="#0d2137" stroke-width="2.5"/>
-        <line x1="52" y1="52" x2="62" y2="62" stroke="#0d2137" stroke-width="2.5" stroke-linecap="round"/>
-        <path d="M39 44 L42.5 47.5 L49 41" fill="none" stroke="#166534" stroke-width="2.5"
-              stroke-linecap="round" stroke-linejoin="round"/>
-    </svg>
-
-    <div class="cover-tag">CONFIDENTIAL</div>
-
-    <div class="cover-title">Penetration Test Report</div>
-    <div class="cover-subtitle">{target_name}</div>
-
-    <div class="cover-divider"></div>
-
-    <div class="cover-meta">
-        <strong>Report ID:</strong> {session_id}<br>
-        <strong>Date:</strong> {date_short}<br>
-        <strong>Target:</strong> {target_url}<br>
-        <strong>Prepared for:</strong> {requester_name} ({requester_email})
-    </div>
-
-    {screenshot_html}
-
-    <div class="cover-footer">
-        Compliance Scanner &mdash; AI-Powered Security Assessment Platform
-    </div>
-</div>"##,
-        target_name = html_escape(target_name),
-        session_id = html_escape(session_id),
-        date_short = date_short,
-        target_url = html_escape(target_url),
-        requester_name = html_escape(requester_name),
-        requester_email = html_escape(requester_email),
-    )
-}

compliance-agent/src/pentest/report/html/executive_summary.rs

@@ -1,238 +0,0 @@
-use super::html_escape;
-use compliance_core::models::dast::DastFinding;
-
-pub(super) fn executive_summary(
-    findings: &[DastFinding],
-    target_name: &str,
-    target_url: &str,
-    tool_count: usize,
-    tool_invocations: u32,
-    success_rate: f64,
-) -> String {
-    let critical = findings
-        .iter()
-        .filter(|f| f.severity.to_string() == "critical")
-        .count();
-    let high = findings
-        .iter()
-        .filter(|f| f.severity.to_string() == "high")
-        .count();
-    let medium = findings
-        .iter()
-        .filter(|f| f.severity.to_string() == "medium")
-        .count();
-    let low = findings
-        .iter()
-        .filter(|f| f.severity.to_string() == "low")
-        .count();
-    let info = findings
-        .iter()
-        .filter(|f| f.severity.to_string() == "info")
-        .count();
-    let exploitable = findings.iter().filter(|f| f.exploitable).count();
-    let total = findings.len();
-
-    let overall_risk = if critical > 0 {
-        "CRITICAL"
-    } else if high > 0 {
-        "HIGH"
-    } else if medium > 0 {
-        "MEDIUM"
-    } else if low > 0 {
-        "LOW"
-    } else {
-        "INFORMATIONAL"
-    };
-
-    let risk_color = match overall_risk {
-        "CRITICAL" => "#991b1b",
-        "HIGH" => "#c2410c",
-        "MEDIUM" => "#a16207",
-        "LOW" => "#1d4ed8",
-        _ => "#4b5563",
-    };
-
-    let risk_score: usize =
-        std::cmp::min(100, critical * 25 + high * 15 + medium * 8 + low * 3 + info);
-
-    let severity_bar = build_severity_bar(critical, high, medium, low, info, total);
-
-    // Table of contents finding sub-entries
-    let severity_order = ["critical", "high", "medium", "low", "info"];
-    let toc_findings_sub = if !findings.is_empty() {
-        let mut sub = String::new();
-        let mut fnum = 0usize;
-        for &sev_key in severity_order.iter() {
-            let count = findings
-                .iter()
-                .filter(|f| f.severity.to_string() == sev_key)
-                .count();
-            if count == 0 {
-                continue;
-            }
-            for f in findings
-                .iter()
-                .filter(|f| f.severity.to_string() == sev_key)
-            {
-                fnum += 1;
-                sub.push_str(&format!(
-                    r#"<div class="toc-sub">F-{:03} — {}</div>"#,
-                    fnum,
-                    html_escape(&f.title),
-                ));
-            }
-        }
-        sub
-    } else {
-        String::new()
-    };
-
-    let critical_high_str = format!("{} / {}", critical, high);
-    let escaped_target_name = html_escape(target_name);
-    let escaped_target_url = html_escape(target_url);
-
-    format!(
-        r##"<!-- ═══════════════ TABLE OF CONTENTS ═══════════════ -->
-<div class="report-body">
-
-<div class="toc">
-    <h2>Table of Contents</h2>
-    <div class="toc-entry"><span class="toc-num">1</span><span class="toc-label">Executive Summary</span></div>
-    <div class="toc-entry"><span class="toc-num">2</span><span class="toc-label">Scope &amp; Methodology</span></div>
-    <div class="toc-entry"><span class="toc-num">3</span><span class="toc-label">Findings ({total_findings})</span></div>
-    {toc_findings_sub}
-    <div class="toc-entry"><span class="toc-num">4</span><span class="toc-label">Attack Chain Timeline</span></div>
-    <div class="toc-entry"><span class="toc-num">5</span><span class="toc-label">Appendix</span></div>
-</div>
-
-<!-- ═══════════════ 1. EXECUTIVE SUMMARY ═══════════════ -->
-<h2><span class="section-num">1.</span> Executive Summary</h2>
-
-<div class="risk-gauge">
-    <div class="risk-gauge-meter">
-        <div class="risk-gauge-track">
-            <div class="risk-gauge-fill" style="width: {risk_score}%; background: {risk_color};"></div>
-        </div>
-        <div class="risk-gauge-score" style="color: {risk_color};">{risk_score} / 100</div>
-    </div>
-    <div class="risk-gauge-text">
-        <div class="risk-gauge-label" style="color: {risk_color};">Overall Risk: {overall_risk}</div>
-        <div class="risk-gauge-desc">
-            Based on {total_findings} finding{findings_plural} identified across the target application.
-        </div>
-    </div>
-</div>
-
-<div class="exec-grid">
-    <div class="kpi-card">
-        <div class="kpi-value">{total_findings}</div>
-        <div class="kpi-label">Total Findings</div>
-    </div>
-    <div class="kpi-card">
-        <div class="kpi-value" style="color: var(--sev-critical);">{critical_high}</div>
-        <div class="kpi-label">Critical / High</div>
-    </div>
-    <div class="kpi-card">
-        <div class="kpi-value" style="color: var(--sev-critical);">{exploitable_count}</div>
-        <div class="kpi-label">Exploitable</div>
-    </div>
-    <div class="kpi-card">
-        <div class="kpi-value">{tool_count}</div>
-        <div class="kpi-label">Tools Used</div>
-    </div>
-</div>
-
-<h3>Severity Distribution</h3>
-{severity_bar}
-
-<p>
-    This report presents the results of an automated penetration test conducted against
-    <strong>{target_name}</strong> (<code>{target_url}</code>) using the Compliance Scanner
-    AI-powered testing engine. A total of <strong>{total_findings} vulnerabilities</strong> were
-    identified, of which <strong>{exploitable_count}</strong> were confirmed exploitable with
-    working proof-of-concept payloads. The assessment employed <strong>{tool_count} security tools</strong>
-    across <strong>{tool_invocations} invocations</strong> ({success_rate:.0}% success rate).
-</p>"##,
-        total_findings = total,
-        findings_plural = if total == 1 { "" } else { "s" },
-        critical_high = critical_high_str,
-        exploitable_count = exploitable,
-        target_name = escaped_target_name,
-        target_url = escaped_target_url,
-    )
-}
-
-fn build_severity_bar(
-    critical: usize,
-    high: usize,
-    medium: usize,
-    low: usize,
-    info: usize,
-    total: usize,
-) -> String {
-    if total == 0 {
-        return String::new();
-    }
-
-    let crit_pct = (critical as f64 / total as f64 * 100.0) as usize;
-    let high_pct = (high as f64 / total as f64 * 100.0) as usize;
-    let med_pct = (medium as f64 / total as f64 * 100.0) as usize;
-    let low_pct = (low as f64 / total as f64 * 100.0) as usize;
-    let info_pct = 100_usize.saturating_sub(crit_pct + high_pct + med_pct + low_pct);
-
-    let mut bar = String::from(r#"<div class="sev-bar">"#);
-    if critical > 0 {
-        bar.push_str(&format!(
-            r#"<div class="sev-bar-seg sev-bar-critical" style="width:{}%"><span>{}</span></div>"#,
-            std::cmp::max(crit_pct, 4),
-            critical
-        ));
-    }
-    if high > 0 {
-        bar.push_str(&format!(
-            r#"<div class="sev-bar-seg sev-bar-high" style="width:{}%"><span>{}</span></div>"#,
-            std::cmp::max(high_pct, 4),
-            high
-        ));
-    }
-    if medium > 0 {
-        bar.push_str(&format!(
-            r#"<div class="sev-bar-seg sev-bar-medium" style="width:{}%"><span>{}</span></div>"#,
-            std::cmp::max(med_pct, 4),
-            medium
-        ));
-    }
-    if low > 0 {
-        bar.push_str(&format!(
-            r#"<div class="sev-bar-seg sev-bar-low" style="width:{}%"><span>{}</span></div>"#,
-            std::cmp::max(low_pct, 4),
-            low
-        ));
-    }
-    if info > 0 {
-        bar.push_str(&format!(
-            r#"<div class="sev-bar-seg sev-bar-info" style="width:{}%"><span>{}</span></div>"#,
-            std::cmp::max(info_pct, 4),
-            info
-        ));
-    }
-    bar.push_str("</div>");
-    bar.push_str(r#"<div class="sev-bar-legend">"#);
-    if critical > 0 {
-        bar.push_str(r#"<span><i class="sev-dot" style="background:#991b1b"></i> Critical</span>"#);
-    }
-    if high > 0 {
-        bar.push_str(r#"<span><i class="sev-dot" style="background:#c2410c"></i> High</span>"#);
-    }
-    if medium > 0 {
-        bar.push_str(r#"<span><i class="sev-dot" style="background:#a16207"></i> Medium</span>"#);
-    }
-    if low > 0 {
-        bar.push_str(r#"<span><i class="sev-dot" style="background:#1d4ed8"></i> Low</span>"#);
-    }
-    if info > 0 {
-        bar.push_str(r#"<span><i class="sev-dot" style="background:#4b5563"></i> Info</span>"#);
-    }
-    bar.push_str("</div>");
-    bar
-}

compliance-agent/src/pentest/report/html/findings.rs

@@ -1,522 +0,0 @@
-use super::html_escape;
-use compliance_core::models::dast::DastFinding;
-use compliance_core::models::finding::Finding;
-use compliance_core::models::pentest::CodeContextHint;
-use compliance_core::models::sbom::SbomEntry;
-
-/// Render the findings section with code-level correlation.
-///
-/// For each DAST finding, if a linked SAST finding exists (via `linked_sast_finding_id`)
-/// or if we can match the endpoint to a code entry point, we render a "Code-Level
-/// Remediation" block showing the exact file, line, code snippet, and suggested fix.
-pub(super) fn findings(
-    findings_list: &[DastFinding],
-    sast_findings: &[Finding],
-    code_context: &[CodeContextHint],
-    sbom_entries: &[SbomEntry],
-) -> String {
-    if findings_list.is_empty() {
-        return r#"<!-- ═══════════════ 3. FINDINGS ═══════════════ -->
-<div class="page-break"></div>
-<h2><span class="section-num">3.</span> Findings</h2>
-
-<p style="color: var(--text-muted);">No vulnerabilities were identified during this assessment.</p>"#.to_string();
-    }
-
-    let severity_order = ["critical", "high", "medium", "low", "info"];
-    let severity_labels = ["Critical", "High", "Medium", "Low", "Informational"];
-    let severity_colors = ["#991b1b", "#c2410c", "#a16207", "#1d4ed8", "#4b5563"];
-
-    // Build SAST lookup by ObjectId hex string
-    let sast_by_id: std::collections::HashMap<String, &Finding> = sast_findings
-        .iter()
-        .filter_map(|f| {
-            let id = f.id.as_ref()?.to_hex();
-            Some((id, f))
-        })
-        .collect();
-
-    let mut findings_html = String::new();
-    let mut finding_num = 0usize;
-
-    for (si, &sev_key) in severity_order.iter().enumerate() {
-        let sev_findings: Vec<&DastFinding> = findings_list
-            .iter()
-            .filter(|f| f.severity.to_string() == sev_key)
-            .collect();
-        if sev_findings.is_empty() {
-            continue;
-        }
-
-        findings_html.push_str(&format!(
-            r#"<h4 class="sev-group-title" style="border-color: {color}">{label} ({count})</h4>"#,
-            color = severity_colors[si],
-            label = severity_labels[si],
-            count = sev_findings.len(),
-        ));
-
-        for f in sev_findings {
-            finding_num += 1;
-            let sev_color = severity_colors[si];
-            let exploitable_badge = if f.exploitable {
-                r#"<span class="badge badge-exploit">EXPLOITABLE</span>"#
-            } else {
-                ""
-            };
-            let cwe_cell = f
-                .cwe
-                .as_deref()
-                .map(|c| format!("<tr><td>CWE</td><td>{}</td></tr>", html_escape(c)))
-                .unwrap_or_default();
-            let param_row = f
-                .parameter
-                .as_deref()
-                .map(|p| {
-                    format!(
-                        "<tr><td>Parameter</td><td><code>{}</code></td></tr>",
-                        html_escape(p)
-                    )
-                })
-                .unwrap_or_default();
-            let remediation = f
-                .remediation
-                .as_deref()
-                .unwrap_or("Refer to industry best practices for this vulnerability class.");
-
-            let evidence_html = build_evidence_html(f);
-
-            // ── Code-level correlation ──────────────────────────────
-            let code_correlation =
-                build_code_correlation(f, &sast_by_id, code_context, sbom_entries);
-
-            findings_html.push_str(&format!(
-                r#"
-                <div class="finding" style="border-left-color: {sev_color}">
-                    <div class="finding-header">
-                        <span class="finding-id">F-{num:03}</span>
-                        <span class="finding-title">{title}</span>
-                        {exploitable_badge}
-                    </div>
-                    <table class="finding-meta">
-                        <tr><td>Type</td><td>{vuln_type}</td></tr>
-                        <tr><td>Endpoint</td><td><code>{method} {endpoint}</code></td></tr>
-                        {param_row}
-                        {cwe_cell}
-                    </table>
-                    <div class="finding-desc">{description}</div>
-                    {evidence_html}
-                    {code_correlation}
-                    <div class="remediation">
-                        <div class="remediation-label">Recommendation</div>
-                        {remediation}
-                    </div>
-                </div>
-                "#,
-                num = finding_num,
-                title = html_escape(&f.title),
-                vuln_type = f.vuln_type,
-                method = f.method,
-                endpoint = html_escape(&f.endpoint),
-                description = html_escape(&f.description),
-            ));
-        }
-    }
-
-    format!(
-        r##"<!-- ═══════════════ 3. FINDINGS ═══════════════ -->
-<div class="page-break"></div>
-<h2><span class="section-num">3.</span> Findings</h2>
-
-{findings_html}"##
-    )
-}
-
-/// Build the evidence table HTML for a finding.
-fn build_evidence_html(f: &DastFinding) -> String {
-    if f.evidence.is_empty() {
-        return String::new();
-    }
-
-    let mut eh = String::from(
-        r#"<div class="evidence-block"><div class="evidence-title">Evidence</div><table class="evidence-table"><thead><tr><th>Request</th><th>Status</th><th>Details</th></tr></thead><tbody>"#,
-    );
-    for ev in &f.evidence {
-        let payload_info = ev
-            .payload
-            .as_deref()
-            .map(|p| {
-                format!(
-                    "<br><span class=\"evidence-payload\">Payload: <code>{}</code></span>",
-                    html_escape(p)
-                )
-            })
-            .unwrap_or_default();
-        eh.push_str(&format!(
-            "<tr><td><code>{} {}</code></td><td>{}</td><td>{}{}</td></tr>",
-            html_escape(&ev.request_method),
-            html_escape(&ev.request_url),
-            ev.response_status,
-            ev.response_snippet
-                .as_deref()
-                .map(html_escape)
-                .unwrap_or_default(),
-            payload_info,
-        ));
-    }
-    eh.push_str("</tbody></table></div>");
-    eh
-}
-
-/// Build the code-level correlation block for a DAST finding.
-///
-/// Attempts correlation in priority order:
-/// 1. Direct link via `linked_sast_finding_id` → shows exact file, line, snippet, suggested fix
-/// 2. Endpoint match via code context → shows handler function, file, known SAST vulns
-/// 3. CWE/CVE match to SBOM → shows vulnerable dependency + version to upgrade
-fn build_code_correlation(
-    dast_finding: &DastFinding,
-    sast_by_id: &std::collections::HashMap<String, &Finding>,
-    code_context: &[CodeContextHint],
-    sbom_entries: &[SbomEntry],
-) -> String {
-    let mut sections: Vec<String> = Vec::new();
-
-    // 1. Direct SAST link
-    if let Some(ref sast_id) = dast_finding.linked_sast_finding_id {
-        if let Some(sast) = sast_by_id.get(sast_id) {
-            let mut s = String::new();
-            s.push_str(r#"<div class="code-correlation-item">"#);
-            s.push_str(r#"<div class="code-correlation-badge">SAST Correlation</div>"#);
-            s.push_str("<table class=\"code-meta\">");
-
-            if let Some(ref fp) = sast.file_path {
-                let line_info = sast
-                    .line_number
-                    .map(|l| format!(":{l}"))
-                    .unwrap_or_default();
-                s.push_str(&format!(
-                    "<tr><td>Location</td><td><code>{}{}</code></td></tr>",
-                    html_escape(fp),
-                    line_info,
-                ));
-            }
-            s.push_str(&format!(
-                "<tr><td>Scanner</td><td>{} &mdash; {}</td></tr>",
-                html_escape(&sast.scanner),
-                html_escape(&sast.title),
-            ));
-            if let Some(ref cwe) = sast.cwe {
-                s.push_str(&format!(
-                    "<tr><td>CWE</td><td>{}</td></tr>",
-                    html_escape(cwe)
-                ));
-            }
-            if let Some(ref rule) = sast.rule_id {
-                s.push_str(&format!(
-                    "<tr><td>Rule</td><td><code>{}</code></td></tr>",
-                    html_escape(rule)
-                ));
-            }
-            s.push_str("</table>");
-
-            // Code snippet
-            if let Some(ref snippet) = sast.code_snippet {
-                if !snippet.is_empty() {
-                    s.push_str(&format!(
-                        "<div class=\"code-snippet-block\"><div class=\"code-snippet-label\">Vulnerable Code</div><pre class=\"code-snippet\">{}</pre></div>",
-                        html_escape(snippet)
-                    ));
-                }
-            }
-
-            // Suggested fix
-            if let Some(ref fix) = sast.suggested_fix {
-                if !fix.is_empty() {
-                    s.push_str(&format!(
-                        "<div class=\"code-fix-block\"><div class=\"code-fix-label\">Suggested Fix</div><pre class=\"code-fix\">{}</pre></div>",
-                        html_escape(fix)
-                    ));
-                }
-            }
-
-            // Remediation from SAST
-            if let Some(ref rem) = sast.remediation {
-                if !rem.is_empty() {
-                    s.push_str(&format!(
-                        "<div class=\"code-remediation\">{}</div>",
-                        html_escape(rem)
-                    ));
-                }
-            }
-
-            s.push_str("</div>");
-            sections.push(s);
-        }
-    }
-
-    // 2. Endpoint match via code context
-    let endpoint_lower = dast_finding.endpoint.to_lowercase();
-    let matching_hints: Vec<&CodeContextHint> = code_context
-        .iter()
-        .filter(|hint| {
-            // Match by endpoint pattern overlap
-            let pattern_lower = hint.endpoint_pattern.to_lowercase();
-            endpoint_lower.contains(&pattern_lower)
-                || pattern_lower.contains(&endpoint_lower)
-                || hint.file_path.to_lowercase().contains(
-                    &endpoint_lower
-                        .split('/')
-                        .next_back()
-                        .unwrap_or("")
-                        .replace(".html", "")
-                        .replace(".php", ""),
-                )
-        })
-        .collect();
-
-    for hint in &matching_hints {
-        let mut s = String::new();
-        s.push_str(r#"<div class="code-correlation-item">"#);
-        s.push_str(r#"<div class="code-correlation-badge">Code Entry Point</div>"#);
-        s.push_str("<table class=\"code-meta\">");
-        s.push_str(&format!(
-            "<tr><td>Handler</td><td><code>{}</code></td></tr>",
-            html_escape(&hint.handler_function),
-        ));
-        s.push_str(&format!(
-            "<tr><td>File</td><td><code>{}</code></td></tr>",
-            html_escape(&hint.file_path),
-        ));
-        s.push_str(&format!(
-            "<tr><td>Route</td><td><code>{}</code></td></tr>",
-            html_escape(&hint.endpoint_pattern),
-        ));
-        s.push_str("</table>");
-
-        if !hint.known_vulnerabilities.is_empty() {
-            s.push_str("<div class=\"code-linked-vulns\"><strong>Known SAST issues in this file:</strong><ul>");
-            for vuln in &hint.known_vulnerabilities {
-                s.push_str(&format!("<li>{}</li>", html_escape(vuln)));
-            }
-            s.push_str("</ul></div>");
-        }
-
-        s.push_str("</div>");
-        sections.push(s);
-    }
-
-    // 3. SBOM match — if a linked SAST finding has a CVE, or we can match by CWE
-    let linked_cve = dast_finding
-        .linked_sast_finding_id
-        .as_deref()
-        .and_then(|id| sast_by_id.get(id))
-        .and_then(|f| f.cve.as_deref());
-
-    if let Some(cve_id) = linked_cve {
-        let matching_deps: Vec<&SbomEntry> = sbom_entries
-            .iter()
-            .filter(|e| e.known_vulnerabilities.iter().any(|v| v.id == cve_id))
-            .collect();
-
-        for dep in &matching_deps {
-            let mut s = String::new();
-            s.push_str(r#"<div class="code-correlation-item">"#);
-            s.push_str(r#"<div class="code-correlation-badge">Vulnerable Dependency</div>"#);
-            s.push_str("<table class=\"code-meta\">");
-            s.push_str(&format!(
-                "<tr><td>Package</td><td><code>{} {}</code> ({})</td></tr>",
-                html_escape(&dep.name),
-                html_escape(&dep.version),
-                html_escape(&dep.package_manager),
-            ));
-            let cve_ids: Vec<&str> = dep
-                .known_vulnerabilities
-                .iter()
-                .map(|v| v.id.as_str())
-                .collect();
-            s.push_str(&format!(
-                "<tr><td>CVEs</td><td>{}</td></tr>",
-                cve_ids.join(", "),
-            ));
-            if let Some(ref purl) = dep.purl {
-                s.push_str(&format!(
-                    "<tr><td>PURL</td><td><code>{}</code></td></tr>",
-                    html_escape(purl),
-                ));
-            }
-            s.push_str("</table>");
-            s.push_str(&format!(
-                "<div class=\"code-remediation\">Upgrade <code>{}</code> to the latest patched version to resolve {}.</div>",
-                html_escape(&dep.name),
-                html_escape(cve_id),
-            ));
-            s.push_str("</div>");
-            sections.push(s);
-        }
-    }
-
-    if sections.is_empty() {
-        return String::new();
-    }
-
-    format!(
-        r#"<div class="code-correlation">
-    <div class="code-correlation-title">Code-Level Remediation</div>
-    {}
-</div>"#,
-        sections.join("\n")
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::dast::{DastEvidence, DastVulnType};
-    use compliance_core::models::finding::Severity;
-    use compliance_core::models::scan::ScanType;
-
-    /// Helper: create a minimal `DastFinding`.
-    fn make_dast(title: &str, severity: Severity, endpoint: &str) -> DastFinding {
-        DastFinding::new(
-            "run1".into(),
-            "target1".into(),
-            DastVulnType::Xss,
-            title.into(),
-            "desc".into(),
-            severity,
-            endpoint.into(),
-            "GET".into(),
-        )
-    }
-
-    /// Helper: create a minimal SAST `Finding` with an ObjectId.
-    fn make_sast(title: &str) -> Finding {
-        let mut f = Finding::new(
-            "repo1".into(),
-            "fp1".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            title.into(),
-            "sast desc".into(),
-            Severity::High,
-        );
-        f.id = Some(mongodb::bson::oid::ObjectId::new());
-        f
-    }
-
-    #[test]
-    fn test_findings_empty() {
-        let result = findings(&[], &[], &[], &[]);
-        assert!(
-            result.contains("No vulnerabilities were identified"),
-            "Empty findings should contain the no-vulns message"
-        );
-    }
-
-    #[test]
-    fn test_findings_grouped_by_severity() {
-        let f_high = make_dast("High vuln", Severity::High, "/a");
-        let f_low = make_dast("Low vuln", Severity::Low, "/b");
-        let f_critical = make_dast("Crit vuln", Severity::Critical, "/c");
-
-        let result = findings(&[f_high, f_low, f_critical], &[], &[], &[]);
-
-        // All severity group headers should appear
-        assert!(
-            result.contains("Critical (1)"),
-            "should have Critical header"
-        );
-        assert!(result.contains("High (1)"), "should have High header");
-        assert!(result.contains("Low (1)"), "should have Low header");
-
-        // Critical should appear before High, High before Low
-        let crit_pos = result.find("Critical (1)");
-        let high_pos = result.find("High (1)");
-        let low_pos = result.find("Low (1)");
-        assert!(crit_pos < high_pos, "Critical should come before High");
-        assert!(high_pos < low_pos, "High should come before Low");
-    }
-
-    #[test]
-    fn test_code_correlation_sast_link() {
-        let mut sast = make_sast("SQL Injection in query");
-        sast.file_path = Some("src/db/query.rs".into());
-        sast.line_number = Some(42);
-        sast.code_snippet =
-            Some("let q = format!(\"SELECT * FROM {} WHERE id={}\", table, id);".into());
-
-        let sast_id = sast.id.as_ref().map(|oid| oid.to_hex()).unwrap_or_default();
-
-        let mut dast = make_dast("SQLi on /api/users", Severity::High, "/api/users");
-        dast.linked_sast_finding_id = Some(sast_id);
-
-        let result = findings(&[dast], &[sast], &[], &[]);
-
-        assert!(
-            result.contains("SAST Correlation"),
-            "should render SAST Correlation badge"
-        );
-        assert!(
-            result.contains("src/db/query.rs"),
-            "should contain the file path"
-        );
-        assert!(result.contains(":42"), "should contain the line number");
-        assert!(
-            result.contains("Vulnerable Code"),
-            "should render code snippet block"
-        );
-    }
-
-    #[test]
-    fn test_code_correlation_no_match() {
-        let dast = make_dast("XSS in search", Severity::Medium, "/search");
-        // No linked_sast_finding_id, no code context, no sbom
-        let result = findings(&[dast], &[], &[], &[]);
-
-        assert!(
-            !result.contains("code-correlation"),
-            "should not contain any code-correlation div"
-        );
-    }
-
-    #[test]
-    fn test_evidence_html_empty() {
-        let f = make_dast("No evidence", Severity::Low, "/x");
-        let result = build_evidence_html(&f);
-        assert!(result.is_empty(), "no evidence should yield empty string");
-    }
-
-    #[test]
-    fn test_evidence_html_with_entries() {
-        let mut f = make_dast("Has evidence", Severity::High, "/y");
-        f.evidence.push(DastEvidence {
-            request_method: "POST".into(),
-            request_url: "https://example.com/login".into(),
-            request_headers: None,
-            request_body: None,
-            response_status: 200,
-            response_headers: None,
-            response_snippet: Some("OK".into()),
-            screenshot_path: None,
-            payload: Some("<script>alert(1)</script>".into()),
-            response_time_ms: None,
-        });
-
-        let result = build_evidence_html(&f);
-
-        assert!(
-            result.contains("evidence-table"),
-            "should render the evidence table"
-        );
-        assert!(result.contains("POST"), "should contain request method");
-        assert!(
-            result.contains("https://example.com/login"),
-            "should contain request URL"
-        );
-        assert!(result.contains("200"), "should contain response status");
-        assert!(
-            result.contains("&lt;script&gt;alert(1)&lt;/script&gt;"),
-            "payload should be HTML-escaped"
-        );
-    }
-}

compliance-agent/src/pentest/report/html/mod.rs

@@ -1,518 +0,0 @@
-mod appendix;
-mod attack_chain;
-mod cover;
-mod executive_summary;
-mod findings;
-mod scope;
-mod styles;
-
-use super::ReportContext;
-
-#[allow(clippy::format_in_format_args)]
-pub(super) fn build_html_report(ctx: &ReportContext) -> String {
-    let session = &ctx.session;
-    let session_id = session
-        .id
-        .map(|oid| oid.to_hex())
-        .unwrap_or_else(|| "-".to_string());
-    let date_str = session
-        .started_at
-        .format("%B %d, %Y at %H:%M UTC")
-        .to_string();
-    let date_short = session.started_at.format("%B %d, %Y").to_string();
-    let completed_str = session
-        .completed_at
-        .map(|d| d.format("%B %d, %Y at %H:%M UTC").to_string())
-        .unwrap_or_else(|| "In Progress".to_string());
-
-    // Collect unique tool names used
-    let tool_names: Vec<String> = {
-        let mut names: Vec<String> = ctx
-            .attack_chain
-            .iter()
-            .map(|n| n.tool_name.clone())
-            .collect();
-        names.sort();
-        names.dedup();
-        names
-    };
-
-    // Find the best app screenshot for the cover page:
-    // prefer the first navigate to the target URL that has a screenshot,
-    // falling back to any navigate with a screenshot
-    let app_screenshot: Option<String> = ctx
-        .attack_chain
-        .iter()
-        .filter(|n| n.tool_name == "browser")
-        .filter_map(|n| {
-            n.tool_output
-                .as_ref()?
-                .get("screenshot_base64")?
-                .as_str()
-                .filter(|s| !s.is_empty())
-                .map(|s| s.to_string())
-        })
-        // Skip the Keycloak login page screenshots — prefer one that shows the actual app
-        .find(|_| {
-            ctx.attack_chain
-                .iter()
-                .filter(|n| n.tool_name == "browser")
-                .any(|n| {
-                    n.tool_output
-                        .as_ref()
-                        .and_then(|o| o.get("title"))
-                        .and_then(|t| t.as_str())
-                        .is_some_and(|t| t.contains("Compliance") || t.contains("Dashboard"))
-                })
-        })
-        .or_else(|| {
-            // Fallback: any screenshot
-            ctx.attack_chain
-                .iter()
-                .filter(|n| n.tool_name == "browser")
-                .filter_map(|n| {
-                    n.tool_output
-                        .as_ref()?
-                        .get("screenshot_base64")?
-                        .as_str()
-                        .filter(|s| !s.is_empty())
-                        .map(|s| s.to_string())
-                })
-                .next()
-        });
-
-    let styles_html = styles::styles();
-    let cover_html = cover::cover(
-        &ctx.target_name,
-        &session_id,
-        &date_short,
-        &ctx.target_url,
-        &ctx.requester_name,
-        &ctx.requester_email,
-        app_screenshot.as_deref(),
-    );
-    let exec_html = executive_summary::executive_summary(
-        &ctx.findings,
-        &ctx.target_name,
-        &ctx.target_url,
-        tool_names.len(),
-        session.tool_invocations,
-        session.success_rate(),
-    );
-    let scope_html = scope::scope(
-        session,
-        &ctx.target_name,
-        &ctx.target_url,
-        &date_str,
-        &completed_str,
-        &tool_names,
-        ctx.config.as_ref(),
-    );
-    let findings_html = findings::findings(
-        &ctx.findings,
-        &ctx.sast_findings,
-        &ctx.code_context,
-        &ctx.sbom_entries,
-    );
-    let chain_html = attack_chain::attack_chain(&ctx.attack_chain);
-    let appendix_html = appendix::appendix(&session_id);
-
-    format!(
-        r#"<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>Penetration Test Report — {target_name}</title>
-<link rel="preconnect" href="https://fonts.googleapis.com">
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Libre+Baskerville:ital,wght@0,400;0,700;1,400&family=Source+Sans+3:ital,wght@0,300;0,400;0,600;0,700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
-{styles_html}
-</head>
-<body>
-
-{cover_html}
-
-{exec_html}
-
-{scope_html}
-
-{findings_html}
-
-{chain_html}
-
-{appendix_html}
-"#,
-        target_name = html_escape(&ctx.target_name),
-    )
-}
-
-fn tool_category(tool_name: &str) -> &'static str {
-    let name = tool_name.to_lowercase();
-    if name.contains("nmap") || name.contains("port") {
-        return "Network Reconnaissance";
-    }
-    if name.contains("nikto") || name.contains("header") {
-        return "Web Server Analysis";
-    }
-    if name.contains("zap") || name.contains("spider") || name.contains("crawl") {
-        return "Web Application Scanning";
-    }
-    if name.contains("sqlmap") || name.contains("sqli") || name.contains("sql") {
-        return "SQL Injection Testing";
-    }
-    if name.contains("xss") || name.contains("cross-site") {
-        return "Cross-Site Scripting Testing";
-    }
-    if name.contains("dir")
-        || name.contains("brute")
-        || name.contains("fuzz")
-        || name.contains("gobuster")
-    {
-        return "Directory Enumeration";
-    }
-    if name.contains("ssl") || name.contains("tls") || name.contains("cert") {
-        return "SSL/TLS Analysis";
-    }
-    if name.contains("api") || name.contains("endpoint") {
-        return "API Security Testing";
-    }
-    if name.contains("auth") || name.contains("login") || name.contains("credential") {
-        return "Authentication Testing";
-    }
-    if name.contains("cors") {
-        return "CORS Testing";
-    }
-    if name.contains("csrf") {
-        return "CSRF Testing";
-    }
-    if name.contains("nuclei") || name.contains("template") {
-        return "Vulnerability Scanning";
-    }
-    if name.contains("whatweb") || name.contains("tech") || name.contains("wappalyzer") {
-        return "Technology Fingerprinting";
-    }
-    "Security Testing"
-}
-
-fn html_escape(s: &str) -> String {
-    s.replace('&', "&amp;")
-        .replace('<', "&lt;")
-        .replace('>', "&gt;")
-        .replace('"', "&quot;")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::dast::{DastFinding, DastVulnType};
-    use compliance_core::models::finding::Severity;
-    use compliance_core::models::pentest::{
-        AttackChainNode, AttackNodeStatus, PentestSession, PentestStrategy,
-    };
-
-    // ── html_escape ──────────────────────────────────────────────────
-
-    #[test]
-    fn html_escape_handles_ampersand() {
-        assert_eq!(html_escape("a & b"), "a &amp; b");
-    }
-
-    #[test]
-    fn html_escape_handles_angle_brackets() {
-        assert_eq!(html_escape("<script>"), "&lt;script&gt;");
-    }
-
-    #[test]
-    fn html_escape_handles_quotes() {
-        assert_eq!(html_escape(r#"key="val""#), "key=&quot;val&quot;");
-    }
-
-    #[test]
-    fn html_escape_handles_all_special_chars() {
-        assert_eq!(
-            html_escape(r#"<a href="x">&y</a>"#),
-            "&lt;a href=&quot;x&quot;&gt;&amp;y&lt;/a&gt;"
-        );
-    }
-
-    #[test]
-    fn html_escape_no_change_for_plain_text() {
-        assert_eq!(html_escape("hello world"), "hello world");
-    }
-
-    #[test]
-    fn html_escape_empty_string() {
-        assert_eq!(html_escape(""), "");
-    }
-
-    // ── tool_category ────────────────────────────────────────────────
-
-    #[test]
-    fn tool_category_nmap() {
-        assert_eq!(tool_category("nmap_scan"), "Network Reconnaissance");
-    }
-
-    #[test]
-    fn tool_category_port_scanner() {
-        assert_eq!(tool_category("port_scanner"), "Network Reconnaissance");
-    }
-
-    #[test]
-    fn tool_category_nikto() {
-        assert_eq!(tool_category("nikto"), "Web Server Analysis");
-    }
-
-    #[test]
-    fn tool_category_header_check() {
-        assert_eq!(
-            tool_category("security_header_check"),
-            "Web Server Analysis"
-        );
-    }
-
-    #[test]
-    fn tool_category_zap_spider() {
-        assert_eq!(tool_category("zap_spider"), "Web Application Scanning");
-    }
-
-    #[test]
-    fn tool_category_sqlmap() {
-        assert_eq!(tool_category("sqlmap"), "SQL Injection Testing");
-    }
-
-    #[test]
-    fn tool_category_xss_scanner() {
-        assert_eq!(tool_category("xss_scanner"), "Cross-Site Scripting Testing");
-    }
-
-    #[test]
-    fn tool_category_dir_bruteforce() {
-        assert_eq!(tool_category("dir_bruteforce"), "Directory Enumeration");
-    }
-
-    #[test]
-    fn tool_category_gobuster() {
-        assert_eq!(tool_category("gobuster"), "Directory Enumeration");
-    }
-
-    #[test]
-    fn tool_category_ssl_check() {
-        assert_eq!(tool_category("ssl_check"), "SSL/TLS Analysis");
-    }
-
-    #[test]
-    fn tool_category_tls_scan() {
-        assert_eq!(tool_category("tls_scan"), "SSL/TLS Analysis");
-    }
-
-    #[test]
-    fn tool_category_api_test() {
-        assert_eq!(tool_category("api_endpoint_test"), "API Security Testing");
-    }
-
-    #[test]
-    fn tool_category_auth_bypass() {
-        assert_eq!(tool_category("auth_bypass_check"), "Authentication Testing");
-    }
-
-    #[test]
-    fn tool_category_cors() {
-        assert_eq!(tool_category("cors_check"), "CORS Testing");
-    }
-
-    #[test]
-    fn tool_category_csrf() {
-        assert_eq!(tool_category("csrf_scanner"), "CSRF Testing");
-    }
-
-    #[test]
-    fn tool_category_nuclei() {
-        assert_eq!(tool_category("nuclei"), "Vulnerability Scanning");
-    }
-
-    #[test]
-    fn tool_category_whatweb() {
-        assert_eq!(tool_category("whatweb"), "Technology Fingerprinting");
-    }
-
-    #[test]
-    fn tool_category_unknown_defaults_to_security_testing() {
-        assert_eq!(tool_category("custom_tool"), "Security Testing");
-    }
-
-    #[test]
-    fn tool_category_is_case_insensitive() {
-        assert_eq!(tool_category("NMAP_Scanner"), "Network Reconnaissance");
-        assert_eq!(tool_category("SQLMap"), "SQL Injection Testing");
-    }
-
-    // ── build_html_report ────────────────────────────────────────────
-
-    fn make_session(strategy: PentestStrategy) -> PentestSession {
-        let mut s = PentestSession::new("target-1".into(), strategy);
-        s.tool_invocations = 5;
-        s.tool_successes = 4;
-        s.findings_count = 2;
-        s.exploitable_count = 1;
-        s
-    }
-
-    fn make_finding(severity: Severity, title: &str, exploitable: bool) -> DastFinding {
-        let mut f = DastFinding::new(
-            "run-1".into(),
-            "target-1".into(),
-            DastVulnType::Xss,
-            title.into(),
-            "description".into(),
-            severity,
-            "https://example.com/test".into(),
-            "GET".into(),
-        );
-        f.exploitable = exploitable;
-        f
-    }
-
-    fn make_attack_node(tool_name: &str) -> AttackChainNode {
-        let mut node = AttackChainNode::new(
-            "session-1".into(),
-            "node-1".into(),
-            tool_name.into(),
-            serde_json::json!({}),
-            "Testing this tool".into(),
-        );
-        node.status = AttackNodeStatus::Completed;
-        node
-    }
-
-    fn make_report_context(
-        findings: Vec<DastFinding>,
-        chain: Vec<AttackChainNode>,
-    ) -> ReportContext {
-        ReportContext {
-            session: make_session(PentestStrategy::Comprehensive),
-            target_name: "Test App".into(),
-            target_url: "https://example.com".into(),
-            findings,
-            attack_chain: chain,
-            requester_name: "Alice".into(),
-            requester_email: "alice@example.com".into(),
-            config: None,
-            sast_findings: Vec::new(),
-            sbom_entries: Vec::new(),
-            code_context: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn report_contains_target_info() {
-        let ctx = make_report_context(vec![], vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("Test App"));
-        assert!(html.contains("https://example.com"));
-    }
-
-    #[test]
-    fn report_contains_requester_info() {
-        let ctx = make_report_context(vec![], vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("Alice"));
-        assert!(html.contains("alice@example.com"));
-    }
-
-    #[test]
-    fn report_shows_informational_risk_when_no_findings() {
-        let ctx = make_report_context(vec![], vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("INFORMATIONAL"));
-    }
-
-    #[test]
-    fn report_shows_critical_risk_with_critical_finding() {
-        let findings = vec![make_finding(Severity::Critical, "Critical XSS", true)];
-        let ctx = make_report_context(findings, vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("CRITICAL"));
-    }
-
-    #[test]
-    fn report_shows_high_risk_without_critical() {
-        let findings = vec![make_finding(Severity::High, "High SQLi", false)];
-        let ctx = make_report_context(findings, vec![]);
-        let html = build_html_report(&ctx);
-        // Should show HIGH, not CRITICAL
-        assert!(html.contains("HIGH"));
-    }
-
-    #[test]
-    fn report_shows_medium_risk_level() {
-        let findings = vec![make_finding(Severity::Medium, "Medium Issue", false)];
-        let ctx = make_report_context(findings, vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("MEDIUM"));
-    }
-
-    #[test]
-    fn report_includes_finding_title() {
-        let findings = vec![make_finding(
-            Severity::High,
-            "Reflected XSS in /search",
-            true,
-        )];
-        let ctx = make_report_context(findings, vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("Reflected XSS in /search"));
-    }
-
-    #[test]
-    fn report_shows_exploitable_badge() {
-        let findings = vec![make_finding(Severity::Critical, "SQLi", true)];
-        let ctx = make_report_context(findings, vec![]);
-        let html = build_html_report(&ctx);
-        // The report should mark exploitable findings
-        assert!(html.contains("EXPLOITABLE"));
-    }
-
-    #[test]
-    fn report_includes_attack_chain_tool_names() {
-        let chain = vec![make_attack_node("nmap_scan"), make_attack_node("sqlmap")];
-        let ctx = make_report_context(vec![], chain);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("nmap_scan"));
-        assert!(html.contains("sqlmap"));
-    }
-
-    #[test]
-    fn report_is_valid_html_structure() {
-        let ctx = make_report_context(vec![], vec![]);
-        let html = build_html_report(&ctx);
-        assert!(html.contains("<!DOCTYPE html>") || html.contains("<html"));
-        assert!(html.contains("</html>"));
-    }
-
-    #[test]
-    fn report_strategy_appears() {
-        let ctx = make_report_context(vec![], vec![]);
-        let html = build_html_report(&ctx);
-        // PentestStrategy::Comprehensive => "comprehensive"
-        assert!(html.contains("comprehensive") || html.contains("Comprehensive"));
-    }
-
-    #[test]
-    fn report_finding_count_is_correct() {
-        let findings = vec![
-            make_finding(Severity::Critical, "F1", true),
-            make_finding(Severity::High, "F2", false),
-            make_finding(Severity::Low, "F3", false),
-        ];
-        let ctx = make_report_context(findings, vec![]);
-        let html = build_html_report(&ctx);
-        // The total count "3" should appear somewhere
-        assert!(
-            html.contains(">3<")
-                || html.contains(">3 ")
-                || html.contains("3 findings")
-                || html.contains("3 Total")
-        );
-    }
-}

compliance-agent/src/pentest/report/html/scope.rs

@@ -1,127 +0,0 @@
-use super::{html_escape, tool_category};
-use compliance_core::models::pentest::{AuthMode, PentestConfig, PentestSession};
-
-pub(super) fn scope(
-    session: &PentestSession,
-    target_name: &str,
-    target_url: &str,
-    date_str: &str,
-    completed_str: &str,
-    tool_names: &[String],
-    config: Option<&PentestConfig>,
-) -> String {
-    let tools_table: String = tool_names
-        .iter()
-        .enumerate()
-        .map(|(i, t)| {
-            let category = tool_category(t);
-            format!(
-                "<tr><td>{}</td><td><code>{}</code></td><td>{}</td></tr>",
-                i + 1,
-                html_escape(t),
-                category,
-            )
-        })
-        .collect::<Vec<_>>()
-        .join("\n");
-
-    let engagement_config_section = if let Some(cfg) = config {
-        let mut rows = String::new();
-        rows.push_str(&format!(
-            "<tr><td>Environment</td><td>{}</td></tr>",
-            html_escape(&cfg.environment.to_string())
-        ));
-        if let Some(ref app_type) = cfg.app_type {
-            rows.push_str(&format!(
-                "<tr><td>Application Type</td><td>{}</td></tr>",
-                html_escape(app_type)
-            ));
-        }
-        let auth_mode = match cfg.auth.mode {
-            AuthMode::None => "No authentication",
-            AuthMode::Manual => "Manual credentials",
-            AuthMode::AutoRegister => "Auto-register",
-        };
-        rows.push_str(&format!("<tr><td>Auth Mode</td><td>{auth_mode}</td></tr>"));
-        if !cfg.scope_exclusions.is_empty() {
-            let excl = cfg
-                .scope_exclusions
-                .iter()
-                .map(|s| html_escape(s))
-                .collect::<Vec<_>>()
-                .join(", ");
-            rows.push_str(&format!(
-                "<tr><td>Scope Exclusions</td><td><code>{excl}</code></td></tr>"
-            ));
-        }
-        if !cfg.tester.name.is_empty() {
-            rows.push_str(&format!(
-                "<tr><td>Tester</td><td>{} ({})</td></tr>",
-                html_escape(&cfg.tester.name),
-                html_escape(&cfg.tester.email)
-            ));
-        }
-        if let Some(ref ts) = cfg.disclaimer_accepted_at {
-            rows.push_str(&format!(
-                "<tr><td>Disclaimer Accepted</td><td>{}</td></tr>",
-                ts.format("%B %d, %Y at %H:%M UTC")
-            ));
-        }
-        if let Some(ref branch) = cfg.branch {
-            rows.push_str(&format!(
-                "<tr><td>Git Branch</td><td>{}</td></tr>",
-                html_escape(branch)
-            ));
-        }
-        if let Some(ref commit) = cfg.commit_hash {
-            rows.push_str(&format!(
-                "<tr><td>Git Commit</td><td><code>{}</code></td></tr>",
-                html_escape(commit)
-            ));
-        }
-        format!("<h3>Engagement Configuration</h3>\n<table class=\"info\">\n{rows}\n</table>")
-    } else {
-        String::new()
-    };
-
-    format!(
-        r##"
-<!-- ═══════════════ 2. SCOPE & METHODOLOGY ═══════════════ -->
-<div class="page-break"></div>
-<h2><span class="section-num">2.</span> Scope &amp; Methodology</h2>
-
-<p>
-    The assessment was performed using an AI-driven orchestrator that autonomously selects and
-    executes security testing tools based on the target's attack surface, technology stack, and
-    any available static analysis (SAST) findings and SBOM data.
-</p>
-
-<h3>Engagement Details</h3>
-<table class="info">
-    <tr><td>Target</td><td><strong>{target_name}</strong></td></tr>
-    <tr><td>URL</td><td><code>{target_url}</code></td></tr>
-    <tr><td>Strategy</td><td>{strategy}</td></tr>
-    <tr><td>Status</td><td>{status}</td></tr>
-    <tr><td>Started</td><td>{date_str}</td></tr>
-    <tr><td>Completed</td><td>{completed_str}</td></tr>
-    <tr><td>Tool Invocations</td><td>{tool_invocations} ({tool_successes} successful, {success_rate:.1}% success rate)</td></tr>
-</table>
-
-{engagement_config_section}
-
-<h3>Tools Employed</h3>
-<table class="tools-table">
-    <thead><tr><th>#</th><th>Tool</th><th>Category</th></tr></thead>
-    <tbody>{tools_table}</tbody>
-</table>"##,
-        target_name = html_escape(target_name),
-        target_url = html_escape(target_url),
-        strategy = session.strategy,
-        status = session.status,
-        date_str = date_str,
-        completed_str = completed_str,
-        tool_invocations = session.tool_invocations,
-        tool_successes = session.tool_successes,
-        success_rate = session.success_rate(),
-    )
-}

compliance-agent/src/pentest/report/html/styles.rs

@@ -1,889 +0,0 @@
-pub(super) fn styles() -> String {
-    r##"<style>
-/* ──────────────── Base / Print-first ──────────────── */
-@page {
-    size: A4;
-    margin: 20mm 18mm 25mm 18mm;
-}
-@page :first {
-    margin: 0;
-}
-
-*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
-
-:root {
-    --text: #1a1a2e;
-    --text-secondary: #475569;
-    --text-muted: #64748b;
-    --heading: #0d2137;
-    --accent: #1a56db;
-    --accent-light: #dbeafe;
-    --border: #d1d5db;
-    --border-light: #e5e7eb;
-    --bg-subtle: #f8fafc;
-    --bg-section: #f1f5f9;
-    --sev-critical: #991b1b;
-    --sev-high: #c2410c;
-    --sev-medium: #a16207;
-    --sev-low: #1d4ed8;
-    --sev-info: #4b5563;
-    --font-serif: 'Libre Baskerville', 'Georgia', serif;
-    --font-sans: 'Source Sans 3', 'Helvetica Neue', sans-serif;
-    --font-mono: 'JetBrains Mono', 'Consolas', monospace;
-}
-
-body {
-    font-family: var(--font-sans);
-    color: var(--text);
-    background: #fff;
-    line-height: 1.65;
-    font-size: 10.5pt;
-    -webkit-print-color-adjust: exact;
-    print-color-adjust: exact;
-}
-
-.report-body {
-    max-width: 190mm;
-    margin: 0 auto;
-    padding: 0 16px;
-}
-
-/* ──────────────── Cover Page ──────────────── */
-.cover {
-    height: 100vh;
-    min-height: 297mm;
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-    align-items: center;
-    text-align: center;
-    padding: 40mm 30mm;
-    page-break-after: always;
-    break-after: page;
-    position: relative;
-    background: #fff;
-}
-
-.cover-shield {
-    width: 72px;
-    height: 72px;
-    margin-bottom: 32px;
-}
-
-.cover-tag {
-    display: inline-block;
-    background: var(--sev-critical);
-    color: #fff;
-    font-family: var(--font-sans);
-    font-size: 8pt;
-    font-weight: 700;
-    letter-spacing: 0.15em;
-    text-transform: uppercase;
-    padding: 4px 16px;
-    border-radius: 2px;
-    margin-bottom: 28px;
-}
-
-.cover-title {
-    font-family: var(--font-serif);
-    font-size: 28pt;
-    font-weight: 700;
-    color: var(--heading);
-    line-height: 1.2;
-    margin-bottom: 8px;
-}
-
-.cover-subtitle {
-    font-family: var(--font-serif);
-    font-size: 14pt;
-    color: var(--text-secondary);
-    font-weight: 400;
-    font-style: italic;
-    margin-bottom: 48px;
-}
-
-.cover-meta {
-    font-size: 10pt;
-    color: var(--text-secondary);
-    line-height: 2;
-}
-
-.cover-meta strong {
-    color: var(--text);
-}
-
-.cover-divider {
-    width: 60px;
-    height: 2px;
-    background: var(--accent);
-    margin: 24px auto;
-}
-
-.cover-footer {
-    position: absolute;
-    bottom: 30mm;
-    left: 0;
-    right: 0;
-    text-align: center;
-    font-size: 8pt;
-    color: var(--text-muted);
-    letter-spacing: 0.05em;
-}
-
-/* ──────────────── Typography ──────────────── */
-h2 {
-    font-family: var(--font-serif);
-    font-size: 16pt;
-    font-weight: 700;
-    color: var(--heading);
-    margin: 36px 0 16px;
-    padding-bottom: 8px;
-    border-bottom: 2px solid var(--heading);
-    page-break-after: avoid;
-    break-after: avoid;
-}
-
-h3 {
-    font-family: var(--font-serif);
-    font-size: 12pt;
-    font-weight: 700;
-    color: var(--heading);
-    margin: 24px 0 10px;
-    page-break-after: avoid;
-    break-after: avoid;
-}
-
-h4 {
-    font-family: var(--font-sans);
-    font-size: 10pt;
-    font-weight: 700;
-    color: var(--text-secondary);
-    margin: 16px 0 8px;
-}
-
-p {
-    margin: 8px 0;
-    font-size: 10.5pt;
-}
-
-code {
-    font-family: var(--font-mono);
-    font-size: 9pt;
-    background: var(--bg-section);
-    padding: 1px 5px;
-    border-radius: 3px;
-    border: 1px solid var(--border-light);
-    word-break: break-all;
-}
-
-/* ──────────────── Section Numbers ──────────────── */
-.section-num {
-    color: var(--accent);
-    margin-right: 8px;
-}
-
-/* ──────────────── Table of Contents ──────────────── */
-.toc {
-    page-break-after: always;
-    break-after: page;
-    padding-top: 24px;
-}
-
-.toc h2 {
-    border-bottom-color: var(--accent);
-    margin-top: 0;
-}
-
-.toc-entry {
-    display: flex;
-    justify-content: space-between;
-    align-items: baseline;
-    padding: 6px 0;
-    border-bottom: 1px dotted var(--border);
-    font-size: 11pt;
-}
-
-.toc-entry .toc-num {
-    font-weight: 700;
-    color: var(--accent);
-    min-width: 24px;
-    margin-right: 10px;
-}
-
-.toc-entry .toc-label {
-    flex: 1;
-    font-weight: 600;
-    color: var(--heading);
-}
-
-.toc-sub {
-    padding: 3px 0 3px 34px;
-    font-size: 9.5pt;
-    color: var(--text-secondary);
-}
-
-/* ──────────────── Executive Summary ──────────────── */
-.exec-grid {
-    display: grid;
-    grid-template-columns: 1fr 1fr 1fr 1fr;
-    gap: 12px;
-    margin: 16px 0 20px;
-}
-
-.kpi-card {
-    border: 1px solid var(--border);
-    border-radius: 6px;
-    padding: 14px 12px;
-    text-align: center;
-    background: var(--bg-subtle);
-}
-
-.kpi-value {
-    font-family: var(--font-serif);
-    font-size: 22pt;
-    font-weight: 700;
-    line-height: 1.1;
-}
-
-.kpi-label {
-    font-size: 8pt;
-    text-transform: uppercase;
-    letter-spacing: 0.08em;
-    color: var(--text-muted);
-    margin-top: 4px;
-    font-weight: 600;
-}
-
-/* Risk gauge */
-.risk-gauge {
-    display: flex;
-    align-items: center;
-    gap: 16px;
-    padding: 16px 20px;
-    border: 1px solid var(--border);
-    border-radius: 6px;
-    background: var(--bg-subtle);
-    margin: 16px 0;
-}
-
-.risk-gauge-meter {
-    width: 140px;
-    flex-shrink: 0;
-}
-
-.risk-gauge-track {
-    height: 10px;
-    background: var(--border-light);
-    border-radius: 5px;
-    overflow: hidden;
-    position: relative;
-}
-
-.risk-gauge-fill {
-    height: 100%;
-    border-radius: 5px;
-    transition: width 0.3s;
-}
-
-.risk-gauge-score {
-    font-family: var(--font-serif);
-    font-size: 9pt;
-    font-weight: 700;
-    text-align: center;
-    margin-top: 3px;
-}
-
-.risk-gauge-text {
-    flex: 1;
-}
-
-.risk-gauge-label {
-    font-family: var(--font-serif);
-    font-size: 14pt;
-    font-weight: 700;
-}
-
-.risk-gauge-desc {
-    font-size: 9.5pt;
-    color: var(--text-secondary);
-    margin-top: 2px;
-}
-
-/* Severity bar */
-.sev-bar {
-    display: flex;
-    height: 28px;
-    border-radius: 4px;
-    overflow: hidden;
-    margin: 12px 0 6px;
-    border: 1px solid var(--border);
-}
-
-.sev-bar-seg {
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    color: #fff;
-    font-size: 8.5pt;
-    font-weight: 700;
-    min-width: 24px;
-}
-
-.sev-bar-critical { background: var(--sev-critical); }
-.sev-bar-high { background: var(--sev-high); }
-.sev-bar-medium { background: var(--sev-medium); }
-.sev-bar-low { background: var(--sev-low); }
-.sev-bar-info { background: var(--sev-info); }
-
-.sev-bar-legend {
-    display: flex;
-    gap: 16px;
-    font-size: 8.5pt;
-    color: var(--text-secondary);
-    margin-bottom: 16px;
-}
-
-.sev-dot {
-    display: inline-block;
-    width: 8px;
-    height: 8px;
-    border-radius: 2px;
-    margin-right: 4px;
-    vertical-align: middle;
-}
-
-/* ──────────────── Info Tables ──────────────── */
-table.info {
-    width: 100%;
-    border-collapse: collapse;
-    margin: 10px 0;
-    font-size: 10pt;
-}
-
-table.info td,
-table.info th {
-    padding: 7px 12px;
-    border: 1px solid var(--border);
-    text-align: left;
-    vertical-align: top;
-}
-
-table.info td:first-child,
-table.info th:first-child {
-    width: 160px;
-    font-weight: 600;
-    color: var(--text-secondary);
-    background: var(--bg-subtle);
-}
-
-/* Methodology tools table */
-table.tools-table {
-    width: 100%;
-    border-collapse: collapse;
-    margin: 10px 0;
-    font-size: 10pt;
-}
-
-table.tools-table th {
-    background: var(--heading);
-    color: #fff;
-    padding: 8px 12px;
-    text-align: left;
-    font-weight: 600;
-    font-size: 9pt;
-    text-transform: uppercase;
-    letter-spacing: 0.04em;
-}
-
-table.tools-table td {
-    padding: 6px 12px;
-    border-bottom: 1px solid var(--border-light);
-}
-
-table.tools-table tr:nth-child(even) td {
-    background: var(--bg-subtle);
-}
-
-table.tools-table td:first-child {
-    width: 32px;
-    text-align: center;
-    color: var(--text-muted);
-    font-weight: 600;
-}
-
-/* ──────────────── Badges ──────────────── */
-.badge {
-    display: inline-block;
-    padding: 2px 8px;
-    border-radius: 3px;
-    font-size: 7.5pt;
-    font-weight: 700;
-    text-transform: uppercase;
-    letter-spacing: 0.03em;
-    vertical-align: middle;
-}
-
-.badge-exploit {
-    background: var(--sev-critical);
-    color: #fff;
-}
-
-/* ──────────────── Findings ──────────────── */
-.sev-group-title {
-    font-family: var(--font-sans);
-    font-size: 11pt;
-    font-weight: 700;
-    color: var(--heading);
-    padding: 8px 0 6px 12px;
-    margin: 20px 0 8px;
-    border-left: 4px solid;
-    page-break-after: avoid;
-    break-after: avoid;
-}
-
-.finding {
-    border: 1px solid var(--border);
-    border-left: 4px solid;
-    border-radius: 0 4px 4px 0;
-    padding: 14px 16px;
-    margin-bottom: 12px;
-    background: #fff;
-    page-break-inside: avoid;
-    break-inside: avoid;
-}
-
-.finding-header {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    margin-bottom: 8px;
-}
-
-.finding-id {
-    font-family: var(--font-mono);
-    font-size: 9pt;
-    font-weight: 500;
-    color: var(--text-muted);
-    background: var(--bg-section);
-    padding: 2px 6px;
-    border-radius: 3px;
-    border: 1px solid var(--border-light);
-}
-
-.finding-title {
-    font-family: var(--font-serif);
-    font-weight: 700;
-    font-size: 11pt;
-    flex: 1;
-    color: var(--heading);
-}
-
-.finding-meta {
-    border-collapse: collapse;
-    margin: 6px 0;
-    font-size: 9.5pt;
-    width: 100%;
-}
-
-.finding-meta td {
-    padding: 3px 10px 3px 0;
-    vertical-align: top;
-}
-
-.finding-meta td:first-child {
-    color: var(--text-muted);
-    font-weight: 600;
-    width: 90px;
-    white-space: nowrap;
-}
-
-.finding-desc {
-    margin: 8px 0;
-    font-size: 10pt;
-    color: var(--text);
-    line-height: 1.6;
-}
-
-.remediation {
-    margin-top: 10px;
-    padding: 10px 14px;
-    background: var(--accent-light);
-    border-left: 3px solid var(--accent);
-    border-radius: 0 4px 4px 0;
-    font-size: 9.5pt;
-    line-height: 1.55;
-}
-
-.remediation-label {
-    font-weight: 700;
-    font-size: 8.5pt;
-    text-transform: uppercase;
-    letter-spacing: 0.06em;
-    color: var(--accent);
-    margin-bottom: 3px;
-}
-
-.evidence-block {
-    margin: 10px 0;
-    page-break-inside: avoid;
-    break-inside: avoid;
-}
-
-.evidence-title {
-    font-weight: 700;
-    font-size: 8.5pt;
-    text-transform: uppercase;
-    letter-spacing: 0.06em;
-    color: var(--text-muted);
-    margin-bottom: 4px;
-}
-
-.evidence-table {
-    width: 100%;
-    border-collapse: collapse;
-    font-size: 9pt;
-}
-
-.evidence-table th {
-    background: var(--bg-section);
-    padding: 5px 8px;
-    text-align: left;
-    font-weight: 600;
-    font-size: 8.5pt;
-    text-transform: uppercase;
-    letter-spacing: 0.03em;
-    color: var(--text-secondary);
-    border: 1px solid var(--border-light);
-}
-
-.evidence-table td {
-    padding: 5px 8px;
-    border: 1px solid var(--border-light);
-    vertical-align: top;
-    word-break: break-word;
-}
-
-.evidence-payload {
-    font-size: 8.5pt;
-    color: var(--sev-critical);
-}
-
-.linked-sast {
-    font-size: 9pt;
-    color: var(--text-muted);
-    margin: 6px 0;
-    font-style: italic;
-}
-
-/* ──────────────── Code-Level Correlation ──────────────── */
-.code-correlation {
-    margin: 12px 0;
-    border: 1px solid #e2e8f0;
-    border-radius: 6px;
-    overflow: hidden;
-}
-.code-correlation-title {
-    background: #1e293b;
-    color: #f8fafc;
-    padding: 6px 12px;
-    font-size: 9pt;
-    font-weight: 700;
-    text-transform: uppercase;
-    letter-spacing: 0.05em;
-}
-.code-correlation-item {
-    padding: 10px 12px;
-    border-bottom: 1px solid #e2e8f0;
-}
-.code-correlation-item:last-child { border-bottom: none; }
-.code-correlation-badge {
-    display: inline-block;
-    background: #3b82f6;
-    color: #fff;
-    font-size: 7pt;
-    font-weight: 600;
-    padding: 2px 8px;
-    border-radius: 3px;
-    text-transform: uppercase;
-    letter-spacing: 0.04em;
-    margin-bottom: 6px;
-}
-.code-meta {
-    width: 100%;
-    font-size: 8.5pt;
-    border-collapse: collapse;
-    margin-bottom: 6px;
-}
-.code-meta td:first-child {
-    width: 80px;
-    font-weight: 600;
-    color: var(--text-muted);
-    padding: 2px 8px 2px 0;
-    vertical-align: top;
-}
-.code-meta td:last-child {
-    padding: 2px 0;
-}
-.code-snippet-block, .code-fix-block {
-    margin: 6px 0;
-}
-.code-snippet-label, .code-fix-label {
-    font-size: 7.5pt;
-    font-weight: 700;
-    text-transform: uppercase;
-    letter-spacing: 0.04em;
-    color: var(--text-muted);
-    margin-bottom: 3px;
-}
-.code-snippet-label { color: #dc2626; }
-.code-fix-label { color: #16a34a; }
-.code-snippet {
-    background: #fef2f2;
-    border: 1px solid #fecaca;
-    border-left: 3px solid #dc2626;
-    padding: 8px 10px;
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 8pt;
-    line-height: 1.5;
-    white-space: pre-wrap;
-    word-break: break-word;
-    border-radius: 0 4px 4px 0;
-    margin: 0;
-}
-.code-fix {
-    background: #f0fdf4;
-    border: 1px solid #bbf7d0;
-    border-left: 3px solid #16a34a;
-    padding: 8px 10px;
-    font-family: 'JetBrains Mono', monospace;
-    font-size: 8pt;
-    line-height: 1.5;
-    white-space: pre-wrap;
-    word-break: break-word;
-    border-radius: 0 4px 4px 0;
-    margin: 0;
-}
-.code-remediation {
-    font-size: 8.5pt;
-    color: var(--text-secondary);
-    margin-top: 4px;
-    padding: 4px 0;
-}
-.code-linked-vulns {
-    font-size: 8.5pt;
-    margin-top: 4px;
-}
-.code-linked-vulns ul {
-    margin: 2px 0 0 16px;
-    padding: 0;
-}
-.code-linked-vulns li {
-    margin-bottom: 2px;
-}
-
-/* ──────────────── Attack Chain ──────────────── */
-.phase-block {
-    margin-bottom: 20px;
-    page-break-inside: avoid;
-    break-inside: avoid;
-}
-
-.phase-header {
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    padding: 8px 14px;
-    background: var(--heading);
-    color: #fff;
-    border-radius: 4px 4px 0 0;
-    font-size: 9.5pt;
-}
-
-.phase-num {
-    font-weight: 700;
-    font-size: 8pt;
-    text-transform: uppercase;
-    letter-spacing: 0.1em;
-    background: rgba(255,255,255,0.15);
-    padding: 2px 8px;
-    border-radius: 3px;
-}
-
-.phase-label {
-    font-weight: 600;
-    flex: 1;
-}
-
-.phase-count {
-    font-size: 8.5pt;
-    opacity: 0.7;
-}
-
-.phase-steps {
-    border: 1px solid var(--border);
-    border-top: none;
-    border-radius: 0 0 4px 4px;
-}
-
-.step-row {
-    display: flex;
-    align-items: flex-start;
-    gap: 10px;
-    padding: 8px 14px;
-    border-bottom: 1px solid var(--border-light);
-    position: relative;
-}
-
-.step-row:last-child {
-    border-bottom: none;
-}
-
-.step-num {
-    width: 22px;
-    height: 22px;
-    border-radius: 50%;
-    background: var(--bg-section);
-    border: 1px solid var(--border);
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    font-size: 8pt;
-    font-weight: 700;
-    color: var(--text-secondary);
-    flex-shrink: 0;
-    margin-top: 1px;
-}
-
-.step-connector {
-    display: none;
-}
-
-.step-content {
-    flex: 1;
-    min-width: 0;
-}
-
-.step-header {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-    flex-wrap: wrap;
-}
-
-.step-tool {
-    font-family: var(--font-mono);
-    font-size: 9.5pt;
-    font-weight: 500;
-    color: var(--heading);
-}
-
-.step-status {
-    font-size: 7.5pt;
-    font-weight: 700;
-    text-transform: uppercase;
-    letter-spacing: 0.04em;
-    padding: 1px 7px;
-    border-radius: 3px;
-}
-
-.step-completed { background: #dcfce7; color: #166534; }
-.step-failed { background: #fef2f2; color: #991b1b; }
-.step-running { background: #fef9c3; color: #854d0e; }
-
-.step-findings {
-    font-size: 8pt;
-    font-weight: 600;
-    color: var(--sev-high);
-    background: #fff7ed;
-    padding: 1px 7px;
-    border-radius: 3px;
-    border: 1px solid #fed7aa;
-}
-
-.step-risk {
-    font-size: 7.5pt;
-    font-weight: 700;
-    padding: 1px 6px;
-    border-radius: 3px;
-}
-
-.risk-high { background: #fef2f2; color: var(--sev-critical); border: 1px solid #fecaca; }
-.risk-med { background: #fffbeb; color: var(--sev-medium); border: 1px solid #fde68a; }
-.risk-low { background: #f0fdf4; color: #166534; border: 1px solid #bbf7d0; }
-
-.step-reasoning {
-    font-size: 9pt;
-    color: var(--text-muted);
-    margin-top: 3px;
-    line-height: 1.5;
-    font-style: italic;
-}
-
-/* ──────────────── Footer ──────────────── */
-.report-footer {
-    margin-top: 48px;
-    padding-top: 14px;
-    border-top: 2px solid var(--heading);
-    font-size: 8pt;
-    color: var(--text-muted);
-    text-align: center;
-    line-height: 1.8;
-}
-
-.report-footer .footer-company {
-    font-weight: 700;
-    color: var(--text-secondary);
-}
-
-/* ──────────────── Page Break Utilities ──────────────── */
-.page-break {
-    page-break-before: always;
-    break-before: page;
-}
-
-.avoid-break {
-    page-break-inside: avoid;
-    break-inside: avoid;
-}
-
-/* ──────────────── Print Overrides ──────────────── */
-@media print {
-    body {
-        font-size: 10pt;
-    }
-    .cover {
-        height: auto;
-        min-height: 250mm;
-        padding: 50mm 20mm;
-    }
-    .report-body {
-        padding: 0;
-    }
-    .no-print {
-        display: none !important;
-    }
-    a {
-        color: var(--accent);
-        text-decoration: none;
-    }
-}
-
-/* ──────────────── Screen Enhancements ──────────────── */
-@media screen {
-    body {
-        background: #e2e8f0;
-    }
-    .cover {
-        background: #fff;
-        box-shadow: 0 1px 4px rgba(0,0,0,0.08);
-    }
-    .report-body {
-        background: #fff;
-        padding: 20px 32px 40px;
-        box-shadow: 0 1px 4px rgba(0,0,0,0.08);
-        margin-bottom: 40px;
-    }
-}
-</style>"##
-        .to_string()
-}

compliance-agent/src/pentest/report/mod.rs

@@ -1,69 +0,0 @@
-mod archive;
-mod html;
-mod pdf;
-
-use compliance_core::models::dast::DastFinding;
-use compliance_core::models::finding::Finding;
-use compliance_core::models::pentest::{
-    AttackChainNode, CodeContextHint, PentestConfig, PentestSession,
-};
-use compliance_core::models::sbom::SbomEntry;
-use sha2::{Digest, Sha256};
-
-/// Report archive with metadata
-pub struct ReportArchive {
-    /// The password-protected ZIP bytes
-    pub archive: Vec<u8>,
-    /// SHA-256 hex digest of the archive
-    pub sha256: String,
-}
-
-/// Report context gathered from the database
-pub struct ReportContext {
-    pub session: PentestSession,
-    pub target_name: String,
-    pub target_url: String,
-    pub findings: Vec<DastFinding>,
-    pub attack_chain: Vec<AttackChainNode>,
-    pub requester_name: String,
-    pub requester_email: String,
-    pub config: Option<PentestConfig>,
-    /// SAST findings for the linked repository (for code-level correlation)
-    pub sast_findings: Vec<Finding>,
-    /// Vulnerable dependencies from SBOM
-    pub sbom_entries: Vec<SbomEntry>,
-    /// Code knowledge graph entry points linked to SAST findings
-    pub code_context: Vec<CodeContextHint>,
-}
-
-/// Generate a password-protected ZIP archive containing the pentest report.
-///
-/// The archive contains:
-/// - `report.pdf` — Professional pentest report (PDF)
-/// - `report.html` — HTML source (fallback)
-/// - `findings.json` — Raw findings data
-/// - `attack-chain.json` — Attack chain timeline
-///
-/// Files are encrypted with AES-256 inside the ZIP (standard WinZip AES format,
-/// supported by 7-Zip, WinRAR, macOS Archive Utility, etc.).
-pub async fn generate_encrypted_report(
-    ctx: &ReportContext,
-    password: &str,
-) -> Result<ReportArchive, String> {
-    let html = html::build_html_report(ctx);
-
-    // Convert HTML to PDF via headless Chrome
-    let pdf_bytes = pdf::html_to_pdf(&html).await?;
-
-    let zip_bytes = archive::build_zip(ctx, password, &html, &pdf_bytes)
-        .map_err(|e| format!("Failed to create archive: {e}"))?;
-
-    let mut hasher = Sha256::new();
-    hasher.update(&zip_bytes);
-    let sha256 = hex::encode(hasher.finalize());
-
-    Ok(ReportArchive {
-        archive: zip_bytes,
-        sha256,
-    })
-}

compliance-agent/src/pentest/report/pdf.rs

@@ -1,289 +0,0 @@
-use futures_util::SinkExt;
-use tokio_tungstenite::tungstenite::Message;
-
-type WsStream =
-    tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>;
-
-/// Convert HTML string to PDF bytes.
-///
-/// If `CHROME_WS_URL` is set (e.g. `ws://host:3000`), connects to a remote
-/// headless Chrome via the Chrome DevTools Protocol over WebSocket.
-/// Otherwise falls back to a local Chrome/Chromium binary.
-pub(super) async fn html_to_pdf(html: &str) -> Result<Vec<u8>, String> {
-    if let Ok(ws_url) = std::env::var("CHROME_WS_URL") {
-        tracing::info!(url = %ws_url, "Generating PDF via remote Chrome (CDP)");
-        cdp_print_to_pdf(&ws_url, html).await
-    } else {
-        tracing::info!("Generating PDF via local Chrome binary");
-        local_chrome_pdf(html).await
-    }
-}
-
-/// Send a CDP command (no session) and return the response.
-async fn cdp_send(
-    ws: &mut WsStream,
-    id: u64,
-    method: &str,
-    params: serde_json::Value,
-) -> Result<serde_json::Value, String> {
-    let msg = serde_json::json!({ "id": id, "method": method, "params": params });
-    ws.send(Message::Text(msg.to_string().into()))
-        .await
-        .map_err(|e| format!("WS send failed: {e}"))?;
-    read_until_result(ws, id).await
-}
-
-/// Send a CDP command on a session and return the response.
-async fn cdp_send_session(
-    ws: &mut WsStream,
-    id: u64,
-    session_id: &str,
-    method: &str,
-    params: serde_json::Value,
-) -> Result<serde_json::Value, String> {
-    let msg = serde_json::json!({
-        "id": id,
-        "sessionId": session_id,
-        "method": method,
-        "params": params,
-    });
-    ws.send(Message::Text(msg.to_string().into()))
-        .await
-        .map_err(|e| format!("WS send failed: {e}"))?;
-    read_until_result(ws, id).await
-}
-
-/// Generate PDF by connecting to a remote Chrome instance over CDP WebSocket.
-async fn cdp_print_to_pdf(base_ws_url: &str, html: &str) -> Result<Vec<u8>, String> {
-    use base64::Engine;
-
-    // Step 1: Discover browser WS endpoint via /json/version
-    let http_url = base_ws_url
-        .replace("ws://", "http://")
-        .replace("wss://", "https://");
-    let version_url = format!("{http_url}/json/version");
-
-    let version: serde_json::Value = reqwest::get(&version_url)
-        .await
-        .map_err(|e| format!("Failed to reach Chrome at {version_url}: {e}"))?
-        .json()
-        .await
-        .map_err(|e| format!("Invalid /json/version response: {e}"))?;
-
-    let browser_ws = version["webSocketDebuggerUrl"]
-        .as_str()
-        .ok_or_else(|| "No webSocketDebuggerUrl in /json/version".to_string())?;
-
-    // Step 2: Connect to browser WS endpoint
-    let (mut ws, _) = tokio_tungstenite::connect_async(browser_ws)
-        .await
-        .map_err(|e| format!("WebSocket connect failed: {e}"))?;
-
-    let mut id: u64 = 1;
-
-    // Step 3: Create a new target (tab)
-    let resp = cdp_send(
-        &mut ws,
-        id,
-        "Target.createTarget",
-        serde_json::json!({ "url": "about:blank" }),
-    )
-    .await?;
-    id += 1;
-
-    let target_id = resp
-        .get("result")
-        .and_then(|r| r.get("targetId"))
-        .and_then(|t| t.as_str())
-        .ok_or("No targetId in createTarget response")?
-        .to_string();
-
-    // Step 4: Attach to target
-    let resp = cdp_send(
-        &mut ws,
-        id,
-        "Target.attachToTarget",
-        serde_json::json!({ "targetId": target_id, "flatten": true }),
-    )
-    .await?;
-    id += 1;
-
-    let session_id = resp
-        .get("result")
-        .and_then(|r| r.get("sessionId"))
-        .and_then(|s| s.as_str())
-        .ok_or("No sessionId in attachToTarget response")?
-        .to_string();
-
-    // Step 5: Enable Page domain
-    cdp_send_session(
-        &mut ws,
-        id,
-        &session_id,
-        "Page.enable",
-        serde_json::json!({}),
-    )
-    .await?;
-    id += 1;
-
-    // Step 6: Set page content with the HTML
-    cdp_send_session(
-        &mut ws,
-        id,
-        &session_id,
-        "Page.setDocumentContent",
-        serde_json::json!({ "frameId": target_id, "html": html }),
-    )
-    .await?;
-    id += 1;
-
-    // Brief pause for rendering
-    tokio::time::sleep(std::time::Duration::from_millis(500)).await;
-
-    // Step 7: Print to PDF
-    let pdf_response = cdp_send_session(
-        &mut ws,
-        id,
-        &session_id,
-        "Page.printToPDF",
-        serde_json::json!({
-            "printBackground": true,
-            "preferCSSPageSize": true,
-            "displayHeaderFooter": false,
-        }),
-    )
-    .await?;
-    id += 1;
-
-    let pdf_b64 = pdf_response
-        .get("result")
-        .and_then(|r| r.get("data"))
-        .and_then(|d| d.as_str())
-        .ok_or("No PDF data in printToPDF response")?;
-
-    let pdf_bytes = base64::engine::general_purpose::STANDARD
-        .decode(pdf_b64)
-        .map_err(|e| format!("Failed to decode PDF base64: {e}"))?;
-
-    // Step 8: Close the target
-    let _ = cdp_send(
-        &mut ws,
-        id,
-        "Target.closeTarget",
-        serde_json::json!({ "targetId": target_id }),
-    )
-    .await;
-
-    let _ = ws.close(None).await;
-
-    if pdf_bytes.is_empty() {
-        return Err("Chrome produced an empty PDF".to_string());
-    }
-
-    tracing::info!(
-        size_kb = pdf_bytes.len() / 1024,
-        "PDF report generated via CDP"
-    );
-    Ok(pdf_bytes)
-}
-
-/// Read WebSocket messages until we get a response matching the given id.
-async fn read_until_result(ws: &mut WsStream, id: u64) -> Result<serde_json::Value, String> {
-    use futures_util::StreamExt;
-
-    let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(30);
-    loop {
-        let msg = tokio::time::timeout_at(deadline, ws.next())
-            .await
-            .map_err(|_| format!("Timeout waiting for CDP response id={id}"))?
-            .ok_or_else(|| "WebSocket closed unexpectedly".to_string())?
-            .map_err(|e| format!("WebSocket read error: {e}"))?;
-
-        if let Message::Text(text) = msg {
-            if let Ok(val) = serde_json::from_str::<serde_json::Value>(&text) {
-                if val.get("id").and_then(|i| i.as_u64()) == Some(id) {
-                    if let Some(err) = val.get("error") {
-                        return Err(format!("CDP error: {err}"));
-                    }
-                    return Ok(val);
-                }
-            }
-        }
-    }
-}
-
-/// Fallback: generate PDF using a local Chrome/Chromium binary.
-async fn local_chrome_pdf(html: &str) -> Result<Vec<u8>, String> {
-    let tmp_dir = std::env::temp_dir();
-    let run_id = uuid::Uuid::new_v4().to_string();
-    let html_path = tmp_dir.join(format!("pentest-report-{run_id}.html"));
-    let pdf_path = tmp_dir.join(format!("pentest-report-{run_id}.pdf"));
-
-    std::fs::write(&html_path, html).map_err(|e| format!("Failed to write temp HTML: {e}"))?;
-
-    let chrome_bin = find_chrome_binary().ok_or_else(|| {
-        "Chrome/Chromium not found. Set CHROME_WS_URL for remote Chrome or install chromium locally."
-            .to_string()
-    })?;
-
-    tracing::info!(chrome = %chrome_bin, "Generating PDF report via headless Chrome");
-
-    let html_url = format!("file://{}", html_path.display());
-
-    let output = tokio::process::Command::new(&chrome_bin)
-        .args([
-            "--headless",
-            "--disable-gpu",
-            "--no-sandbox",
-            "--disable-software-rasterizer",
-            "--run-all-compositor-stages-before-draw",
-            "--disable-dev-shm-usage",
-            &format!("--print-to-pdf={}", pdf_path.display()),
-            "--no-pdf-header-footer",
-            &html_url,
-        ])
-        .output()
-        .await
-        .map_err(|e| format!("Failed to run Chrome: {e}"))?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        let _ = std::fs::remove_file(&html_path);
-        let _ = std::fs::remove_file(&pdf_path);
-        return Err(format!("Chrome PDF generation failed: {stderr}"));
-    }
-
-    let pdf_bytes =
-        std::fs::read(&pdf_path).map_err(|e| format!("Failed to read generated PDF: {e}"))?;
-
-    let _ = std::fs::remove_file(&html_path);
-    let _ = std::fs::remove_file(&pdf_path);
-
-    if pdf_bytes.is_empty() {
-        return Err("Chrome produced an empty PDF".to_string());
-    }
-
-    tracing::info!(size_kb = pdf_bytes.len() / 1024, "PDF report generated");
-    Ok(pdf_bytes)
-}
-
-/// Search for Chrome/Chromium binary on the system.
-fn find_chrome_binary() -> Option<String> {
-    let candidates = [
-        "google-chrome-stable",
-        "google-chrome",
-        "chromium-browser",
-        "chromium",
-    ];
-    for name in &candidates {
-        if let Ok(output) = std::process::Command::new("which").arg(name).output() {
-            if output.status.success() {
-                let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
-                if !path.is_empty() {
-                    return Some(path);
-                }
-            }
-        }
-    }
-    None
-}

compliance-agent/src/pipeline/code_review.rs

@@ -66,10 +66,8 @@ impl CodeReviewScanner {
             }
         }
 
-        let deduped = dedup_cross_pass(all_findings);
-
         ScanOutput {
-            findings: deduped,
+            findings: all_findings,
             sbom_entries: Vec::new(),
         }
     }
@@ -186,51 +184,3 @@ struct ReviewIssue {
     #[serde(default)]
     suggestion: Option<String>,
 }
-
-/// Deduplicate findings across review passes.
-///
-/// Multiple passes often flag the same issue (e.g. SQL injection reported by
-/// logic, security, and convention passes). We group by file + nearby line +
-/// normalized title keywords and keep the highest-severity finding.
-fn dedup_cross_pass(findings: Vec<Finding>) -> Vec<Finding> {
-    use std::collections::HashMap;
-
-    // Build a dedup key: (file, line bucket, normalized title words)
-    fn dedup_key(f: &Finding) -> String {
-        let file = f.file_path.as_deref().unwrap_or("");
-        // Group lines within 3 of each other
-        let line_bucket = f.line_number.unwrap_or(0) / 4;
-        // Normalize: lowercase, keep only alphanumeric, sort words for order-independence
-        let title_lower = f.title.to_lowercase();
-        let mut words: Vec<&str> = title_lower
-            .split(|c: char| !c.is_alphanumeric())
-            .filter(|w| w.len() > 2)
-            .collect();
-        words.sort();
-        format!("{file}:{line_bucket}:{}", words.join(","))
-    }
-
-    let mut groups: HashMap<String, Finding> = HashMap::new();
-
-    for finding in findings {
-        let key = dedup_key(&finding);
-        groups
-            .entry(key)
-            .and_modify(|existing| {
-                // Keep the higher severity; on tie, keep the one with more detail
-                if finding.severity > existing.severity
-                    || (finding.severity == existing.severity
-                        && finding.description.len() > existing.description.len())
-                {
-                    *existing = finding.clone();
-                }
-                // Merge CWE if the existing one is missing it
-                if existing.cwe.is_none() {
-                    existing.cwe = finding.cwe.clone();
-                }
-            })
-            .or_insert(finding);
-    }
-
-    groups.into_values().collect()
-}

compliance-agent/src/pipeline/dedup.rs

@@ -1,7 +1,5 @@
 use sha2::{Digest, Sha256};
 
-use compliance_core::models::dast::DastFinding;
-
 pub fn compute_fingerprint(parts: &[&str]) -> String {
     let mut hasher = Sha256::new();
     for part in parts {
@@ -10,406 +8,3 @@ pub fn compute_fingerprint(parts: &[&str]) -> String {
     }
     hex::encode(hasher.finalize())
 }
-
-/// Compute a dedup fingerprint for a DAST finding.
-///
-/// The key is derived from the *canonicalized* title (lowercased, domain names
-/// stripped, known synonyms resolved), endpoint, and HTTP method.  This lets us
-/// detect both exact duplicates (same tool reporting twice across passes) and
-/// semantic duplicates (e.g., `security_header_missing` "Missing HSTS header"
-/// vs `tls_misconfiguration` "Missing strict-transport-security header").
-pub fn compute_dast_fingerprint(f: &DastFinding) -> String {
-    let canon = canonicalize_dast_title(&f.title);
-    let endpoint = f.endpoint.to_lowercase().trim_end_matches('/').to_string();
-    let method = f.method.to_uppercase();
-    let param = f.parameter.as_deref().unwrap_or("");
-    compute_fingerprint(&[&canon, &endpoint, &method, param])
-}
-
-/// Canonicalize a DAST finding title for dedup purposes.
-///
-/// 1. Lowercase
-/// 2. Strip domain names / URLs (e.g. "for comp-dev.meghsakha.com")
-/// 3. Resolve known header synonyms (hsts ↔ strict-transport-security, etc.)
-/// 4. Strip extra whitespace
-fn canonicalize_dast_title(title: &str) -> String {
-    let mut s = title.to_lowercase();
-
-    // Strip "for <domain>" or "on <domain>" suffixes
-    // Pattern: "for <word.word...>" or "on <method> <url>"
-    if let Some(idx) = s.find(" for ") {
-        // Check if what follows looks like a domain or URL
-        let rest = &s[idx + 5..];
-        if rest.contains('.') || rest.starts_with("http") {
-            s.truncate(idx);
-        }
-    }
-    if let Some(idx) = s.find(" on ") {
-        let rest = &s[idx + 4..];
-        if rest.contains("http") || rest.contains('/') {
-            s.truncate(idx);
-        }
-    }
-
-    // Resolve known header synonyms
-    let synonyms: &[(&str, &str)] = &[
-        ("hsts", "strict-transport-security"),
-        ("csp", "content-security-policy"),
-        ("cors", "cross-origin-resource-sharing"),
-        ("xfo", "x-frame-options"),
-    ];
-    for &(short, canonical) in synonyms {
-        // Only replace whole words — check boundaries
-        if let Some(pos) = s.find(short) {
-            let before_ok = pos == 0 || !s.as_bytes()[pos - 1].is_ascii_alphanumeric();
-            let after_ok = pos + short.len() >= s.len()
-                || !s.as_bytes()[pos + short.len()].is_ascii_alphanumeric();
-            if before_ok && after_ok {
-                s = format!("{}{}{}", &s[..pos], canonical, &s[pos + short.len()..]);
-            }
-        }
-    }
-
-    // Collapse whitespace
-    s.split_whitespace().collect::<Vec<_>>().join(" ")
-}
-
-/// Deduplicate a list of DAST findings, merging evidence from duplicates.
-///
-/// Two-phase approach:
-/// 1. **Exact dedup** — group by canonicalized `(title, endpoint, method, parameter)`.
-///    Merge evidence arrays, keep the highest severity, preserve exploitable flag.
-/// 2. **CWE-based dedup** — within the same `(cwe, endpoint, method)` group, merge
-///    findings whose canonicalized titles resolve to the same subject (e.g., HSTS
-///    reported as both `security_header_missing` and `tls_misconfiguration`).
-pub fn dedup_dast_findings(findings: Vec<DastFinding>) -> Vec<DastFinding> {
-    use std::collections::HashMap;
-
-    if findings.len() <= 1 {
-        return findings;
-    }
-
-    // Phase 1: exact fingerprint dedup
-    let mut seen: HashMap<String, usize> = HashMap::new();
-    let mut deduped: Vec<DastFinding> = Vec::new();
-
-    for finding in findings {
-        let fp = compute_dast_fingerprint(&finding);
-
-        if let Some(&idx) = seen.get(&fp) {
-            // Merge into existing
-            merge_dast_finding(&mut deduped[idx], &finding);
-        } else {
-            seen.insert(fp, deduped.len());
-            deduped.push(finding);
-        }
-    }
-
-    let before = deduped.len();
-
-    // Phase 2: CWE-based related dedup
-    // Group by (cwe, endpoint_normalized, method) — only when CWE is present
-    let mut cwe_groups: HashMap<String, Vec<usize>> = HashMap::new();
-    for (i, f) in deduped.iter().enumerate() {
-        if let Some(ref cwe) = f.cwe {
-            let key = format!(
-                "{}|{}|{}",
-                cwe,
-                f.endpoint.to_lowercase().trim_end_matches('/'),
-                f.method.to_uppercase(),
-            );
-            cwe_groups.entry(key).or_default().push(i);
-        }
-    }
-
-    // For each CWE group with multiple findings, keep the one with highest severity
-    // and most evidence, merge the rest into it
-    let mut merge_map: HashMap<usize, Vec<usize>> = HashMap::new();
-    let mut remove_indices: Vec<usize> = Vec::new();
-
-    for indices in cwe_groups.values() {
-        if indices.len() <= 1 {
-            continue;
-        }
-        // Find the "primary" finding: highest severity, then most evidence, then longest description
-        let Some(&primary_idx) = indices.iter().max_by(|&&a, &&b| {
-            deduped[a]
-                .severity
-                .cmp(&deduped[b].severity)
-                .then_with(|| deduped[a].evidence.len().cmp(&deduped[b].evidence.len()))
-                .then_with(|| {
-                    deduped[a]
-                        .description
-                        .len()
-                        .cmp(&deduped[b].description.len())
-                })
-        }) else {
-            continue;
-        };
-
-        for &idx in indices {
-            if idx != primary_idx {
-                remove_indices.push(idx);
-                merge_map.entry(primary_idx).or_default().push(idx);
-            }
-        }
-    }
-
-    if !remove_indices.is_empty() {
-        remove_indices.sort_unstable();
-        remove_indices.dedup();
-
-        // Merge evidence
-        for (&primary, secondaries) in &merge_map {
-            let extra_evidence: Vec<_> = secondaries
-                .iter()
-                .flat_map(|&i| deduped[i].evidence.clone())
-                .collect();
-            let any_exploitable = secondaries.iter().any(|&i| deduped[i].exploitable);
-
-            deduped[primary].evidence.extend(extra_evidence);
-            if any_exploitable {
-                deduped[primary].exploitable = true;
-            }
-        }
-
-        // Remove merged findings (iterate in reverse to preserve indices)
-        for &idx in remove_indices.iter().rev() {
-            deduped.remove(idx);
-        }
-    }
-
-    let after = deduped.len();
-    if before != after {
-        tracing::debug!(
-            "DAST CWE-based dedup: {before} → {after} findings ({} merged)",
-            before - after
-        );
-    }
-
-    deduped
-}
-
-/// Merge a duplicate DAST finding into a primary one.
-fn merge_dast_finding(primary: &mut DastFinding, duplicate: &DastFinding) {
-    primary.evidence.extend(duplicate.evidence.clone());
-    if duplicate.severity > primary.severity {
-        primary.severity = duplicate.severity.clone();
-    }
-    if duplicate.exploitable {
-        primary.exploitable = true;
-    }
-    // Keep the longer/better description
-    if duplicate.description.len() > primary.description.len() {
-        primary.description.clone_from(&duplicate.description);
-    }
-    // Keep remediation if primary doesn't have one
-    if primary.remediation.is_none() && duplicate.remediation.is_some() {
-        primary.remediation.clone_from(&duplicate.remediation);
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::dast::DastVulnType;
-    use compliance_core::models::finding::Severity;
-
-    #[test]
-    fn fingerprint_is_deterministic() {
-        let a = compute_fingerprint(&["repo1", "rule-x", "src/main.rs", "42"]);
-        let b = compute_fingerprint(&["repo1", "rule-x", "src/main.rs", "42"]);
-        assert_eq!(a, b);
-    }
-
-    #[test]
-    fn fingerprint_changes_with_different_input() {
-        let a = compute_fingerprint(&["repo1", "rule-x", "src/main.rs", "42"]);
-        let b = compute_fingerprint(&["repo1", "rule-x", "src/main.rs", "43"]);
-        assert_ne!(a, b);
-    }
-
-    #[test]
-    fn fingerprint_is_valid_hex_sha256() {
-        let fp = compute_fingerprint(&["hello"]);
-        assert_eq!(fp.len(), 64, "SHA-256 hex should be 64 chars");
-        assert!(fp.chars().all(|c| c.is_ascii_hexdigit()));
-    }
-
-    #[test]
-    fn fingerprint_empty_parts() {
-        let fp = compute_fingerprint(&[]);
-        // Should still produce a valid hash (of empty input)
-        assert_eq!(fp.len(), 64);
-    }
-
-    #[test]
-    fn fingerprint_order_matters() {
-        let a = compute_fingerprint(&["a", "b"]);
-        let b = compute_fingerprint(&["b", "a"]);
-        assert_ne!(a, b);
-    }
-
-    #[test]
-    fn fingerprint_separator_prevents_collision() {
-        // "ab" + "c" vs "a" + "bc" should differ because of the "|" separator
-        let a = compute_fingerprint(&["ab", "c"]);
-        let b = compute_fingerprint(&["a", "bc"]);
-        assert_ne!(a, b);
-    }
-
-    fn make_dast(title: &str, endpoint: &str, vuln_type: DastVulnType) -> DastFinding {
-        let mut f = DastFinding::new(
-            "run1".into(),
-            "target1".into(),
-            vuln_type,
-            title.into(),
-            format!("Description for {title}"),
-            Severity::Medium,
-            endpoint.into(),
-            "GET".into(),
-        );
-        f.cwe = Some("CWE-319".into());
-        f
-    }
-
-    #[test]
-    fn canonicalize_strips_domain_suffix() {
-        let canon = canonicalize_dast_title("Missing HSTS header for comp-dev.meghsakha.com");
-        assert!(!canon.contains("meghsakha"), "domain should be stripped");
-        assert!(
-            canon.contains("strict-transport-security"),
-            "hsts should be resolved: {canon}"
-        );
-    }
-
-    #[test]
-    fn canonicalize_resolves_synonyms() {
-        let a = canonicalize_dast_title("Missing HSTS header");
-        let b = canonicalize_dast_title("Missing strict-transport-security header");
-        assert_eq!(a, b);
-    }
-
-    #[test]
-    fn exact_dedup_merges_identical_findings() {
-        let f1 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        let f2 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        let result = dedup_dast_findings(vec![f1, f2]);
-        assert_eq!(result.len(), 1, "exact duplicates should be merged");
-    }
-
-    #[test]
-    fn synonym_dedup_merges_hsts_variants() {
-        let f1 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        let f2 = make_dast(
-            "Missing HSTS header for example.com",
-            "https://example.com",
-            DastVulnType::TlsMisconfiguration,
-        );
-        let result = dedup_dast_findings(vec![f1, f2]);
-        assert_eq!(
-            result.len(),
-            1,
-            "HSTS synonym variants should merge to 1 finding"
-        );
-    }
-
-    #[test]
-    fn different_headers_not_merged() {
-        let mut f1 = make_dast(
-            "Missing x-content-type-options header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        f1.cwe = Some("CWE-16".into());
-        let mut f2 = make_dast(
-            "Missing permissions-policy header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        f2.cwe = Some("CWE-16".into());
-        // These share CWE-16 but are different headers — phase 2 will merge them
-        // since they share the same CWE+endpoint. This is acceptable because they
-        // have the same root cause (missing security headers configuration).
-        let result = dedup_dast_findings(vec![f1, f2]);
-        // CWE-based dedup will merge these into 1
-        assert!(
-            result.len() <= 2,
-            "same CWE+endpoint findings may be merged"
-        );
-    }
-
-    #[test]
-    fn different_endpoints_not_merged() {
-        let f1 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        let f2 = make_dast(
-            "Missing strict-transport-security header",
-            "https://other.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        let result = dedup_dast_findings(vec![f1, f2]);
-        assert_eq!(result.len(), 2, "different endpoints should not merge");
-    }
-
-    #[test]
-    fn dedup_preserves_highest_severity() {
-        let f1 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        let mut f2 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        f2.severity = Severity::High;
-        let result = dedup_dast_findings(vec![f1, f2]);
-        assert_eq!(result.len(), 1);
-        assert_eq!(result[0].severity, Severity::High);
-    }
-
-    #[test]
-    fn dedup_merges_evidence() {
-        let mut f1 = make_dast(
-            "Missing strict-transport-security header",
-            "https://example.com",
-            DastVulnType::SecurityHeaderMissing,
-        );
-        f1.evidence
-            .push(compliance_core::models::dast::DastEvidence {
-                request_method: "GET".into(),
-                request_url: "https://example.com".into(),
-                request_headers: None,
-                request_body: None,
-                response_status: 200,
-                response_headers: None,
-                response_snippet: Some("pass 1".into()),
-                screenshot_path: None,
-                payload: None,
-                response_time_ms: None,
-            });
-        let mut f2 = f1.clone();
-        f2.evidence[0].response_snippet = Some("pass 2".into());
-
-        let result = dedup_dast_findings(vec![f1, f2]);
-        assert_eq!(result.len(), 1);
-        assert_eq!(result[0].evidence.len(), 2, "evidence should be merged");
-    }
-}

compliance-agent/src/pipeline/gitleaks.rs

@@ -19,33 +19,26 @@ impl Scanner for GitleaksScanner {
 
     #[tracing::instrument(skip_all)]
     async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let output = tokio::time::timeout(
+        let output = tokio::process::Command::new("gitleaks")
-            std::time::Duration::from_secs(300),
+            .args([
-            tokio::process::Command::new("gitleaks")
+                "detect",
-                .args([
+                "--source",
-                    "detect",
+                ".",
-                    "--source",
+                "--report-format",
-                    ".",
+                "json",
-                    "--report-format",
+                "--report-path",
-                    "json",
+                "/dev/stdout",
-                    "--report-path",
+                "--no-banner",
-                    "/dev/stdout",
+                "--exit-code",
-                    "--no-banner",
+                "0",
-                    "--exit-code",
+            ])
-                    "0",
+            .current_dir(repo_path)
-                ])
+            .output()
-                .current_dir(repo_path)
+            .await
-                .output(),
+            .map_err(|e| CoreError::Scanner {
-        )
+                scanner: "gitleaks".to_string(),
-        .await
+                source: Box::new(e),
-        .map_err(|_| CoreError::Scanner {
+            })?;
-            scanner: "gitleaks".to_string(),
-            source: "timed out after 5 minutes".into(),
-        })?
-        .map_err(|e| CoreError::Scanner {
-            scanner: "gitleaks".to_string(),
-            source: Box::new(e),
-        })?;
 
         if output.stdout.is_empty() {
             return Ok(ScanOutput::default());
@@ -136,110 +129,3 @@ struct GitleaksResult {
     #[serde(rename = "Match")]
     r#match: String,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // --- is_allowlisted tests ---
-
-    #[test]
-    fn allowlisted_env_example_files() {
-        assert!(is_allowlisted(".env.example"));
-        assert!(is_allowlisted("config/.env.sample"));
-        assert!(is_allowlisted("deploy/.ENV.TEMPLATE"));
-    }
-
-    #[test]
-    fn allowlisted_test_directories() {
-        assert!(is_allowlisted("src/test/config.json"));
-        assert!(is_allowlisted("src/tests/fixtures.rs"));
-        assert!(is_allowlisted("data/fixtures/secret.txt"));
-        assert!(is_allowlisted("pkg/testdata/key.pem"));
-    }
-
-    #[test]
-    fn allowlisted_mock_files() {
-        assert!(is_allowlisted("src/mock_service.py"));
-        assert!(is_allowlisted("lib/MockAuth.java"));
-    }
-
-    #[test]
-    fn allowlisted_test_suffixes() {
-        assert!(is_allowlisted("auth_test.go"));
-        assert!(is_allowlisted("auth.test.ts"));
-        assert!(is_allowlisted("auth.test.js"));
-        assert!(is_allowlisted("auth.spec.ts"));
-        assert!(is_allowlisted("auth.spec.js"));
-    }
-
-    #[test]
-    fn not_allowlisted_regular_files() {
-        assert!(!is_allowlisted("src/main.rs"));
-        assert!(!is_allowlisted("config/.env"));
-        assert!(!is_allowlisted("lib/auth.ts"));
-        assert!(!is_allowlisted("deploy/secrets.yaml"));
-    }
-
-    #[test]
-    fn not_allowlisted_partial_matches() {
-        // "test" as substring in a non-directory context should not match
-        assert!(!is_allowlisted("src/attestation.rs"));
-        assert!(!is_allowlisted("src/contest/data.json"));
-    }
-
-    // --- GitleaksResult deserialization tests ---
-
-    #[test]
-    fn deserialize_gitleaks_result() {
-        let json = r#"{
-            "Description": "AWS Access Key",
-            "RuleID": "aws-access-key",
-            "File": "src/config.rs",
-            "StartLine": 10,
-            "Match": "AKIAIOSFODNN7EXAMPLE"
-        }"#;
-        let result: GitleaksResult = serde_json::from_str(json).unwrap();
-        assert_eq!(result.description, "AWS Access Key");
-        assert_eq!(result.rule_id, "aws-access-key");
-        assert_eq!(result.file, "src/config.rs");
-        assert_eq!(result.start_line, 10);
-        assert_eq!(result.r#match, "AKIAIOSFODNN7EXAMPLE");
-    }
-
-    #[test]
-    fn deserialize_gitleaks_result_array() {
-        let json = r#"[
-            {
-                "Description": "Generic Secret",
-                "RuleID": "generic-secret",
-                "File": "app.py",
-                "StartLine": 5,
-                "Match": "password=hunter2"
-            }
-        ]"#;
-        let results: Vec<GitleaksResult> = serde_json::from_str(json).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].rule_id, "generic-secret");
-    }
-
-    #[test]
-    fn severity_mapping_private_key() {
-        // Verify the severity logic from the scan method
-        let rule_id = "some-private-key-rule";
-        assert!(rule_id.contains("private-key"));
-    }
-
-    #[test]
-    fn severity_mapping_token_password_secret() {
-        for keyword in &["token", "password", "secret"] {
-            let rule_id = format!("some-{}-rule", keyword);
-            assert!(
-                rule_id.contains("token")
-                    || rule_id.contains("password")
-                    || rule_id.contains("secret"),
-                "Expected '{rule_id}' to match token/password/secret"
-            );
-        }
-    }
-}

compliance-agent/src/pipeline/graph_build.rs

@@ -1,106 +0,0 @@
-use compliance_core::models::Finding;
-
-use super::orchestrator::{GraphContext, PipelineOrchestrator};
-use crate::error::AgentError;
-
-impl PipelineOrchestrator {
-    /// Build the code knowledge graph for a repo and compute impact analyses
-    pub(super) async fn build_code_graph(
-        &self,
-        repo_path: &std::path::Path,
-        repo_id: &str,
-        findings: &[Finding],
-    ) -> Result<GraphContext, AgentError> {
-        let graph_build_id = uuid::Uuid::new_v4().to_string();
-        let engine = compliance_graph::GraphEngine::new(50_000);
-
-        let (mut code_graph, build_run) =
-            engine
-                .build_graph(repo_path, repo_id, &graph_build_id)
-                .map_err(|e| AgentError::Other(format!("Graph build error: {e}")))?;
-
-        // Apply community detection
-        compliance_graph::graph::community::apply_communities(&mut code_graph);
-
-        // Store graph in MongoDB
-        let store = compliance_graph::graph::persistence::GraphStore::new(self.db.inner());
-        store
-            .delete_repo_graph(repo_id)
-            .await
-            .map_err(|e| AgentError::Other(format!("Graph cleanup error: {e}")))?;
-        store
-            .store_graph(&build_run, &code_graph.nodes, &code_graph.edges)
-            .await
-            .map_err(|e| AgentError::Other(format!("Graph store error: {e}")))?;
-
-        // Compute impact analysis for each finding
-        let analyzer = compliance_graph::GraphEngine::impact_analyzer(&code_graph);
-        let mut impacts = Vec::new();
-
-        for finding in findings {
-            if let Some(file_path) = &finding.file_path {
-                let impact = analyzer.analyze(
-                    repo_id,
-                    &finding.fingerprint,
-                    &graph_build_id,
-                    file_path,
-                    finding.line_number,
-                );
-                store
-                    .store_impact(&impact)
-                    .await
-                    .map_err(|e| AgentError::Other(format!("Impact store error: {e}")))?;
-                impacts.push(impact);
-            }
-        }
-
-        Ok(GraphContext {
-            node_count: build_run.node_count,
-            edge_count: build_run.edge_count,
-            community_count: build_run.community_count,
-            impacts,
-        })
-    }
-
-    /// Trigger DAST scan if a target is configured for this repo
-    pub(super) async fn maybe_trigger_dast(&self, repo_id: &str, scan_run_id: &str) {
-        use futures_util::TryStreamExt;
-
-        let filter = mongodb::bson::doc! { "repo_id": repo_id };
-        let targets: Vec<compliance_core::models::DastTarget> =
-            match self.db.dast_targets().find(filter).await {
-                Ok(cursor) => cursor.try_collect().await.unwrap_or_default(),
-                Err(_) => return,
-            };
-
-        if targets.is_empty() {
-            tracing::info!("[{repo_id}] No DAST targets configured, skipping");
-            return;
-        }
-
-        for target in targets {
-            let db = self.db.clone();
-            let scan_run_id = scan_run_id.to_string();
-            tokio::spawn(async move {
-                let orchestrator = compliance_dast::DastOrchestrator::new(100);
-                match orchestrator.run_scan(&target, Vec::new()).await {
-                    Ok((mut scan_run, findings)) => {
-                        scan_run.sast_scan_run_id = Some(scan_run_id);
-                        if let Err(e) = db.dast_scan_runs().insert_one(&scan_run).await {
-                            tracing::error!("Failed to store DAST scan run: {e}");
-                        }
-                        for finding in &findings {
-                            if let Err(e) = db.dast_findings().insert_one(finding).await {
-                                tracing::error!("Failed to store DAST finding: {e}");
-                            }
-                        }
-                        tracing::info!("DAST scan complete: {} findings", findings.len());
-                    }
-                    Err(e) => {
-                        tracing::error!("DAST scan failed: {e}");
-                    }
-                }
-            });
-        }
-    }
-}

compliance-agent/src/pipeline/issue_creation.rs

@@ -1,259 +0,0 @@
-use mongodb::bson::doc;
-
-use compliance_core::models::*;
-
-use super::orchestrator::{extract_base_url, PipelineOrchestrator};
-use super::tracker_dispatch::TrackerDispatch;
-use crate::error::AgentError;
-use crate::trackers;
-
-impl PipelineOrchestrator {
-    /// Build an issue tracker client from a repository's tracker configuration.
-    /// Returns `None` if the repo has no tracker configured.
-    pub(super) fn build_tracker(&self, repo: &TrackedRepository) -> Option<TrackerDispatch> {
-        let tracker_type = repo.tracker_type.as_ref()?;
-        // Per-repo token takes precedence, fall back to global config
-        match tracker_type {
-            TrackerType::GitHub => {
-                let token = repo.tracker_token.clone().or_else(|| {
-                    self.config.github_token.as_ref().map(|t| {
-                        use secrecy::ExposeSecret;
-                        t.expose_secret().to_string()
-                    })
-                })?;
-                let secret = secrecy::SecretString::from(token);
-                match trackers::github::GitHubTracker::new(&secret) {
-                    Ok(t) => Some(TrackerDispatch::GitHub(t)),
-                    Err(e) => {
-                        tracing::warn!("Failed to build GitHub tracker: {e}");
-                        None
-                    }
-                }
-            }
-            TrackerType::GitLab => {
-                let base_url = self
-                    .config
-                    .gitlab_url
-                    .clone()
-                    .unwrap_or_else(|| "https://gitlab.com".to_string());
-                let token = repo.tracker_token.clone().or_else(|| {
-                    self.config.gitlab_token.as_ref().map(|t| {
-                        use secrecy::ExposeSecret;
-                        t.expose_secret().to_string()
-                    })
-                })?;
-                let secret = secrecy::SecretString::from(token);
-                Some(TrackerDispatch::GitLab(
-                    trackers::gitlab::GitLabTracker::new(base_url, secret),
-                ))
-            }
-            TrackerType::Gitea => {
-                let token = repo.tracker_token.clone()?;
-                let base_url = extract_base_url(&repo.git_url)?;
-                let secret = secrecy::SecretString::from(token);
-                Some(TrackerDispatch::Gitea(trackers::gitea::GiteaTracker::new(
-                    base_url, secret,
-                )))
-            }
-            TrackerType::Jira => {
-                let base_url = self.config.jira_url.clone()?;
-                let email = self.config.jira_email.clone()?;
-                let project_key = self.config.jira_project_key.clone()?;
-                let token = repo.tracker_token.clone().or_else(|| {
-                    self.config.jira_api_token.as_ref().map(|t| {
-                        use secrecy::ExposeSecret;
-                        t.expose_secret().to_string()
-                    })
-                })?;
-                let secret = secrecy::SecretString::from(token);
-                Some(TrackerDispatch::Jira(trackers::jira::JiraTracker::new(
-                    base_url,
-                    email,
-                    secret,
-                    project_key,
-                )))
-            }
-        }
-    }
-
-    /// Create tracker issues for new findings (severity >= Medium).
-    /// Checks for duplicates via fingerprint search before creating.
-    #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
-    pub(super) async fn create_tracker_issues(
-        &self,
-        repo: &TrackedRepository,
-        repo_id: &str,
-        new_findings: &[Finding],
-    ) -> Result<(), AgentError> {
-        let tracker = match self.build_tracker(repo) {
-            Some(t) => t,
-            None => {
-                tracing::info!("[{repo_id}] No issue tracker configured, skipping");
-                return Ok(());
-            }
-        };
-
-        let owner = match repo.tracker_owner.as_deref() {
-            Some(o) => o,
-            None => {
-                tracing::warn!("[{repo_id}] tracker_owner not set, skipping issue creation");
-                return Ok(());
-            }
-        };
-        let tracker_repo_name = match repo.tracker_repo.as_deref() {
-            Some(r) => r,
-            None => {
-                tracing::warn!("[{repo_id}] tracker_repo not set, skipping issue creation");
-                return Ok(());
-            }
-        };
-
-        // Only create issues for medium+ severity findings
-        let actionable: Vec<&Finding> = new_findings
-            .iter()
-            .filter(|f| {
-                matches!(
-                    f.severity,
-                    Severity::Medium | Severity::High | Severity::Critical
-                )
-            })
-            .collect();
-
-        if actionable.is_empty() {
-            tracing::info!("[{repo_id}] No medium+ findings, skipping issue creation");
-            return Ok(());
-        }
-
-        tracing::info!(
-            "[{repo_id}] Creating issues for {} findings via {}",
-            actionable.len(),
-            tracker.name()
-        );
-
-        let mut created = 0u32;
-        for finding in actionable {
-            let title = format!(
-                "[{}] {}: {}",
-                finding.severity, finding.scanner, finding.title
-            );
-
-            // Check if an issue already exists by fingerprint first, then by title
-            let mut found_existing = false;
-            for search_term in [&finding.fingerprint, &title] {
-                match tracker
-                    .find_existing_issue(owner, tracker_repo_name, search_term)
-                    .await
-                {
-                    Ok(Some(existing)) => {
-                        tracing::debug!(
-                            "[{repo_id}] Issue already exists for '{}': {}",
-                            search_term,
-                            existing.external_url
-                        );
-                        found_existing = true;
-                        break;
-                    }
-                    Ok(None) => {}
-                    Err(e) => {
-                        tracing::warn!("[{repo_id}] Failed to search for existing issue: {e}");
-                    }
-                }
-            }
-            if found_existing {
-                continue;
-            }
-            let body = format_issue_body(finding);
-            let labels = vec![
-                format!("severity:{}", finding.severity),
-                format!("scanner:{}", finding.scanner),
-                "compliance-scanner".to_string(),
-            ];
-
-            match tracker
-                .create_issue(owner, tracker_repo_name, &title, &body, &labels)
-                .await
-            {
-                Ok(mut issue) => {
-                    issue.finding_id = finding
-                        .id
-                        .as_ref()
-                        .map(|id| id.to_hex())
-                        .unwrap_or_default();
-
-                    // Update the finding with the issue URL
-                    if let Some(finding_id) = &finding.id {
-                        let _ = self
-                            .db
-                            .findings()
-                            .update_one(
-                                doc! { "_id": finding_id },
-                                doc! { "$set": { "tracker_issue_url": &issue.external_url } },
-                            )
-                            .await;
-                    }
-
-                    // Store the tracker issue record
-                    if let Err(e) = self.db.tracker_issues().insert_one(&issue).await {
-                        tracing::warn!("[{repo_id}] Failed to store tracker issue: {e}");
-                    }
-
-                    created += 1;
-                }
-                Err(e) => {
-                    tracing::warn!(
-                        "[{repo_id}] Failed to create issue for {}: {e}",
-                        finding.fingerprint
-                    );
-                }
-            }
-        }
-
-        tracing::info!("[{repo_id}] Created {created} tracker issues");
-        Ok(())
-    }
-}
-
-/// Format a finding into a markdown issue body for the tracker.
-pub(super) fn format_issue_body(finding: &Finding) -> String {
-    let mut body = String::new();
-
-    body.push_str(&format!("## {} Finding\n\n", finding.severity));
-    body.push_str(&format!("**Scanner:** {}\n", finding.scanner));
-    body.push_str(&format!("**Severity:** {}\n", finding.severity));
-
-    if let Some(rule) = &finding.rule_id {
-        body.push_str(&format!("**Rule:** {}\n", rule));
-    }
-    if let Some(cwe) = &finding.cwe {
-        body.push_str(&format!("**CWE:** {}\n", cwe));
-    }
-
-    body.push_str(&format!("\n### Description\n\n{}\n", finding.description));
-
-    if let Some(file_path) = &finding.file_path {
-        body.push_str(&format!("\n### Location\n\n**File:** `{}`", file_path));
-        if let Some(line) = finding.line_number {
-            body.push_str(&format!(" (line {})", line));
-        }
-        body.push('\n');
-    }
-
-    if let Some(snippet) = &finding.code_snippet {
-        body.push_str(&format!("\n### Code\n\n```\n{}\n```\n", snippet));
-    }
-
-    if let Some(remediation) = &finding.remediation {
-        body.push_str(&format!("\n### Remediation\n\n{}\n", remediation));
-    }
-
-    if let Some(fix) = &finding.suggested_fix {
-        body.push_str(&format!("\n### Suggested Fix\n\n```\n{}\n```\n", fix));
-    }
-
-    body.push_str(&format!(
-        "\n---\n*Fingerprint:* `{}`\n*Generated by compliance-scanner*",
-        finding.fingerprint
-    ));
-
-    body
-}

compliance-agent/src/pipeline/lint.rs

@@ -0,0 +1,366 @@
+use std::path::Path;
+use std::time::Duration;
+
+use compliance_core::models::{Finding, ScanType, Severity};
+use compliance_core::traits::{ScanOutput, Scanner};
+use compliance_core::CoreError;
+use tokio::process::Command;
+
+use crate::pipeline::dedup;
+
+/// Timeout for each individual lint command
+const LINT_TIMEOUT: Duration = Duration::from_secs(120);
+
+pub struct LintScanner;
+
+impl Scanner for LintScanner {
+    fn name(&self) -> &str {
+        "lint"
+    }
+
+    fn scan_type(&self) -> ScanType {
+        ScanType::Lint
+    }
+
+    #[tracing::instrument(skip_all)]
+    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
+        let mut all_findings = Vec::new();
+
+        // Detect which languages are present and run appropriate linters
+        if has_rust_project(repo_path) {
+            match run_clippy(repo_path, repo_id).await {
+                Ok(findings) => all_findings.extend(findings),
+                Err(e) => tracing::warn!("Clippy failed: {e}"),
+            }
+        }
+
+        if has_js_project(repo_path) {
+            match run_eslint(repo_path, repo_id).await {
+                Ok(findings) => all_findings.extend(findings),
+                Err(e) => tracing::warn!("ESLint failed: {e}"),
+            }
+        }
+
+        if has_python_project(repo_path) {
+            match run_ruff(repo_path, repo_id).await {
+                Ok(findings) => all_findings.extend(findings),
+                Err(e) => tracing::warn!("Ruff failed: {e}"),
+            }
+        }
+
+        Ok(ScanOutput {
+            findings: all_findings,
+            sbom_entries: Vec::new(),
+        })
+    }
+}
+
+fn has_rust_project(repo_path: &Path) -> bool {
+    repo_path.join("Cargo.toml").exists()
+}
+
+fn has_js_project(repo_path: &Path) -> bool {
+    // Only run if eslint is actually installed in the project
+    repo_path.join("package.json").exists() && repo_path.join("node_modules/.bin/eslint").exists()
+}
+
+fn has_python_project(repo_path: &Path) -> bool {
+    repo_path.join("pyproject.toml").exists()
+        || repo_path.join("setup.py").exists()
+        || repo_path.join("requirements.txt").exists()
+}
+
+/// Run a command with a timeout, returning its output or an error
+async fn run_with_timeout(
+    child: tokio::process::Child,
+    scanner_name: &str,
+) -> Result<std::process::Output, CoreError> {
+    let result = tokio::time::timeout(LINT_TIMEOUT, child.wait_with_output()).await;
+    match result {
+        Ok(Ok(output)) => Ok(output),
+        Ok(Err(e)) => Err(CoreError::Scanner {
+            scanner: scanner_name.to_string(),
+            source: Box::new(e),
+        }),
+        Err(_) => {
+            // Process is dropped here which sends SIGKILL on Unix
+            Err(CoreError::Scanner {
+                scanner: scanner_name.to_string(),
+                source: Box::new(std::io::Error::new(
+                    std::io::ErrorKind::TimedOut,
+                    format!("{scanner_name} timed out after {}s", LINT_TIMEOUT.as_secs()),
+                )),
+            })
+        }
+    }
+}
+
+// ── Clippy ──────────────────────────────────────────────
+
+async fn run_clippy(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
+    let child = Command::new("cargo")
+        .args([
+            "clippy",
+            "--message-format=json",
+            "--quiet",
+            "--",
+            "-W",
+            "clippy::all",
+        ])
+        .current_dir(repo_path)
+        .env("RUSTC_WRAPPER", "")
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|e| CoreError::Scanner {
+            scanner: "clippy".to_string(),
+            source: Box::new(e),
+        })?;
+
+    let output = run_with_timeout(child, "clippy").await?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let mut findings = Vec::new();
+
+    for line in stdout.lines() {
+        let msg: serde_json::Value = match serde_json::from_str(line) {
+            Ok(v) => v,
+            Err(_) => continue,
+        };
+
+        if msg.get("reason").and_then(|v| v.as_str()) != Some("compiler-message") {
+            continue;
+        }
+
+        let message = match msg.get("message") {
+            Some(m) => m,
+            None => continue,
+        };
+
+        let level = message.get("level").and_then(|v| v.as_str()).unwrap_or("");
+
+        if level != "warning" && level != "error" {
+            continue;
+        }
+
+        let text = message
+            .get("message")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string();
+
+        let code = message
+            .get("code")
+            .and_then(|v| v.get("code"))
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string();
+
+        if text.starts_with("aborting due to") || code.is_empty() {
+            continue;
+        }
+
+        let (file_path, line_number) = extract_primary_span(message);
+
+        let severity = if level == "error" {
+            Severity::High
+        } else {
+            Severity::Low
+        };
+
+        let fingerprint = dedup::compute_fingerprint(&[
+            repo_id,
+            "clippy",
+            &code,
+            &file_path,
+            &line_number.to_string(),
+        ]);
+
+        let mut finding = Finding::new(
+            repo_id.to_string(),
+            fingerprint,
+            "clippy".to_string(),
+            ScanType::Lint,
+            format!("[clippy] {text}"),
+            text,
+            severity,
+        );
+        finding.rule_id = Some(code);
+        if !file_path.is_empty() {
+            finding.file_path = Some(file_path);
+        }
+        if line_number > 0 {
+            finding.line_number = Some(line_number);
+        }
+        findings.push(finding);
+    }
+
+    Ok(findings)
+}
+
+fn extract_primary_span(message: &serde_json::Value) -> (String, u32) {
+    let spans = match message.get("spans").and_then(|v| v.as_array()) {
+        Some(s) => s,
+        None => return (String::new(), 0),
+    };
+
+    for span in spans {
+        if span.get("is_primary").and_then(|v| v.as_bool()) == Some(true) {
+            let file = span
+                .get("file_name")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let line = span.get("line_start").and_then(|v| v.as_u64()).unwrap_or(0) as u32;
+            return (file, line);
+        }
+    }
+
+    (String::new(), 0)
+}
+
+// ── ESLint ──────────────────────────────────────────────
+
+async fn run_eslint(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
+    // Use the project-local eslint binary directly, not npx (which can hang downloading)
+    let eslint_bin = repo_path.join("node_modules/.bin/eslint");
+    let child = Command::new(eslint_bin)
+        .args([".", "--format", "json", "--no-error-on-unmatched-pattern"])
+        .current_dir(repo_path)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|e| CoreError::Scanner {
+            scanner: "eslint".to_string(),
+            source: Box::new(e),
+        })?;
+
+    let output = run_with_timeout(child, "eslint").await?;
+
+    if output.stdout.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    let results: Vec<EslintFileResult> = serde_json::from_slice(&output.stdout).unwrap_or_default();
+
+    let mut findings = Vec::new();
+    for file_result in results {
+        for msg in file_result.messages {
+            let severity = match msg.severity {
+                2 => Severity::Medium,
+                _ => Severity::Low,
+            };
+
+            let rule_id = msg.rule_id.unwrap_or_default();
+            let fingerprint = dedup::compute_fingerprint(&[
+                repo_id,
+                "eslint",
+                &rule_id,
+                &file_result.file_path,
+                &msg.line.to_string(),
+            ]);
+
+            let mut finding = Finding::new(
+                repo_id.to_string(),
+                fingerprint,
+                "eslint".to_string(),
+                ScanType::Lint,
+                format!("[eslint] {}", msg.message),
+                msg.message,
+                severity,
+            );
+            finding.rule_id = Some(rule_id);
+            finding.file_path = Some(file_result.file_path.clone());
+            finding.line_number = Some(msg.line);
+            findings.push(finding);
+        }
+    }
+
+    Ok(findings)
+}
+
+#[derive(serde::Deserialize)]
+struct EslintFileResult {
+    #[serde(rename = "filePath")]
+    file_path: String,
+    messages: Vec<EslintMessage>,
+}
+
+#[derive(serde::Deserialize)]
+struct EslintMessage {
+    #[serde(rename = "ruleId")]
+    rule_id: Option<String>,
+    severity: u8,
+    message: String,
+    line: u32,
+}
+
+// ── Ruff ────────────────────────────────────────────────
+
+async fn run_ruff(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
+    let child = Command::new("ruff")
+        .args(["check", ".", "--output-format", "json", "--exit-zero"])
+        .current_dir(repo_path)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|e| CoreError::Scanner {
+            scanner: "ruff".to_string(),
+            source: Box::new(e),
+        })?;
+
+    let output = run_with_timeout(child, "ruff").await?;
+
+    if output.stdout.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    let results: Vec<RuffResult> = serde_json::from_slice(&output.stdout).unwrap_or_default();
+
+    let findings = results
+        .into_iter()
+        .map(|r| {
+            let severity = if r.code.starts_with('E') || r.code.starts_with('F') {
+                Severity::Medium
+            } else {
+                Severity::Low
+            };
+
+            let fingerprint = dedup::compute_fingerprint(&[
+                repo_id,
+                "ruff",
+                &r.code,
+                &r.filename,
+                &r.location.row.to_string(),
+            ]);
+
+            let mut finding = Finding::new(
+                repo_id.to_string(),
+                fingerprint,
+                "ruff".to_string(),
+                ScanType::Lint,
+                format!("[ruff] {}: {}", r.code, r.message),
+                r.message,
+                severity,
+            );
+            finding.rule_id = Some(r.code);
+            finding.file_path = Some(r.filename);
+            finding.line_number = Some(r.location.row);
+            finding
+        })
+        .collect();
+
+    Ok(findings)
+}
+
+#[derive(serde::Deserialize)]
+struct RuffResult {
+    code: String,
+    message: String,
+    filename: String,
+    location: RuffLocation,
+}
+
+#[derive(serde::Deserialize)]
+struct RuffLocation {
+    row: u32,
+}

compliance-agent/src/pipeline/lint/clippy.rs

@@ -1,251 +0,0 @@
-use std::path::Path;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-use compliance_core::CoreError;
-use tokio::process::Command;
-
-use crate::pipeline::dedup;
-
-use super::run_with_timeout;
-
-pub(super) async fn run_clippy(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
-    let child = Command::new("cargo")
-        .args([
-            "clippy",
-            "--message-format=json",
-            "--quiet",
-            "--",
-            "-W",
-            "clippy::all",
-        ])
-        .current_dir(repo_path)
-        .env("RUSTC_WRAPPER", "")
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| CoreError::Scanner {
-            scanner: "clippy".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let output = run_with_timeout(child, "clippy").await?;
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let mut findings = Vec::new();
-
-    for line in stdout.lines() {
-        let msg: serde_json::Value = match serde_json::from_str(line) {
-            Ok(v) => v,
-            Err(_) => continue,
-        };
-
-        if msg.get("reason").and_then(|v| v.as_str()) != Some("compiler-message") {
-            continue;
-        }
-
-        let message = match msg.get("message") {
-            Some(m) => m,
-            None => continue,
-        };
-
-        let level = message.get("level").and_then(|v| v.as_str()).unwrap_or("");
-
-        if level != "warning" && level != "error" {
-            continue;
-        }
-
-        let text = message
-            .get("message")
-            .and_then(|v| v.as_str())
-            .unwrap_or("")
-            .to_string();
-
-        let code = message
-            .get("code")
-            .and_then(|v| v.get("code"))
-            .and_then(|v| v.as_str())
-            .unwrap_or("")
-            .to_string();
-
-        if text.starts_with("aborting due to") || code.is_empty() {
-            continue;
-        }
-
-        let (file_path, line_number) = extract_primary_span(message);
-
-        let severity = if level == "error" {
-            Severity::High
-        } else {
-            Severity::Low
-        };
-
-        let fingerprint = dedup::compute_fingerprint(&[
-            repo_id,
-            "clippy",
-            &code,
-            &file_path,
-            &line_number.to_string(),
-        ]);
-
-        let mut finding = Finding::new(
-            repo_id.to_string(),
-            fingerprint,
-            "clippy".to_string(),
-            ScanType::Lint,
-            format!("[clippy] {text}"),
-            text,
-            severity,
-        );
-        finding.rule_id = Some(code);
-        if !file_path.is_empty() {
-            finding.file_path = Some(file_path);
-        }
-        if line_number > 0 {
-            finding.line_number = Some(line_number);
-        }
-        findings.push(finding);
-    }
-
-    Ok(findings)
-}
-
-fn extract_primary_span(message: &serde_json::Value) -> (String, u32) {
-    let spans = match message.get("spans").and_then(|v| v.as_array()) {
-        Some(s) => s,
-        None => return (String::new(), 0),
-    };
-
-    for span in spans {
-        if span.get("is_primary").and_then(|v| v.as_bool()) == Some(true) {
-            let file = span
-                .get("file_name")
-                .and_then(|v| v.as_str())
-                .unwrap_or("")
-                .to_string();
-            let line = span.get("line_start").and_then(|v| v.as_u64()).unwrap_or(0) as u32;
-            return (file, line);
-        }
-    }
-
-    (String::new(), 0)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn extract_primary_span_with_primary() {
-        let msg = serde_json::json!({
-            "spans": [
-                {
-                    "file_name": "src/lib.rs",
-                    "line_start": 42,
-                    "is_primary": true
-                }
-            ]
-        });
-        let (file, line) = extract_primary_span(&msg);
-        assert_eq!(file, "src/lib.rs");
-        assert_eq!(line, 42);
-    }
-
-    #[test]
-    fn extract_primary_span_no_primary() {
-        let msg = serde_json::json!({
-            "spans": [
-                {
-                    "file_name": "src/lib.rs",
-                    "line_start": 42,
-                    "is_primary": false
-                }
-            ]
-        });
-        let (file, line) = extract_primary_span(&msg);
-        assert_eq!(file, "");
-        assert_eq!(line, 0);
-    }
-
-    #[test]
-    fn extract_primary_span_multiple_spans() {
-        let msg = serde_json::json!({
-            "spans": [
-                {
-                    "file_name": "src/other.rs",
-                    "line_start": 10,
-                    "is_primary": false
-                },
-                {
-                    "file_name": "src/main.rs",
-                    "line_start": 99,
-                    "is_primary": true
-                }
-            ]
-        });
-        let (file, line) = extract_primary_span(&msg);
-        assert_eq!(file, "src/main.rs");
-        assert_eq!(line, 99);
-    }
-
-    #[test]
-    fn extract_primary_span_no_spans() {
-        let msg = serde_json::json!({});
-        let (file, line) = extract_primary_span(&msg);
-        assert_eq!(file, "");
-        assert_eq!(line, 0);
-    }
-
-    #[test]
-    fn extract_primary_span_empty_spans() {
-        let msg = serde_json::json!({ "spans": [] });
-        let (file, line) = extract_primary_span(&msg);
-        assert_eq!(file, "");
-        assert_eq!(line, 0);
-    }
-
-    #[test]
-    fn parse_clippy_compiler_message_line() {
-        let line = r#"{"reason":"compiler-message","message":{"level":"warning","message":"unused variable","code":{"code":"unused_variables"},"spans":[{"file_name":"src/main.rs","line_start":5,"is_primary":true}]}}"#;
-        let msg: serde_json::Value = serde_json::from_str(line).unwrap();
-
-        assert_eq!(
-            msg.get("reason").and_then(|v| v.as_str()),
-            Some("compiler-message")
-        );
-        let message = msg.get("message").unwrap();
-        assert_eq!(
-            message.get("level").and_then(|v| v.as_str()),
-            Some("warning")
-        );
-        assert_eq!(
-            message.get("message").and_then(|v| v.as_str()),
-            Some("unused variable")
-        );
-        assert_eq!(
-            message
-                .get("code")
-                .and_then(|v| v.get("code"))
-                .and_then(|v| v.as_str()),
-            Some("unused_variables")
-        );
-
-        let (file, line_num) = extract_primary_span(message);
-        assert_eq!(file, "src/main.rs");
-        assert_eq!(line_num, 5);
-    }
-
-    #[test]
-    fn skip_non_compiler_message() {
-        let line = r#"{"reason":"build-script-executed","package_id":"foo 0.1.0"}"#;
-        let msg: serde_json::Value = serde_json::from_str(line).unwrap();
-        assert_ne!(
-            msg.get("reason").and_then(|v| v.as_str()),
-            Some("compiler-message")
-        );
-    }
-
-    #[test]
-    fn skip_aborting_message() {
-        let text = "aborting due to 3 previous errors";
-        assert!(text.starts_with("aborting due to"));
-    }
-}

compliance-agent/src/pipeline/lint/eslint.rs

@@ -1,183 +0,0 @@
-use std::path::Path;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-use compliance_core::CoreError;
-use tokio::process::Command;
-
-use crate::pipeline::dedup;
-
-use super::run_with_timeout;
-
-pub(super) async fn run_eslint(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
-    // Use the project-local eslint binary directly, not npx (which can hang downloading)
-    let eslint_bin = repo_path.join("node_modules/.bin/eslint");
-    let child = Command::new(eslint_bin)
-        .args([".", "--format", "json", "--no-error-on-unmatched-pattern"])
-        .current_dir(repo_path)
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| CoreError::Scanner {
-            scanner: "eslint".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let output = run_with_timeout(child, "eslint").await?;
-
-    if output.stdout.is_empty() {
-        return Ok(Vec::new());
-    }
-
-    let results: Vec<EslintFileResult> = serde_json::from_slice(&output.stdout).unwrap_or_default();
-
-    let mut findings = Vec::new();
-    for file_result in results {
-        for msg in file_result.messages {
-            let severity = match msg.severity {
-                2 => Severity::Medium,
-                _ => Severity::Low,
-            };
-
-            let rule_id = msg.rule_id.unwrap_or_default();
-            let fingerprint = dedup::compute_fingerprint(&[
-                repo_id,
-                "eslint",
-                &rule_id,
-                &file_result.file_path,
-                &msg.line.to_string(),
-            ]);
-
-            let mut finding = Finding::new(
-                repo_id.to_string(),
-                fingerprint,
-                "eslint".to_string(),
-                ScanType::Lint,
-                format!("[eslint] {}", msg.message),
-                msg.message,
-                severity,
-            );
-            finding.rule_id = Some(rule_id);
-            finding.file_path = Some(file_result.file_path.clone());
-            finding.line_number = Some(msg.line);
-            findings.push(finding);
-        }
-    }
-
-    Ok(findings)
-}
-
-#[derive(serde::Deserialize)]
-struct EslintFileResult {
-    #[serde(rename = "filePath")]
-    file_path: String,
-    messages: Vec<EslintMessage>,
-}
-
-#[derive(serde::Deserialize)]
-struct EslintMessage {
-    #[serde(rename = "ruleId")]
-    rule_id: Option<String>,
-    severity: u8,
-    message: String,
-    line: u32,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn deserialize_eslint_output() {
-        let json = r#"[
-            {
-                "filePath": "/home/user/project/src/app.js",
-                "messages": [
-                    {
-                        "ruleId": "no-unused-vars",
-                        "severity": 2,
-                        "message": "'x' is defined but never used.",
-                        "line": 10
-                    },
-                    {
-                        "ruleId": "semi",
-                        "severity": 1,
-                        "message": "Missing semicolon.",
-                        "line": 15
-                    }
-                ]
-            }
-        ]"#;
-        let results: Vec<EslintFileResult> = serde_json::from_str(json).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].file_path, "/home/user/project/src/app.js");
-        assert_eq!(results[0].messages.len(), 2);
-
-        assert_eq!(
-            results[0].messages[0].rule_id,
-            Some("no-unused-vars".to_string())
-        );
-        assert_eq!(results[0].messages[0].severity, 2);
-        assert_eq!(results[0].messages[0].line, 10);
-
-        assert_eq!(results[0].messages[1].severity, 1);
-    }
-
-    #[test]
-    fn deserialize_eslint_null_rule_id() {
-        let json = r#"[
-            {
-                "filePath": "src/index.js",
-                "messages": [
-                    {
-                        "ruleId": null,
-                        "severity": 2,
-                        "message": "Parsing error: Unexpected token",
-                        "line": 1
-                    }
-                ]
-            }
-        ]"#;
-        let results: Vec<EslintFileResult> = serde_json::from_str(json).unwrap();
-        assert_eq!(results[0].messages[0].rule_id, None);
-    }
-
-    #[test]
-    fn deserialize_eslint_empty_messages() {
-        let json = r#"[{"filePath": "src/clean.js", "messages": []}]"#;
-        let results: Vec<EslintFileResult> = serde_json::from_str(json).unwrap();
-        assert_eq!(results[0].messages.len(), 0);
-    }
-
-    #[test]
-    fn deserialize_eslint_empty_array() {
-        let json = "[]";
-        let results: Vec<EslintFileResult> = serde_json::from_str(json).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn eslint_severity_mapping() {
-        // severity 2 = error -> Medium, anything else -> Low
-        assert_eq!(
-            match 2u8 {
-                2 => "Medium",
-                _ => "Low",
-            },
-            "Medium"
-        );
-        assert_eq!(
-            match 1u8 {
-                2 => "Medium",
-                _ => "Low",
-            },
-            "Low"
-        );
-        assert_eq!(
-            match 0u8 {
-                2 => "Medium",
-                _ => "Low",
-            },
-            "Low"
-        );
-    }
-}

compliance-agent/src/pipeline/lint/mod.rs

@@ -1,97 +0,0 @@
-mod clippy;
-mod eslint;
-mod ruff;
-
-use std::path::Path;
-use std::time::Duration;
-
-use compliance_core::models::ScanType;
-use compliance_core::traits::{ScanOutput, Scanner};
-use compliance_core::CoreError;
-
-/// Timeout for each individual lint command
-pub(crate) const LINT_TIMEOUT: Duration = Duration::from_secs(120);
-
-pub struct LintScanner;
-
-impl Scanner for LintScanner {
-    fn name(&self) -> &str {
-        "lint"
-    }
-
-    fn scan_type(&self) -> ScanType {
-        ScanType::Lint
-    }
-
-    #[tracing::instrument(skip_all)]
-    async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let mut all_findings = Vec::new();
-
-        // Detect which languages are present and run appropriate linters
-        if has_rust_project(repo_path) {
-            match clippy::run_clippy(repo_path, repo_id).await {
-                Ok(findings) => all_findings.extend(findings),
-                Err(e) => tracing::warn!("Clippy failed: {e}"),
-            }
-        }
-
-        if has_js_project(repo_path) {
-            match eslint::run_eslint(repo_path, repo_id).await {
-                Ok(findings) => all_findings.extend(findings),
-                Err(e) => tracing::warn!("ESLint failed: {e}"),
-            }
-        }
-
-        if has_python_project(repo_path) {
-            match ruff::run_ruff(repo_path, repo_id).await {
-                Ok(findings) => all_findings.extend(findings),
-                Err(e) => tracing::warn!("Ruff failed: {e}"),
-            }
-        }
-
-        Ok(ScanOutput {
-            findings: all_findings,
-            sbom_entries: Vec::new(),
-        })
-    }
-}
-
-fn has_rust_project(repo_path: &Path) -> bool {
-    repo_path.join("Cargo.toml").exists()
-}
-
-fn has_js_project(repo_path: &Path) -> bool {
-    // Only run if eslint is actually installed in the project
-    repo_path.join("package.json").exists() && repo_path.join("node_modules/.bin/eslint").exists()
-}
-
-fn has_python_project(repo_path: &Path) -> bool {
-    repo_path.join("pyproject.toml").exists()
-        || repo_path.join("setup.py").exists()
-        || repo_path.join("requirements.txt").exists()
-}
-
-/// Run a command with a timeout, returning its output or an error
-pub(crate) async fn run_with_timeout(
-    child: tokio::process::Child,
-    scanner_name: &str,
-) -> Result<std::process::Output, CoreError> {
-    let result = tokio::time::timeout(LINT_TIMEOUT, child.wait_with_output()).await;
-    match result {
-        Ok(Ok(output)) => Ok(output),
-        Ok(Err(e)) => Err(CoreError::Scanner {
-            scanner: scanner_name.to_string(),
-            source: Box::new(e),
-        }),
-        Err(_) => {
-            // Process is dropped here which sends SIGKILL on Unix
-            Err(CoreError::Scanner {
-                scanner: scanner_name.to_string(),
-                source: Box::new(std::io::Error::new(
-                    std::io::ErrorKind::TimedOut,
-                    format!("{scanner_name} timed out after {}s", LINT_TIMEOUT.as_secs()),
-                )),
-            })
-        }
-    }
-}

compliance-agent/src/pipeline/lint/ruff.rs

@@ -1,150 +0,0 @@
-use std::path::Path;
-
-use compliance_core::models::{Finding, ScanType, Severity};
-use compliance_core::CoreError;
-use tokio::process::Command;
-
-use crate::pipeline::dedup;
-
-use super::run_with_timeout;
-
-pub(super) async fn run_ruff(repo_path: &Path, repo_id: &str) -> Result<Vec<Finding>, CoreError> {
-    let child = Command::new("ruff")
-        .args(["check", ".", "--output-format", "json", "--exit-zero"])
-        .current_dir(repo_path)
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| CoreError::Scanner {
-            scanner: "ruff".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let output = run_with_timeout(child, "ruff").await?;
-
-    if output.stdout.is_empty() {
-        return Ok(Vec::new());
-    }
-
-    let results: Vec<RuffResult> = serde_json::from_slice(&output.stdout).unwrap_or_default();
-
-    let findings = results
-        .into_iter()
-        .map(|r| {
-            let severity = if r.code.starts_with('E') || r.code.starts_with('F') {
-                Severity::Medium
-            } else {
-                Severity::Low
-            };
-
-            let fingerprint = dedup::compute_fingerprint(&[
-                repo_id,
-                "ruff",
-                &r.code,
-                &r.filename,
-                &r.location.row.to_string(),
-            ]);
-
-            let mut finding = Finding::new(
-                repo_id.to_string(),
-                fingerprint,
-                "ruff".to_string(),
-                ScanType::Lint,
-                format!("[ruff] {}: {}", r.code, r.message),
-                r.message,
-                severity,
-            );
-            finding.rule_id = Some(r.code);
-            finding.file_path = Some(r.filename);
-            finding.line_number = Some(r.location.row);
-            finding
-        })
-        .collect();
-
-    Ok(findings)
-}
-
-#[derive(serde::Deserialize)]
-struct RuffResult {
-    code: String,
-    message: String,
-    filename: String,
-    location: RuffLocation,
-}
-
-#[derive(serde::Deserialize)]
-struct RuffLocation {
-    row: u32,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn deserialize_ruff_output() {
-        let json = r#"[
-            {
-                "code": "E501",
-                "message": "Line too long (120 > 79 characters)",
-                "filename": "src/main.py",
-                "location": {"row": 42}
-            },
-            {
-                "code": "F401",
-                "message": "`os` imported but unused",
-                "filename": "src/utils.py",
-                "location": {"row": 1}
-            }
-        ]"#;
-        let results: Vec<RuffResult> = serde_json::from_str(json).unwrap();
-        assert_eq!(results.len(), 2);
-
-        assert_eq!(results[0].code, "E501");
-        assert_eq!(results[0].filename, "src/main.py");
-        assert_eq!(results[0].location.row, 42);
-
-        assert_eq!(results[1].code, "F401");
-        assert_eq!(results[1].location.row, 1);
-    }
-
-    #[test]
-    fn deserialize_ruff_empty() {
-        let json = "[]";
-        let results: Vec<RuffResult> = serde_json::from_str(json).unwrap();
-        assert!(results.is_empty());
-    }
-
-    #[test]
-    fn ruff_severity_e_and_f_are_medium() {
-        for code in &["E501", "E302", "F401", "F811"] {
-            let is_medium = code.starts_with('E') || code.starts_with('F');
-            assert!(is_medium, "Expected {code} to be Medium severity");
-        }
-    }
-
-    #[test]
-    fn ruff_severity_others_are_low() {
-        for code in &["W291", "I001", "D100", "C901", "N801"] {
-            let is_medium = code.starts_with('E') || code.starts_with('F');
-            assert!(!is_medium, "Expected {code} to be Low severity");
-        }
-    }
-
-    #[test]
-    fn deserialize_ruff_with_extra_fields() {
-        // Ruff output may contain additional fields we don't use
-        let json = r#"[{
-            "code": "W291",
-            "message": "Trailing whitespace",
-            "filename": "app.py",
-            "location": {"row": 3, "column": 10},
-            "end_location": {"row": 3, "column": 11},
-            "fix": null,
-            "noqa_row": 3
-        }]"#;
-        let results: Vec<RuffResult> = serde_json::from_str(json).unwrap();
-        assert_eq!(results.len(), 1);
-        assert_eq!(results[0].code, "W291");
-    }
-}

compliance-agent/src/pipeline/mod.rs

@@ -3,12 +3,8 @@ pub mod cve;
 pub mod dedup;
 pub mod git;
 pub mod gitleaks;
-mod graph_build;
-mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
-mod pr_review;
 pub mod sbom;
 pub mod semgrep;
-mod tracker_dispatch;

compliance-agent/src/pipeline/orchestrator.rs

@@ -4,12 +4,14 @@ use mongodb::bson::doc;
 use tracing::Instrument;
 
 use compliance_core::models::*;
+use compliance_core::traits::issue_tracker::IssueTracker;
 use compliance_core::traits::Scanner;
 use compliance_core::AgentConfig;
 
 use crate::database::Database;
 use crate::error::AgentError;
 use crate::llm::LlmClient;
+use crate::pipeline::code_review::CodeReviewScanner;
 use crate::pipeline::cve::CveScanner;
 use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
@@ -17,6 +19,84 @@ use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
+use crate::trackers;
+
+/// Enum dispatch for issue trackers (async traits aren't dyn-compatible).
+enum TrackerDispatch {
+    GitHub(trackers::github::GitHubTracker),
+    GitLab(trackers::gitlab::GitLabTracker),
+    Gitea(trackers::gitea::GiteaTracker),
+    Jira(trackers::jira::JiraTracker),
+}
+
+impl TrackerDispatch {
+    fn name(&self) -> &str {
+        match self {
+            Self::GitHub(t) => t.name(),
+            Self::GitLab(t) => t.name(),
+            Self::Gitea(t) => t.name(),
+            Self::Jira(t) => t.name(),
+        }
+    }
+
+    async fn create_issue(
+        &self,
+        owner: &str,
+        repo: &str,
+        title: &str,
+        body: &str,
+        labels: &[String],
+    ) -> Result<TrackerIssue, compliance_core::error::CoreError> {
+        match self {
+            Self::GitHub(t) => t.create_issue(owner, repo, title, body, labels).await,
+            Self::GitLab(t) => t.create_issue(owner, repo, title, body, labels).await,
+            Self::Gitea(t) => t.create_issue(owner, repo, title, body, labels).await,
+            Self::Jira(t) => t.create_issue(owner, repo, title, body, labels).await,
+        }
+    }
+
+    async fn find_existing_issue(
+        &self,
+        owner: &str,
+        repo: &str,
+        fingerprint: &str,
+    ) -> Result<Option<TrackerIssue>, compliance_core::error::CoreError> {
+        match self {
+            Self::GitHub(t) => t.find_existing_issue(owner, repo, fingerprint).await,
+            Self::GitLab(t) => t.find_existing_issue(owner, repo, fingerprint).await,
+            Self::Gitea(t) => t.find_existing_issue(owner, repo, fingerprint).await,
+            Self::Jira(t) => t.find_existing_issue(owner, repo, fingerprint).await,
+        }
+    }
+
+    async fn create_pr_review(
+        &self,
+        owner: &str,
+        repo: &str,
+        pr_number: u64,
+        body: &str,
+        comments: Vec<compliance_core::traits::issue_tracker::ReviewComment>,
+    ) -> Result<(), compliance_core::error::CoreError> {
+        match self {
+            Self::GitHub(t) => {
+                t.create_pr_review(owner, repo, pr_number, body, comments)
+                    .await
+            }
+            Self::GitLab(t) => {
+                t.create_pr_review(owner, repo, pr_number, body, comments)
+                    .await
+            }
+            Self::Gitea(t) => {
+                t.create_pr_review(owner, repo, pr_number, body, comments)
+                    .await
+            }
+            Self::Jira(t) => {
+                t.create_pr_review(owner, repo, pr_number, body, comments)
+                    .await
+            }
+        }
+    }
+}
 
 /// Context from graph analysis passed to LLM triage for enhanced filtering
 #[derive(Debug)]
@@ -29,10 +109,10 @@ pub struct GraphContext {
 }
 
 pub struct PipelineOrchestrator {
-    pub(super) config: AgentConfig,
+    config: AgentConfig,
-    pub(super) db: Database,
+    db: Database,
-    pub(super) llm: Arc<LlmClient>,
+    llm: Arc<LlmClient>,
-    pub(super) http: reqwest::Client,
+    http: reqwest::Client,
 }
 
 impl PipelineOrchestrator {
@@ -174,26 +254,19 @@ impl PipelineOrchestrator {
                 k.expose_secret().to_string()
             }),
         );
-        let cve_alerts = match tokio::time::timeout(
+        let cve_alerts = match async {
-            std::time::Duration::from_secs(600),
+            cve_scanner
-            async {
+                .scan_dependencies(&repo_id, &mut sbom_entries)
-                cve_scanner
+                .await
-                    .scan_dependencies(&repo_id, &mut sbom_entries)
+        }
-                    .await
+        .instrument(tracing::info_span!("stage_cve_scanning"))
-            }
-            .instrument(tracing::info_span!("stage_cve_scanning")),
-        )
         .await
         {
-            Ok(Ok(alerts)) => alerts,
+            Ok(alerts) => alerts,
-            Ok(Err(e)) => {
+            Err(e) => {
                 tracing::warn!("[{repo_id}] CVE scanning failed: {e}");
                 Vec::new()
             }
-            Err(_) => {
-                tracing::warn!("[{repo_id}] CVE scanning timed out after 10 minutes");
-                Vec::new()
-            }
         };
 
         // Stage 4: Pattern Scanning (GDPR + OAuth)
@@ -247,6 +320,21 @@ impl PipelineOrchestrator {
             Err(e) => tracing::warn!("[{repo_id}] Lint scanning failed: {e}"),
         }
 
+        // Stage 4c: LLM Code Review (only on incremental scans)
+        if let Some(old_sha) = &repo.last_scanned_commit {
+            tracing::info!("[{repo_id}] Stage 4c: LLM Code Review");
+            self.update_phase(scan_run_id, "code_review").await;
+            let review_output = async {
+                let reviewer = CodeReviewScanner::new(self.llm.clone());
+                reviewer
+                    .review_diff(&repo_path, &repo_id, old_sha, &current_sha)
+                    .await
+            }
+            .instrument(tracing::info_span!("stage_code_review"))
+            .await;
+            all_findings.extend(review_output.findings);
+        }
+
         // Stage 4.5: Graph Building
         tracing::info!("[{repo_id}] Stage 4.5: Graph Building");
         self.update_phase(scan_run_id, "graph_building").await;
@@ -322,67 +410,20 @@ impl PipelineOrchestrator {
                 .await?;
         }
 
-        // Persist CVE alerts and create notifications
+        // Persist CVE alerts (upsert by cve_id + repo_id)
-        {
+        for alert in &cve_alerts {
-            use compliance_core::models::notification::{parse_severity, CveNotification};
+            let filter = doc! {
-
+                "cve_id": &alert.cve_id,
-            let repo_name = repo.name.clone();
+                "repo_id": &alert.repo_id,
-            let mut new_notif_count = 0u32;
+            };
-
+            let update = mongodb::bson::to_document(alert)
-            for alert in &cve_alerts {
+                .map(|d| doc! { "$set": d })
-                // Upsert the alert
+                .unwrap_or_else(|_| doc! {});
-                let filter = doc! {
+            self.db
-                    "cve_id": &alert.cve_id,
+                .cve_alerts()
-                    "repo_id": &alert.repo_id,
+                .update_one(filter, update)
-                };
+                .upsert(true)
-                let update = mongodb::bson::to_document(alert)
+                .await?;
-                    .map(|d| doc! { "$set": d })
-                    .unwrap_or_else(|_| doc! {});
-                self.db
-                    .cve_alerts()
-                    .update_one(filter, update)
-                    .upsert(true)
-                    .await?;
-
-                // Create notification (dedup by cve_id + repo + package + version)
-                let notif_filter = doc! {
-                    "cve_id": &alert.cve_id,
-                    "repo_id": &alert.repo_id,
-                    "package_name": &alert.affected_package,
-                    "package_version": &alert.affected_version,
-                };
-                let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
-                let mut notification = CveNotification::new(
-                    alert.cve_id.clone(),
-                    repo_id.clone(),
-                    repo_name.clone(),
-                    alert.affected_package.clone(),
-                    alert.affected_version.clone(),
-                    severity,
-                );
-                notification.cvss_score = alert.cvss_score;
-                notification.summary = alert.summary.clone();
-                notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
-
-                let notif_update = doc! {
-                    "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
-                };
-                if let Ok(result) = self
-                    .db
-                    .cve_notifications()
-                    .update_one(notif_filter, notif_update)
-                    .upsert(true)
-                    .await
-                {
-                    if result.upserted_id.is_some() {
-                        new_notif_count += 1;
-                    }
-                }
-            }
-
-            if new_notif_count > 0 {
-                tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
-            }
         }
 
         // Stage 6: Issue Creation
@@ -419,7 +460,446 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
-    pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
+    /// Build the code knowledge graph for a repo and compute impact analyses
+    async fn build_code_graph(
+        &self,
+        repo_path: &std::path::Path,
+        repo_id: &str,
+        findings: &[Finding],
+    ) -> Result<GraphContext, AgentError> {
+        let graph_build_id = uuid::Uuid::new_v4().to_string();
+        let engine = compliance_graph::GraphEngine::new(50_000);
+
+        let (mut code_graph, build_run) =
+            engine
+                .build_graph(repo_path, repo_id, &graph_build_id)
+                .map_err(|e| AgentError::Other(format!("Graph build error: {e}")))?;
+
+        // Apply community detection
+        compliance_graph::graph::community::apply_communities(&mut code_graph);
+
+        // Store graph in MongoDB
+        let store = compliance_graph::graph::persistence::GraphStore::new(self.db.inner());
+        store
+            .delete_repo_graph(repo_id)
+            .await
+            .map_err(|e| AgentError::Other(format!("Graph cleanup error: {e}")))?;
+        store
+            .store_graph(&build_run, &code_graph.nodes, &code_graph.edges)
+            .await
+            .map_err(|e| AgentError::Other(format!("Graph store error: {e}")))?;
+
+        // Compute impact analysis for each finding
+        let analyzer = compliance_graph::GraphEngine::impact_analyzer(&code_graph);
+        let mut impacts = Vec::new();
+
+        for finding in findings {
+            if let Some(file_path) = &finding.file_path {
+                let impact = analyzer.analyze(
+                    repo_id,
+                    &finding.fingerprint,
+                    &graph_build_id,
+                    file_path,
+                    finding.line_number,
+                );
+                store
+                    .store_impact(&impact)
+                    .await
+                    .map_err(|e| AgentError::Other(format!("Impact store error: {e}")))?;
+                impacts.push(impact);
+            }
+        }
+
+        Ok(GraphContext {
+            node_count: build_run.node_count,
+            edge_count: build_run.edge_count,
+            community_count: build_run.community_count,
+            impacts,
+        })
+    }
+
+    /// Trigger DAST scan if a target is configured for this repo
+    async fn maybe_trigger_dast(&self, repo_id: &str, scan_run_id: &str) {
+        use futures_util::TryStreamExt;
+
+        let filter = mongodb::bson::doc! { "repo_id": repo_id };
+        let targets: Vec<compliance_core::models::DastTarget> =
+            match self.db.dast_targets().find(filter).await {
+                Ok(cursor) => cursor.try_collect().await.unwrap_or_default(),
+                Err(_) => return,
+            };
+
+        if targets.is_empty() {
+            tracing::info!("[{repo_id}] No DAST targets configured, skipping");
+            return;
+        }
+
+        for target in targets {
+            let db = self.db.clone();
+            let scan_run_id = scan_run_id.to_string();
+            tokio::spawn(async move {
+                let orchestrator = compliance_dast::DastOrchestrator::new(100);
+                match orchestrator.run_scan(&target, Vec::new()).await {
+                    Ok((mut scan_run, findings)) => {
+                        scan_run.sast_scan_run_id = Some(scan_run_id);
+                        if let Err(e) = db.dast_scan_runs().insert_one(&scan_run).await {
+                            tracing::error!("Failed to store DAST scan run: {e}");
+                        }
+                        for finding in &findings {
+                            if let Err(e) = db.dast_findings().insert_one(finding).await {
+                                tracing::error!("Failed to store DAST finding: {e}");
+                            }
+                        }
+                        tracing::info!("DAST scan complete: {} findings", findings.len());
+                    }
+                    Err(e) => {
+                        tracing::error!("DAST scan failed: {e}");
+                    }
+                }
+            });
+        }
+    }
+
+    /// Build an issue tracker client from a repository's tracker configuration.
+    /// Returns `None` if the repo has no tracker configured.
+    fn build_tracker(&self, repo: &TrackedRepository) -> Option<TrackerDispatch> {
+        let tracker_type = repo.tracker_type.as_ref()?;
+        // Per-repo token takes precedence, fall back to global config
+        match tracker_type {
+            TrackerType::GitHub => {
+                let token = repo.tracker_token.clone().or_else(|| {
+                    self.config.github_token.as_ref().map(|t| {
+                        use secrecy::ExposeSecret;
+                        t.expose_secret().to_string()
+                    })
+                })?;
+                let secret = secrecy::SecretString::from(token);
+                match trackers::github::GitHubTracker::new(&secret) {
+                    Ok(t) => Some(TrackerDispatch::GitHub(t)),
+                    Err(e) => {
+                        tracing::warn!("Failed to build GitHub tracker: {e}");
+                        None
+                    }
+                }
+            }
+            TrackerType::GitLab => {
+                let base_url = self
+                    .config
+                    .gitlab_url
+                    .clone()
+                    .unwrap_or_else(|| "https://gitlab.com".to_string());
+                let token = repo.tracker_token.clone().or_else(|| {
+                    self.config.gitlab_token.as_ref().map(|t| {
+                        use secrecy::ExposeSecret;
+                        t.expose_secret().to_string()
+                    })
+                })?;
+                let secret = secrecy::SecretString::from(token);
+                Some(TrackerDispatch::GitLab(
+                    trackers::gitlab::GitLabTracker::new(base_url, secret),
+                ))
+            }
+            TrackerType::Gitea => {
+                let token = repo.tracker_token.clone()?;
+                let base_url = extract_base_url(&repo.git_url)?;
+                let secret = secrecy::SecretString::from(token);
+                Some(TrackerDispatch::Gitea(trackers::gitea::GiteaTracker::new(
+                    base_url, secret,
+                )))
+            }
+            TrackerType::Jira => {
+                let base_url = self.config.jira_url.clone()?;
+                let email = self.config.jira_email.clone()?;
+                let project_key = self.config.jira_project_key.clone()?;
+                let token = repo.tracker_token.clone().or_else(|| {
+                    self.config.jira_api_token.as_ref().map(|t| {
+                        use secrecy::ExposeSecret;
+                        t.expose_secret().to_string()
+                    })
+                })?;
+                let secret = secrecy::SecretString::from(token);
+                Some(TrackerDispatch::Jira(trackers::jira::JiraTracker::new(
+                    base_url,
+                    email,
+                    secret,
+                    project_key,
+                )))
+            }
+        }
+    }
+
+    /// Create tracker issues for new findings (severity >= Medium).
+    /// Checks for duplicates via fingerprint search before creating.
+    #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
+    async fn create_tracker_issues(
+        &self,
+        repo: &TrackedRepository,
+        repo_id: &str,
+        new_findings: &[Finding],
+    ) -> Result<(), AgentError> {
+        let tracker = match self.build_tracker(repo) {
+            Some(t) => t,
+            None => {
+                tracing::info!("[{repo_id}] No issue tracker configured, skipping");
+                return Ok(());
+            }
+        };
+
+        let owner = match repo.tracker_owner.as_deref() {
+            Some(o) => o,
+            None => {
+                tracing::warn!("[{repo_id}] tracker_owner not set, skipping issue creation");
+                return Ok(());
+            }
+        };
+        let tracker_repo_name = match repo.tracker_repo.as_deref() {
+            Some(r) => r,
+            None => {
+                tracing::warn!("[{repo_id}] tracker_repo not set, skipping issue creation");
+                return Ok(());
+            }
+        };
+
+        // Only create issues for medium+ severity findings
+        let actionable: Vec<&Finding> = new_findings
+            .iter()
+            .filter(|f| {
+                matches!(
+                    f.severity,
+                    Severity::Medium | Severity::High | Severity::Critical
+                )
+            })
+            .collect();
+
+        if actionable.is_empty() {
+            tracing::info!("[{repo_id}] No medium+ findings, skipping issue creation");
+            return Ok(());
+        }
+
+        tracing::info!(
+            "[{repo_id}] Creating issues for {} findings via {}",
+            actionable.len(),
+            tracker.name()
+        );
+
+        let mut created = 0u32;
+        for finding in actionable {
+            let title = format!(
+                "[{}] {}: {}",
+                finding.severity, finding.scanner, finding.title
+            );
+
+            // Check if an issue already exists by fingerprint first, then by title
+            let mut found_existing = false;
+            for search_term in [&finding.fingerprint, &title] {
+                match tracker
+                    .find_existing_issue(owner, tracker_repo_name, search_term)
+                    .await
+                {
+                    Ok(Some(existing)) => {
+                        tracing::debug!(
+                            "[{repo_id}] Issue already exists for '{}': {}",
+                            search_term,
+                            existing.external_url
+                        );
+                        found_existing = true;
+                        break;
+                    }
+                    Ok(None) => {}
+                    Err(e) => {
+                        tracing::warn!("[{repo_id}] Failed to search for existing issue: {e}");
+                    }
+                }
+            }
+            if found_existing {
+                continue;
+            }
+            let body = format_issue_body(finding);
+            let labels = vec![
+                format!("severity:{}", finding.severity),
+                format!("scanner:{}", finding.scanner),
+                "compliance-scanner".to_string(),
+            ];
+
+            match tracker
+                .create_issue(owner, tracker_repo_name, &title, &body, &labels)
+                .await
+            {
+                Ok(mut issue) => {
+                    issue.finding_id = finding
+                        .id
+                        .as_ref()
+                        .map(|id| id.to_hex())
+                        .unwrap_or_default();
+
+                    // Update the finding with the issue URL
+                    if let Some(finding_id) = &finding.id {
+                        let _ = self
+                            .db
+                            .findings()
+                            .update_one(
+                                doc! { "_id": finding_id },
+                                doc! { "$set": { "tracker_issue_url": &issue.external_url } },
+                            )
+                            .await;
+                    }
+
+                    // Store the tracker issue record
+                    if let Err(e) = self.db.tracker_issues().insert_one(&issue).await {
+                        tracing::warn!("[{repo_id}] Failed to store tracker issue: {e}");
+                    }
+
+                    created += 1;
+                }
+                Err(e) => {
+                    tracing::warn!(
+                        "[{repo_id}] Failed to create issue for {}: {e}",
+                        finding.fingerprint
+                    );
+                }
+            }
+        }
+
+        tracing::info!("[{repo_id}] Created {created} tracker issues");
+        Ok(())
+    }
+
+    /// Run an incremental scan on a PR diff and post review comments.
+    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, pr_number))]
+    pub async fn run_pr_review(
+        &self,
+        repo: &TrackedRepository,
+        repo_id: &str,
+        pr_number: u64,
+        base_sha: &str,
+        head_sha: &str,
+    ) -> Result<(), AgentError> {
+        let tracker = match self.build_tracker(repo) {
+            Some(t) => t,
+            None => {
+                tracing::warn!("[{repo_id}] No tracker configured, cannot post PR review");
+                return Ok(());
+            }
+        };
+        let owner = repo.tracker_owner.as_deref().unwrap_or("");
+        let tracker_repo_name = repo.tracker_repo.as_deref().unwrap_or("");
+        if owner.is_empty() || tracker_repo_name.is_empty() {
+            tracing::warn!("[{repo_id}] tracker_owner or tracker_repo not set");
+            return Ok(());
+        }
+
+        // Clone/fetch the repo
+        let creds = GitOps::make_repo_credentials(&self.config, repo);
+        let git_ops = GitOps::new(&self.config.git_clone_base_path, creds);
+        let repo_path = git_ops.clone_or_fetch(&repo.git_url, &repo.name)?;
+
+        // Get diff between base and head
+        let diff_files = GitOps::get_diff_content(&repo_path, base_sha, head_sha)?;
+        if diff_files.is_empty() {
+            tracing::info!("[{repo_id}] PR #{pr_number}: no diff files, skipping review");
+            return Ok(());
+        }
+
+        // Run semgrep on the full repo but we'll filter findings to changed files
+        let changed_paths: std::collections::HashSet<String> =
+            diff_files.iter().map(|f| f.path.clone()).collect();
+
+        let mut pr_findings: Vec<Finding> = Vec::new();
+
+        // SAST scan (semgrep)
+        match SemgrepScanner.scan(&repo_path, repo_id).await {
+            Ok(output) => {
+                for f in output.findings {
+                    if let Some(fp) = &f.file_path {
+                        if changed_paths.contains(fp.as_str()) {
+                            pr_findings.push(f);
+                        }
+                    }
+                }
+            }
+            Err(e) => tracing::warn!("[{repo_id}] PR semgrep failed: {e}"),
+        }
+
+        // LLM code review on the diff
+        let reviewer = CodeReviewScanner::new(self.llm.clone());
+        let review_output = reviewer
+            .review_diff(&repo_path, repo_id, base_sha, head_sha)
+            .await;
+        pr_findings.extend(review_output.findings);
+
+        if pr_findings.is_empty() {
+            // Post a clean review
+            if let Err(e) = tracker
+                .create_pr_review(
+                    owner,
+                    tracker_repo_name,
+                    pr_number,
+                    "Compliance scan: no issues found in this PR.",
+                    Vec::new(),
+                )
+                .await
+            {
+                tracing::warn!("[{repo_id}] Failed to post clean PR review: {e}");
+            }
+            return Ok(());
+        }
+
+        // Build review comments from findings
+        let mut review_comments = Vec::new();
+        for finding in &pr_findings {
+            if let (Some(path), Some(line)) = (&finding.file_path, finding.line_number) {
+                let comment_body = format!(
+                    "**[{}] {}**\n\n{}\n\n*Scanner: {} | {}*",
+                    finding.severity,
+                    finding.title,
+                    finding.description,
+                    finding.scanner,
+                    finding
+                        .cwe
+                        .as_deref()
+                        .map(|c| format!("CWE: {c}"))
+                        .unwrap_or_default(),
+                );
+                review_comments.push(compliance_core::traits::issue_tracker::ReviewComment {
+                    path: path.clone(),
+                    line,
+                    body: comment_body,
+                });
+            }
+        }
+
+        let summary = format!(
+            "Compliance scan found **{}** issue(s) in this PR:\n\n{}",
+            pr_findings.len(),
+            pr_findings
+                .iter()
+                .map(|f| format!("- **[{}]** {}: {}", f.severity, f.scanner, f.title))
+                .collect::<Vec<_>>()
+                .join("\n"),
+        );
+
+        if let Err(e) = tracker
+            .create_pr_review(
+                owner,
+                tracker_repo_name,
+                pr_number,
+                &summary,
+                review_comments,
+            )
+            .await
+        {
+            tracing::warn!("[{repo_id}] Failed to post PR review: {e}");
+        } else {
+            tracing::info!(
+                "[{repo_id}] Posted PR review on #{pr_number} with {} findings",
+                pr_findings.len()
+            );
+        }
+
+        Ok(())
+    }
+
+    async fn update_phase(&self, scan_run_id: &str, phase: &str) {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
             let _ = self
                 .db
@@ -437,9 +917,9 @@ impl PipelineOrchestrator {
 }
 
 /// Extract the scheme + host from a git URL.
-/// e.g. "https://gitea.example.com/owner/repo.git" -> "https://gitea.example.com"
+/// e.g. "https://gitea.example.com/owner/repo.git" → "https://gitea.example.com"
-/// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" -> "https://gitea.example.com"
+/// e.g. "ssh://git@gitea.example.com:22/owner/repo.git" → "https://gitea.example.com"
-pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
+fn extract_base_url(git_url: &str) -> Option<String> {
     if let Some(rest) = git_url.strip_prefix("https://") {
         let host = rest.split('/').next()?;
         Some(format!("https://{host}"))
@@ -447,7 +927,7 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
         let host = rest.split('/').next()?;
         Some(format!("http://{host}"))
     } else if let Some(rest) = git_url.strip_prefix("ssh://") {
-        // ssh://git@host:port/path -> extract host
+        // ssh://git@host:port/path → extract host
         let after_at = rest.find('@').map(|i| &rest[i + 1..]).unwrap_or(rest);
         let host = after_at.split(&[':', '/'][..]).next()?;
         Some(format!("https://{host}"))
@@ -460,3 +940,48 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
         None
     }
 }
+
+/// Format a finding into a markdown issue body for the tracker.
+fn format_issue_body(finding: &Finding) -> String {
+    let mut body = String::new();
+
+    body.push_str(&format!("## {} Finding\n\n", finding.severity));
+    body.push_str(&format!("**Scanner:** {}\n", finding.scanner));
+    body.push_str(&format!("**Severity:** {}\n", finding.severity));
+
+    if let Some(rule) = &finding.rule_id {
+        body.push_str(&format!("**Rule:** {}\n", rule));
+    }
+    if let Some(cwe) = &finding.cwe {
+        body.push_str(&format!("**CWE:** {}\n", cwe));
+    }
+
+    body.push_str(&format!("\n### Description\n\n{}\n", finding.description));
+
+    if let Some(file_path) = &finding.file_path {
+        body.push_str(&format!("\n### Location\n\n**File:** `{}`", file_path));
+        if let Some(line) = finding.line_number {
+            body.push_str(&format!(" (line {})", line));
+        }
+        body.push('\n');
+    }
+
+    if let Some(snippet) = &finding.code_snippet {
+        body.push_str(&format!("\n### Code\n\n```\n{}\n```\n", snippet));
+    }
+
+    if let Some(remediation) = &finding.remediation {
+        body.push_str(&format!("\n### Remediation\n\n{}\n", remediation));
+    }
+
+    if let Some(fix) = &finding.suggested_fix {
+        body.push_str(&format!("\n### Suggested Fix\n\n```\n{}\n```\n", fix));
+    }
+
+    body.push_str(&format!(
+        "\n---\n*Fingerprint:* `{}`\n*Generated by compliance-scanner*",
+        finding.fingerprint
+    ));
+
+    body
+}

compliance-agent/src/pipeline/patterns.rs

@@ -33,7 +33,6 @@ struct PatternRule {
     file_extensions: Vec<String>,
 }
 
-#[allow(clippy::new_without_default)]
 impl GdprPatternScanner {
     pub fn new() -> Self {
         let patterns = vec![
@@ -99,7 +98,6 @@ impl Scanner for GdprPatternScanner {
     }
 }
 
-#[allow(clippy::new_without_default)]
 impl OAuthPatternScanner {
     pub fn new() -> Self {
         let patterns = vec![
@@ -215,7 +213,7 @@ fn scan_with_patterns(
                         repo_id.to_string(),
                         fingerprint,
                         scanner_name.to_string(),
-                        scan_type,
+                        scan_type.clone(),
                         pattern.title.clone(),
                         pattern.description.clone(),
                         pattern.severity.clone(),
@@ -258,159 +256,3 @@ fn walkdir(path: &Path) -> Result<Vec<walkdir::DirEntry>, CoreError> {
 
     Ok(entries)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // --- compile_regex tests ---
-
-    #[test]
-    fn compile_regex_valid_pattern() {
-        let re = compile_regex(r"\bfoo\b");
-        assert!(re.is_match("hello foo bar"));
-        assert!(!re.is_match("foobar"));
-    }
-
-    #[test]
-    fn compile_regex_invalid_pattern_returns_fallback() {
-        // An invalid regex should return the fallback "^$" that only matches empty strings
-        let re = compile_regex(r"[invalid");
-        assert!(re.is_match(""));
-        assert!(!re.is_match("anything"));
-    }
-
-    // --- GDPR pattern tests ---
-
-    #[test]
-    fn gdpr_pii_logging_matches() {
-        let scanner = GdprPatternScanner::new();
-        let pattern = &scanner.patterns[0]; // gdpr-pii-logging
-                                            // Regex: (log|print|console\.|logger\.|tracing::)\s*[\.(].*\b(pii_keyword)\b
-        assert!(pattern.pattern.is_match("console.log(email)"));
-        assert!(pattern.pattern.is_match("console.log(user.ssn)"));
-        assert!(pattern.pattern.is_match("print(phone_number)"));
-        assert!(pattern.pattern.is_match("tracing::(ip_addr)"));
-        assert!(pattern.pattern.is_match("log.debug(credit_card)"));
-    }
-
-    #[test]
-    fn gdpr_pii_logging_no_false_positive() {
-        let scanner = GdprPatternScanner::new();
-        let pattern = &scanner.patterns[0];
-        // Regular logging without PII fields should not match
-        assert!(!pattern
-            .pattern
-            .is_match("logger.info(\"request completed\")"));
-        assert!(!pattern.pattern.is_match("let email = user.email;"));
-    }
-
-    #[test]
-    fn gdpr_no_consent_matches() {
-        let scanner = GdprPatternScanner::new();
-        let pattern = &scanner.patterns[1]; // gdpr-no-consent
-        assert!(pattern.pattern.is_match("collect personal data"));
-        assert!(pattern.pattern.is_match("store user_data in db"));
-        assert!(pattern.pattern.is_match("save pii to disk"));
-    }
-
-    #[test]
-    fn gdpr_user_model_matches() {
-        let scanner = GdprPatternScanner::new();
-        let pattern = &scanner.patterns[2]; // gdpr-no-delete-endpoint
-        assert!(pattern.pattern.is_match("struct User {"));
-        assert!(pattern.pattern.is_match("class User(Model):"));
-    }
-
-    #[test]
-    fn gdpr_hardcoded_retention_matches() {
-        let scanner = GdprPatternScanner::new();
-        let pattern = &scanner.patterns[3]; // gdpr-hardcoded-retention
-        assert!(pattern.pattern.is_match("retention = 30"));
-        assert!(pattern.pattern.is_match("ttl: 3600"));
-        assert!(pattern.pattern.is_match("expire = 86400"));
-    }
-
-    // --- OAuth pattern tests ---
-
-    #[test]
-    fn oauth_implicit_grant_matches() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[0]; // oauth-implicit-grant
-        assert!(pattern.pattern.is_match("response_type = \"token\""));
-        assert!(pattern.pattern.is_match("grant_type: implicit"));
-        assert!(pattern.pattern.is_match("response_type='token'"));
-    }
-
-    #[test]
-    fn oauth_implicit_grant_no_false_positive() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[0];
-        assert!(!pattern.pattern.is_match("response_type = \"code\""));
-        assert!(!pattern.pattern.is_match("grant_type: authorization_code"));
-    }
-
-    #[test]
-    fn oauth_authorization_code_matches() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[1]; // oauth-missing-pkce
-        assert!(pattern.pattern.is_match("uses authorization_code flow"));
-        assert!(pattern.pattern.is_match("authorization code grant"));
-    }
-
-    #[test]
-    fn oauth_token_localstorage_matches() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[2]; // oauth-token-localstorage
-        assert!(pattern
-            .pattern
-            .is_match("localStorage.setItem('access_token', tok)"));
-        assert!(pattern
-            .pattern
-            .is_match("localStorage.getItem(\"refresh_token\")"));
-    }
-
-    #[test]
-    fn oauth_token_localstorage_no_false_positive() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[2];
-        assert!(!pattern
-            .pattern
-            .is_match("localStorage.setItem('theme', 'dark')"));
-        assert!(!pattern
-            .pattern
-            .is_match("sessionStorage.setItem('token', t)"));
-    }
-
-    #[test]
-    fn oauth_token_url_matches() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[3]; // oauth-token-url
-        assert!(pattern.pattern.is_match("access_token = build_url(query)"));
-        assert!(pattern.pattern.is_match("bearer = url.param"));
-    }
-
-    // --- Pattern rule file extension filtering ---
-
-    #[test]
-    fn gdpr_patterns_cover_common_languages() {
-        let scanner = GdprPatternScanner::new();
-        for pattern in &scanner.patterns {
-            assert!(
-                pattern.file_extensions.contains(&"rs".to_string()),
-                "Pattern {} should cover .rs files",
-                pattern.id
-            );
-        }
-    }
-
-    #[test]
-    fn oauth_localstorage_only_js_ts() {
-        let scanner = OAuthPatternScanner::new();
-        let pattern = &scanner.patterns[2]; // oauth-token-localstorage
-        assert!(pattern.file_extensions.contains(&"js".to_string()));
-        assert!(pattern.file_extensions.contains(&"ts".to_string()));
-        assert!(!pattern.file_extensions.contains(&"rs".to_string()));
-        assert!(!pattern.file_extensions.contains(&"py".to_string()));
-    }
-}

compliance-agent/src/pipeline/pr_review.rs

@@ -1,183 +0,0 @@
-use compliance_core::models::*;
-
-use super::dedup::compute_fingerprint;
-use super::orchestrator::PipelineOrchestrator;
-use crate::error::AgentError;
-use crate::pipeline::code_review::CodeReviewScanner;
-use crate::pipeline::git::GitOps;
-use crate::pipeline::semgrep::SemgrepScanner;
-
-use compliance_core::traits::Scanner;
-
-impl PipelineOrchestrator {
-    /// Run an incremental scan on a PR diff and post review comments.
-    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, pr_number))]
-    pub async fn run_pr_review(
-        &self,
-        repo: &TrackedRepository,
-        repo_id: &str,
-        pr_number: u64,
-        base_sha: &str,
-        head_sha: &str,
-    ) -> Result<(), AgentError> {
-        let tracker = match self.build_tracker(repo) {
-            Some(t) => t,
-            None => {
-                tracing::warn!("[{repo_id}] No tracker configured, cannot post PR review");
-                return Ok(());
-            }
-        };
-        let owner = repo.tracker_owner.as_deref().unwrap_or("");
-        let tracker_repo_name = repo.tracker_repo.as_deref().unwrap_or("");
-        if owner.is_empty() || tracker_repo_name.is_empty() {
-            tracing::warn!("[{repo_id}] tracker_owner or tracker_repo not set");
-            return Ok(());
-        }
-
-        // Clone/fetch the repo
-        let creds = GitOps::make_repo_credentials(&self.config, repo);
-        let git_ops = GitOps::new(&self.config.git_clone_base_path, creds);
-        let repo_path = git_ops.clone_or_fetch(&repo.git_url, &repo.name)?;
-
-        // Get diff between base and head
-        let diff_files = GitOps::get_diff_content(&repo_path, base_sha, head_sha)?;
-        if diff_files.is_empty() {
-            tracing::info!("[{repo_id}] PR #{pr_number}: no diff files, skipping review");
-            return Ok(());
-        }
-
-        // Run semgrep on the full repo but we'll filter findings to changed files
-        let changed_paths: std::collections::HashSet<String> =
-            diff_files.iter().map(|f| f.path.clone()).collect();
-
-        let mut pr_findings: Vec<Finding> = Vec::new();
-
-        // SAST scan (semgrep)
-        match SemgrepScanner.scan(&repo_path, repo_id).await {
-            Ok(output) => {
-                for f in output.findings {
-                    if let Some(fp) = &f.file_path {
-                        if changed_paths.contains(fp.as_str()) {
-                            pr_findings.push(f);
-                        }
-                    }
-                }
-            }
-            Err(e) => tracing::warn!("[{repo_id}] PR semgrep failed: {e}"),
-        }
-
-        // LLM code review on the diff
-        let reviewer = CodeReviewScanner::new(self.llm.clone());
-        let review_output = reviewer
-            .review_diff(&repo_path, repo_id, base_sha, head_sha)
-            .await;
-        pr_findings.extend(review_output.findings);
-
-        if pr_findings.is_empty() {
-            // Post a clean review
-            if let Err(e) = tracker
-                .create_pr_review(
-                    owner,
-                    tracker_repo_name,
-                    pr_number,
-                    "Compliance scan: no issues found in this PR.",
-                    Vec::new(),
-                )
-                .await
-            {
-                tracing::warn!("[{repo_id}] Failed to post clean PR review: {e}");
-            }
-            return Ok(());
-        }
-
-        // Dedup findings by fingerprint to avoid duplicate comments
-        let mut seen_fps = std::collections::HashSet::new();
-        let mut unique_findings: Vec<&Finding> = Vec::new();
-        for finding in &pr_findings {
-            let fp = compute_fingerprint(&[
-                repo_id,
-                &pr_number.to_string(),
-                finding.file_path.as_deref().unwrap_or(""),
-                &finding.line_number.unwrap_or(0).to_string(),
-                &finding.title,
-            ]);
-            if seen_fps.insert(fp) {
-                unique_findings.push(finding);
-            }
-        }
-
-        let pr_findings = unique_findings;
-
-        // Build review comments from findings
-        let mut review_comments = Vec::new();
-        for finding in &pr_findings {
-            if let (Some(path), Some(line)) = (&finding.file_path, finding.line_number) {
-                let fp = compute_fingerprint(&[
-                    repo_id,
-                    &pr_number.to_string(),
-                    path,
-                    &line.to_string(),
-                    &finding.title,
-                ]);
-                let comment_body = format!(
-                    "**[{}] {}**\n\n{}\n\n*Scanner: {} | {}*\n\n<!-- compliance-fp:{fp} -->",
-                    finding.severity,
-                    finding.title,
-                    finding.description,
-                    finding.scanner,
-                    finding
-                        .cwe
-                        .as_deref()
-                        .map(|c| format!("CWE: {c}"))
-                        .unwrap_or_default(),
-                );
-                review_comments.push(compliance_core::traits::issue_tracker::ReviewComment {
-                    path: path.clone(),
-                    line,
-                    body: comment_body,
-                });
-            }
-        }
-
-        let summary = format!(
-            "Compliance scan found **{}** issue(s) in this PR:\n\n{}",
-            pr_findings.len(),
-            pr_findings
-                .iter()
-                .map(|f| format!("- **[{}]** {}: {}", f.severity, f.scanner, f.title))
-                .collect::<Vec<_>>()
-                .join("\n"),
-        );
-
-        if review_comments.is_empty() {
-            // All findings were on files/lines we can't comment on inline
-            if let Err(e) = tracker
-                .create_pr_review(owner, tracker_repo_name, pr_number, &summary, Vec::new())
-                .await
-            {
-                tracing::warn!("[{repo_id}] Failed to post PR review summary: {e}");
-            }
-            return Ok(());
-        }
-
-        if let Err(e) = tracker
-            .create_pr_review(
-                owner,
-                tracker_repo_name,
-                pr_number,
-                &summary,
-                review_comments,
-            )
-            .await
-        {
-            tracing::warn!("[{repo_id}] Failed to post PR review: {e}");
-        } else {
-            tracing::info!(
-                "[{repo_id}] Posted PR review on #{pr_number} with {} findings",
-                pr_findings.len()
-            );
-        }
-
-        Ok(())
-    }
-}

compliance-agent/src/pipeline/sbom.rs

@@ -1,6 +1,3 @@
-mod cargo_audit;
-mod syft;
-
 use std::path::Path;
 
 use compliance_core::models::{SbomEntry, ScanType, VulnRef};
@@ -26,7 +23,7 @@ impl Scanner for SbomScanner {
         generate_lockfiles(repo_path).await;
 
         // Run syft for SBOM generation
-        match syft::run_syft(repo_path, repo_id).await {
+        match run_syft(repo_path, repo_id).await {
             Ok(syft_entries) => entries.extend(syft_entries),
             Err(e) => tracing::warn!("syft failed: {e}"),
         }
@@ -35,7 +32,7 @@ impl Scanner for SbomScanner {
         enrich_cargo_licenses(repo_path, &mut entries).await;
 
         // Run cargo-audit for Rust-specific vulns
-        match cargo_audit::run_cargo_audit(repo_path, repo_id).await {
+        match run_cargo_audit(repo_path, repo_id).await {
             Ok(vulns) => merge_audit_vulns(&mut entries, vulns),
             Err(e) => tracing::warn!("cargo-audit skipped: {e}"),
         }
@@ -189,7 +186,95 @@ async fn enrich_cargo_licenses(repo_path: &Path, entries: &mut [SbomEntry]) {
     }
 }
 
-fn merge_audit_vulns(entries: &mut [SbomEntry], vulns: Vec<cargo_audit::AuditVuln>) {
+#[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
+async fn run_syft(repo_path: &Path, repo_id: &str) -> Result<Vec<SbomEntry>, CoreError> {
+    let output = tokio::process::Command::new("syft")
+        .arg(repo_path)
+        .args(["-o", "cyclonedx-json"])
+        // Enable remote license lookups for all ecosystems
+        .env("SYFT_GOLANG_SEARCH_REMOTE_LICENSES", "true")
+        .env("SYFT_JAVASCRIPT_SEARCH_REMOTE_LICENSES", "true")
+        .env("SYFT_PYTHON_SEARCH_REMOTE_LICENSES", "true")
+        .env("SYFT_JAVA_USE_NETWORK", "true")
+        .output()
+        .await
+        .map_err(|e| CoreError::Scanner {
+            scanner: "syft".to_string(),
+            source: Box::new(e),
+        })?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(CoreError::Scanner {
+            scanner: "syft".to_string(),
+            source: format!("syft exited with {}: {stderr}", output.status).into(),
+        });
+    }
+
+    let cdx: CycloneDxBom = serde_json::from_slice(&output.stdout)?;
+    let entries = cdx
+        .components
+        .unwrap_or_default()
+        .into_iter()
+        .map(|c| {
+            let package_manager = c
+                .purl
+                .as_deref()
+                .and_then(extract_ecosystem_from_purl)
+                .unwrap_or_else(|| "unknown".to_string());
+            let mut entry = SbomEntry::new(
+                repo_id.to_string(),
+                c.name,
+                c.version.unwrap_or_else(|| "unknown".to_string()),
+                package_manager,
+            );
+            entry.purl = c.purl;
+            entry.license = c.licenses.and_then(|ls| extract_license(&ls));
+            entry
+        })
+        .collect();
+
+    Ok(entries)
+}
+
+#[tracing::instrument(skip_all)]
+async fn run_cargo_audit(repo_path: &Path, _repo_id: &str) -> Result<Vec<AuditVuln>, CoreError> {
+    let cargo_lock = repo_path.join("Cargo.lock");
+    if !cargo_lock.exists() {
+        return Ok(Vec::new());
+    }
+
+    let output = tokio::process::Command::new("cargo")
+        .args(["audit", "--json"])
+        .current_dir(repo_path)
+        .env("RUSTC_WRAPPER", "")
+        .output()
+        .await
+        .map_err(|e| CoreError::Scanner {
+            scanner: "cargo-audit".to_string(),
+            source: Box::new(e),
+        })?;
+
+    let result: CargoAuditOutput =
+        serde_json::from_slice(&output.stdout).unwrap_or_else(|_| CargoAuditOutput {
+            vulnerabilities: CargoAuditVulns { list: Vec::new() },
+        });
+
+    let vulns = result
+        .vulnerabilities
+        .list
+        .into_iter()
+        .map(|v| AuditVuln {
+            package: v.advisory.package,
+            id: v.advisory.id,
+            url: v.advisory.url,
+        })
+        .collect();
+
+    Ok(vulns)
+}
+
+fn merge_audit_vulns(entries: &mut [SbomEntry], vulns: Vec<AuditVuln>) {
     for vuln in vulns {
         if let Some(entry) = entries.iter_mut().find(|e| e.name == vuln.package) {
             entry.known_vulnerabilities.push(VulnRef {
@@ -202,6 +287,65 @@ fn merge_audit_vulns(entries: &mut [SbomEntry], vulns: Vec<cargo_audit::AuditVul
     }
 }
 
+// CycloneDX JSON types
+#[derive(serde::Deserialize)]
+struct CycloneDxBom {
+    components: Option<Vec<CdxComponent>>,
+}
+
+#[derive(serde::Deserialize)]
+struct CdxComponent {
+    name: String,
+    version: Option<String>,
+    #[serde(rename = "type")]
+    #[allow(dead_code)]
+    component_type: Option<String>,
+    purl: Option<String>,
+    licenses: Option<Vec<CdxLicenseWrapper>>,
+}
+
+#[derive(serde::Deserialize)]
+struct CdxLicenseWrapper {
+    license: Option<CdxLicense>,
+    /// SPDX license expression (e.g. "MIT OR Apache-2.0")
+    expression: Option<String>,
+}
+
+#[derive(serde::Deserialize)]
+struct CdxLicense {
+    id: Option<String>,
+    name: Option<String>,
+}
+
+// Cargo audit types
+#[derive(serde::Deserialize)]
+struct CargoAuditOutput {
+    vulnerabilities: CargoAuditVulns,
+}
+
+#[derive(serde::Deserialize)]
+struct CargoAuditVulns {
+    list: Vec<CargoAuditEntry>,
+}
+
+#[derive(serde::Deserialize)]
+struct CargoAuditEntry {
+    advisory: CargoAuditAdvisory,
+}
+
+#[derive(serde::Deserialize)]
+struct CargoAuditAdvisory {
+    id: String,
+    package: String,
+    url: String,
+}
+
+struct AuditVuln {
+    package: String,
+    id: String,
+    url: String,
+}
+
 // Cargo metadata types
 #[derive(serde::Deserialize)]
 struct CargoMetadata {
@@ -214,3 +358,49 @@ struct CargoPackage {
     version: String,
     license: Option<String>,
 }
+
+/// Extract the best license string from CycloneDX license entries.
+/// Handles three formats: expression ("MIT OR Apache-2.0"), license.id ("MIT"), license.name ("MIT License").
+fn extract_license(entries: &[CdxLicenseWrapper]) -> Option<String> {
+    // First pass: look for SPDX expressions (most precise for dual-licensed packages)
+    for entry in entries {
+        if let Some(ref expr) = entry.expression {
+            if !expr.is_empty() {
+                return Some(expr.clone());
+            }
+        }
+    }
+    // Second pass: collect license.id or license.name from all entries
+    let parts: Vec<String> = entries
+        .iter()
+        .filter_map(|e| {
+            e.license.as_ref().and_then(|lic| {
+                lic.id
+                    .clone()
+                    .or_else(|| lic.name.clone())
+                    .filter(|s| !s.is_empty())
+            })
+        })
+        .collect();
+    if parts.is_empty() {
+        return None;
+    }
+    Some(parts.join(" OR "))
+}
+
+/// Extract the ecosystem/package-manager from a PURL string.
+/// e.g. "pkg:npm/lodash@4.17.21" → "npm", "pkg:cargo/serde@1.0" → "cargo"
+fn extract_ecosystem_from_purl(purl: &str) -> Option<String> {
+    let rest = purl.strip_prefix("pkg:")?;
+    let ecosystem = rest.split('/').next()?;
+    if ecosystem.is_empty() {
+        return None;
+    }
+    // Normalise common PURL types to user-friendly names
+    let normalised = match ecosystem {
+        "golang" => "go",
+        "pypi" => "pip",
+        _ => ecosystem,
+    };
+    Some(normalised.to_string())
+}

compliance-agent/src/pipeline/sbom/cargo_audit.rs

@@ -1,72 +0,0 @@
-use std::path::Path;
-
-use compliance_core::CoreError;
-
-pub(super) struct AuditVuln {
-    pub package: String,
-    pub id: String,
-    pub url: String,
-}
-
-#[tracing::instrument(skip_all)]
-pub(super) async fn run_cargo_audit(
-    repo_path: &Path,
-    _repo_id: &str,
-) -> Result<Vec<AuditVuln>, CoreError> {
-    let cargo_lock = repo_path.join("Cargo.lock");
-    if !cargo_lock.exists() {
-        return Ok(Vec::new());
-    }
-
-    let output = tokio::process::Command::new("cargo")
-        .args(["audit", "--json"])
-        .current_dir(repo_path)
-        .env("RUSTC_WRAPPER", "")
-        .output()
-        .await
-        .map_err(|e| CoreError::Scanner {
-            scanner: "cargo-audit".to_string(),
-            source: Box::new(e),
-        })?;
-
-    let result: CargoAuditOutput =
-        serde_json::from_slice(&output.stdout).unwrap_or_else(|_| CargoAuditOutput {
-            vulnerabilities: CargoAuditVulns { list: Vec::new() },
-        });
-
-    let vulns = result
-        .vulnerabilities
-        .list
-        .into_iter()
-        .map(|v| AuditVuln {
-            package: v.advisory.package,
-            id: v.advisory.id,
-            url: v.advisory.url,
-        })
-        .collect();
-
-    Ok(vulns)
-}
-
-// Cargo audit types
-#[derive(serde::Deserialize)]
-struct CargoAuditOutput {
-    vulnerabilities: CargoAuditVulns,
-}
-
-#[derive(serde::Deserialize)]
-struct CargoAuditVulns {
-    list: Vec<CargoAuditEntry>,
-}
-
-#[derive(serde::Deserialize)]
-struct CargoAuditEntry {
-    advisory: CargoAuditAdvisory,
-}
-
-#[derive(serde::Deserialize)]
-struct CargoAuditAdvisory {
-    id: String,
-    package: String,
-    url: String,
-}

compliance-agent/src/pipeline/sbom/syft.rs

@@ -1,361 +0,0 @@
-use std::path::Path;
-
-use compliance_core::models::SbomEntry;
-use compliance_core::CoreError;
-
-#[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
-pub(super) async fn run_syft(repo_path: &Path, repo_id: &str) -> Result<Vec<SbomEntry>, CoreError> {
-    let output = tokio::time::timeout(
-        std::time::Duration::from_secs(300),
-        tokio::process::Command::new("syft")
-            .arg(repo_path)
-            .args(["-o", "cyclonedx-json"])
-            .env("SYFT_GOLANG_SEARCH_REMOTE_LICENSES", "true")
-            .env("SYFT_JAVASCRIPT_SEARCH_REMOTE_LICENSES", "true")
-            .env("SYFT_PYTHON_SEARCH_REMOTE_LICENSES", "true")
-            .env("SYFT_JAVA_USE_NETWORK", "true")
-            .output(),
-    )
-    .await
-    .map_err(|_| CoreError::Scanner {
-        scanner: "syft".to_string(),
-        source: "timed out after 5 minutes".into(),
-    })?
-    .map_err(|e| CoreError::Scanner {
-        scanner: "syft".to_string(),
-        source: Box::new(e),
-    })?;
-
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        return Err(CoreError::Scanner {
-            scanner: "syft".to_string(),
-            source: format!("syft exited with {}: {stderr}", output.status).into(),
-        });
-    }
-
-    let cdx: CycloneDxBom = serde_json::from_slice(&output.stdout)?;
-    let entries = cdx
-        .components
-        .unwrap_or_default()
-        .into_iter()
-        .map(|c| {
-            let package_manager = c
-                .purl
-                .as_deref()
-                .and_then(extract_ecosystem_from_purl)
-                .unwrap_or_else(|| "unknown".to_string());
-            let mut entry = SbomEntry::new(
-                repo_id.to_string(),
-                c.name,
-                c.version.unwrap_or_else(|| "unknown".to_string()),
-                package_manager,
-            );
-            entry.purl = c.purl;
-            entry.license = c.licenses.and_then(|ls| extract_license(&ls));
-            entry
-        })
-        .collect();
-
-    Ok(entries)
-}
-
-// CycloneDX JSON types
-#[derive(serde::Deserialize)]
-struct CycloneDxBom {
-    components: Option<Vec<CdxComponent>>,
-}
-
-#[derive(serde::Deserialize)]
-struct CdxComponent {
-    name: String,
-    version: Option<String>,
-    #[serde(rename = "type")]
-    #[allow(dead_code)]
-    component_type: Option<String>,
-    purl: Option<String>,
-    licenses: Option<Vec<CdxLicenseWrapper>>,
-}
-
-#[derive(serde::Deserialize)]
-struct CdxLicenseWrapper {
-    license: Option<CdxLicense>,
-    /// SPDX license expression (e.g. "MIT OR Apache-2.0")
-    expression: Option<String>,
-}
-
-#[derive(serde::Deserialize)]
-struct CdxLicense {
-    id: Option<String>,
-    name: Option<String>,
-}
-
-/// Extract the best license string from CycloneDX license entries.
-/// Handles three formats: expression ("MIT OR Apache-2.0"), license.id ("MIT"), license.name ("MIT License").
-fn extract_license(entries: &[CdxLicenseWrapper]) -> Option<String> {
-    // First pass: look for SPDX expressions (most precise for dual-licensed packages)
-    for entry in entries {
-        if let Some(ref expr) = entry.expression {
-            if !expr.is_empty() {
-                return Some(expr.clone());
-            }
-        }
-    }
-    // Second pass: collect license.id or license.name from all entries
-    let parts: Vec<String> = entries
-        .iter()
-        .filter_map(|e| {
-            e.license.as_ref().and_then(|lic| {
-                lic.id
-                    .clone()
-                    .or_else(|| lic.name.clone())
-                    .filter(|s| !s.is_empty())
-            })
-        })
-        .collect();
-    if parts.is_empty() {
-        return None;
-    }
-    Some(parts.join(" OR "))
-}
-
-/// Extract the ecosystem/package-manager from a PURL string.
-/// e.g. "pkg:npm/lodash@4.17.21" -> "npm", "pkg:cargo/serde@1.0" -> "cargo"
-fn extract_ecosystem_from_purl(purl: &str) -> Option<String> {
-    let rest = purl.strip_prefix("pkg:")?;
-    let ecosystem = rest.split('/').next()?;
-    if ecosystem.is_empty() {
-        return None;
-    }
-    // Normalise common PURL types to user-friendly names
-    let normalised = match ecosystem {
-        "golang" => "go",
-        "pypi" => "pip",
-        _ => ecosystem,
-    };
-    Some(normalised.to_string())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // --- extract_ecosystem_from_purl tests ---
-
-    #[test]
-    fn purl_npm() {
-        assert_eq!(
-            extract_ecosystem_from_purl("pkg:npm/lodash@4.17.21"),
-            Some("npm".to_string())
-        );
-    }
-
-    #[test]
-    fn purl_cargo() {
-        assert_eq!(
-            extract_ecosystem_from_purl("pkg:cargo/serde@1.0.197"),
-            Some("cargo".to_string())
-        );
-    }
-
-    #[test]
-    fn purl_golang_normalised() {
-        assert_eq!(
-            extract_ecosystem_from_purl("pkg:golang/github.com/gin-gonic/gin@1.9.1"),
-            Some("go".to_string())
-        );
-    }
-
-    #[test]
-    fn purl_pypi_normalised() {
-        assert_eq!(
-            extract_ecosystem_from_purl("pkg:pypi/requests@2.31.0"),
-            Some("pip".to_string())
-        );
-    }
-
-    #[test]
-    fn purl_maven() {
-        assert_eq!(
-            extract_ecosystem_from_purl("pkg:maven/org.apache.commons/commons-lang3@3.14.0"),
-            Some("maven".to_string())
-        );
-    }
-
-    #[test]
-    fn purl_missing_prefix() {
-        assert_eq!(extract_ecosystem_from_purl("npm/lodash@4.17.21"), None);
-    }
-
-    #[test]
-    fn purl_empty_ecosystem() {
-        assert_eq!(extract_ecosystem_from_purl("pkg:/lodash@4.17.21"), None);
-    }
-
-    #[test]
-    fn purl_empty_string() {
-        assert_eq!(extract_ecosystem_from_purl(""), None);
-    }
-
-    #[test]
-    fn purl_just_prefix() {
-        assert_eq!(extract_ecosystem_from_purl("pkg:"), None);
-    }
-
-    // --- extract_license tests ---
-
-    #[test]
-    fn license_from_expression() {
-        let entries = vec![CdxLicenseWrapper {
-            license: None,
-            expression: Some("MIT OR Apache-2.0".to_string()),
-        }];
-        assert_eq!(
-            extract_license(&entries),
-            Some("MIT OR Apache-2.0".to_string())
-        );
-    }
-
-    #[test]
-    fn license_from_id() {
-        let entries = vec![CdxLicenseWrapper {
-            license: Some(CdxLicense {
-                id: Some("MIT".to_string()),
-                name: None,
-            }),
-            expression: None,
-        }];
-        assert_eq!(extract_license(&entries), Some("MIT".to_string()));
-    }
-
-    #[test]
-    fn license_from_name_fallback() {
-        let entries = vec![CdxLicenseWrapper {
-            license: Some(CdxLicense {
-                id: None,
-                name: Some("MIT License".to_string()),
-            }),
-            expression: None,
-        }];
-        assert_eq!(extract_license(&entries), Some("MIT License".to_string()));
-    }
-
-    #[test]
-    fn license_expression_preferred_over_id() {
-        let entries = vec![
-            CdxLicenseWrapper {
-                license: Some(CdxLicense {
-                    id: Some("MIT".to_string()),
-                    name: None,
-                }),
-                expression: None,
-            },
-            CdxLicenseWrapper {
-                license: None,
-                expression: Some("MIT AND Apache-2.0".to_string()),
-            },
-        ];
-        // Expression should be preferred (first pass finds it)
-        assert_eq!(
-            extract_license(&entries),
-            Some("MIT AND Apache-2.0".to_string())
-        );
-    }
-
-    #[test]
-    fn license_multiple_ids_joined() {
-        let entries = vec![
-            CdxLicenseWrapper {
-                license: Some(CdxLicense {
-                    id: Some("MIT".to_string()),
-                    name: None,
-                }),
-                expression: None,
-            },
-            CdxLicenseWrapper {
-                license: Some(CdxLicense {
-                    id: Some("Apache-2.0".to_string()),
-                    name: None,
-                }),
-                expression: None,
-            },
-        ];
-        assert_eq!(
-            extract_license(&entries),
-            Some("MIT OR Apache-2.0".to_string())
-        );
-    }
-
-    #[test]
-    fn license_empty_entries() {
-        let entries: Vec<CdxLicenseWrapper> = vec![];
-        assert_eq!(extract_license(&entries), None);
-    }
-
-    #[test]
-    fn license_all_empty_strings() {
-        let entries = vec![CdxLicenseWrapper {
-            license: Some(CdxLicense {
-                id: Some(String::new()),
-                name: Some(String::new()),
-            }),
-            expression: Some(String::new()),
-        }];
-        assert_eq!(extract_license(&entries), None);
-    }
-
-    #[test]
-    fn license_none_fields() {
-        let entries = vec![CdxLicenseWrapper {
-            license: None,
-            expression: None,
-        }];
-        assert_eq!(extract_license(&entries), None);
-    }
-
-    // --- CycloneDX deserialization tests ---
-
-    #[test]
-    fn deserialize_cyclonedx_bom() {
-        let json = r#"{
-            "components": [
-                {
-                    "name": "serde",
-                    "version": "1.0.197",
-                    "type": "library",
-                    "purl": "pkg:cargo/serde@1.0.197",
-                    "licenses": [
-                        {"expression": "MIT OR Apache-2.0"}
-                    ]
-                }
-            ]
-        }"#;
-        let bom: CycloneDxBom = serde_json::from_str(json).unwrap();
-        let components = bom.components.unwrap();
-        assert_eq!(components.len(), 1);
-        assert_eq!(components[0].name, "serde");
-        assert_eq!(components[0].version, Some("1.0.197".to_string()));
-        assert_eq!(
-            components[0].purl,
-            Some("pkg:cargo/serde@1.0.197".to_string())
-        );
-    }
-
-    #[test]
-    fn deserialize_cyclonedx_no_components() {
-        let json = r#"{}"#;
-        let bom: CycloneDxBom = serde_json::from_str(json).unwrap();
-        assert!(bom.components.is_none());
-    }
-
-    #[test]
-    fn deserialize_cyclonedx_minimal_component() {
-        let json = r#"{"components": [{"name": "foo"}]}"#;
-        let bom: CycloneDxBom = serde_json::from_str(json).unwrap();
-        let c = &bom.components.unwrap()[0];
-        assert_eq!(c.name, "foo");
-        assert!(c.version.is_none());
-        assert!(c.purl.is_none());
-        assert!(c.licenses.is_none());
-    }
-}

compliance-agent/src/pipeline/semgrep.rs

@@ -19,30 +19,15 @@ impl Scanner for SemgrepScanner {
 
     #[tracing::instrument(skip_all)]
     async fn scan(&self, repo_path: &Path, repo_id: &str) -> Result<ScanOutput, CoreError> {
-        let output = tokio::time::timeout(
+        let output = tokio::process::Command::new("semgrep")
-            std::time::Duration::from_secs(600),
+            .args(["--config=auto", "--json", "--quiet"])
-            tokio::process::Command::new("semgrep")
+            .arg(repo_path)
-                .args([
+            .output()
-                    "--config=auto",
+            .await
-                    "--json",
+            .map_err(|e| CoreError::Scanner {
-                    "--quiet",
+                scanner: "semgrep".to_string(),
-                    "--max-memory",
+                source: Box::new(e),
-                    "500",
+            })?;
-                    "--jobs",
-                    "1",
-                ])
-                .arg(repo_path)
-                .output(),
-        )
-        .await
-        .map_err(|_| CoreError::Scanner {
-            scanner: "semgrep".to_string(),
-            source: "timed out after 10 minutes".into(),
-        })?
-        .map_err(|e| CoreError::Scanner {
-            scanner: "semgrep".to_string(),
-            source: Box::new(e),
-        })?;
 
         if !output.status.success() && output.stdout.is_empty() {
             let stderr = String::from_utf8_lossy(&output.stderr);
@@ -123,124 +108,3 @@ struct SemgrepExtra {
     #[serde(default)]
     metadata: Option<serde_json::Value>,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn deserialize_semgrep_output() {
-        let json = r#"{
-            "results": [
-                {
-                    "check_id": "python.lang.security.audit.exec-detected",
-                    "path": "src/main.py",
-                    "start": {"line": 15},
-                    "extra": {
-                        "message": "Detected use of exec()",
-                        "severity": "ERROR",
-                        "lines": "exec(user_input)",
-                        "metadata": {"cwe": "CWE-78"}
-                    }
-                }
-            ]
-        }"#;
-        let output: SemgrepOutput = serde_json::from_str(json).unwrap();
-        assert_eq!(output.results.len(), 1);
-
-        let r = &output.results[0];
-        assert_eq!(r.check_id, "python.lang.security.audit.exec-detected");
-        assert_eq!(r.path, "src/main.py");
-        assert_eq!(r.start.line, 15);
-        assert_eq!(r.extra.message, "Detected use of exec()");
-        assert_eq!(r.extra.severity, "ERROR");
-        assert_eq!(r.extra.lines, "exec(user_input)");
-        assert_eq!(
-            r.extra
-                .metadata
-                .as_ref()
-                .unwrap()
-                .get("cwe")
-                .unwrap()
-                .as_str(),
-            Some("CWE-78")
-        );
-    }
-
-    #[test]
-    fn deserialize_semgrep_empty_results() {
-        let json = r#"{"results": []}"#;
-        let output: SemgrepOutput = serde_json::from_str(json).unwrap();
-        assert!(output.results.is_empty());
-    }
-
-    #[test]
-    fn deserialize_semgrep_no_metadata() {
-        let json = r#"{
-            "results": [
-                {
-                    "check_id": "rule-1",
-                    "path": "app.py",
-                    "start": {"line": 1},
-                    "extra": {
-                        "message": "found something",
-                        "severity": "WARNING",
-                        "lines": "import os"
-                    }
-                }
-            ]
-        }"#;
-        let output: SemgrepOutput = serde_json::from_str(json).unwrap();
-        assert!(output.results[0].extra.metadata.is_none());
-    }
-
-    #[test]
-    fn semgrep_severity_mapping() {
-        let cases = vec![
-            ("ERROR", "High"),
-            ("WARNING", "Medium"),
-            ("INFO", "Low"),
-            ("UNKNOWN", "Info"),
-        ];
-        for (input, expected) in cases {
-            let result = match input {
-                "ERROR" => "High",
-                "WARNING" => "Medium",
-                "INFO" => "Low",
-                _ => "Info",
-            };
-            assert_eq!(result, expected, "Severity for '{input}'");
-        }
-    }
-
-    #[test]
-    fn deserialize_semgrep_multiple_results() {
-        let json = r#"{
-            "results": [
-                {
-                    "check_id": "rule-a",
-                    "path": "a.py",
-                    "start": {"line": 1},
-                    "extra": {
-                        "message": "msg a",
-                        "severity": "ERROR",
-                        "lines": "line a"
-                    }
-                },
-                {
-                    "check_id": "rule-b",
-                    "path": "b.py",
-                    "start": {"line": 99},
-                    "extra": {
-                        "message": "msg b",
-                        "severity": "INFO",
-                        "lines": "line b"
-                    }
-                }
-            ]
-        }"#;
-        let output: SemgrepOutput = serde_json::from_str(json).unwrap();
-        assert_eq!(output.results.len(), 2);
-        assert_eq!(output.results[1].start.line, 99);
-    }
-}

compliance-agent/src/pipeline/tracker_dispatch.rs

@@ -1,81 +0,0 @@
-use compliance_core::models::TrackerIssue;
-use compliance_core::traits::issue_tracker::IssueTracker;
-
-use crate::trackers;
-
-/// Enum dispatch for issue trackers (async traits aren't dyn-compatible).
-pub(crate) enum TrackerDispatch {
-    GitHub(trackers::github::GitHubTracker),
-    GitLab(trackers::gitlab::GitLabTracker),
-    Gitea(trackers::gitea::GiteaTracker),
-    Jira(trackers::jira::JiraTracker),
-}
-
-impl TrackerDispatch {
-    pub(crate) fn name(&self) -> &str {
-        match self {
-            Self::GitHub(t) => t.name(),
-            Self::GitLab(t) => t.name(),
-            Self::Gitea(t) => t.name(),
-            Self::Jira(t) => t.name(),
-        }
-    }
-
-    pub(crate) async fn create_issue(
-        &self,
-        owner: &str,
-        repo: &str,
-        title: &str,
-        body: &str,
-        labels: &[String],
-    ) -> Result<TrackerIssue, compliance_core::error::CoreError> {
-        match self {
-            Self::GitHub(t) => t.create_issue(owner, repo, title, body, labels).await,
-            Self::GitLab(t) => t.create_issue(owner, repo, title, body, labels).await,
-            Self::Gitea(t) => t.create_issue(owner, repo, title, body, labels).await,
-            Self::Jira(t) => t.create_issue(owner, repo, title, body, labels).await,
-        }
-    }
-
-    pub(crate) async fn find_existing_issue(
-        &self,
-        owner: &str,
-        repo: &str,
-        fingerprint: &str,
-    ) -> Result<Option<TrackerIssue>, compliance_core::error::CoreError> {
-        match self {
-            Self::GitHub(t) => t.find_existing_issue(owner, repo, fingerprint).await,
-            Self::GitLab(t) => t.find_existing_issue(owner, repo, fingerprint).await,
-            Self::Gitea(t) => t.find_existing_issue(owner, repo, fingerprint).await,
-            Self::Jira(t) => t.find_existing_issue(owner, repo, fingerprint).await,
-        }
-    }
-
-    pub(crate) async fn create_pr_review(
-        &self,
-        owner: &str,
-        repo: &str,
-        pr_number: u64,
-        body: &str,
-        comments: Vec<compliance_core::traits::issue_tracker::ReviewComment>,
-    ) -> Result<(), compliance_core::error::CoreError> {
-        match self {
-            Self::GitHub(t) => {
-                t.create_pr_review(owner, repo, pr_number, body, comments)
-                    .await
-            }
-            Self::GitLab(t) => {
-                t.create_pr_review(owner, repo, pr_number, body, comments)
-                    .await
-            }
-            Self::Gitea(t) => {
-                t.create_pr_review(owner, repo, pr_number, body, comments)
-                    .await
-            }
-            Self::Jira(t) => {
-                t.create_pr_review(owner, repo, pr_number, body, comments)
-                    .await
-            }
-        }
-    }
-}

compliance-agent/src/rag/pipeline.rs

@@ -6,16 +6,11 @@ use compliance_core::models::embedding::{CodeEmbedding, EmbeddingBuildRun, Embed
 use compliance_core::models::graph::CodeNode;
 use compliance_graph::graph::chunking::extract_chunks;
 use compliance_graph::graph::embedding_store::EmbeddingStore;
-use futures_util::stream::{FuturesUnordered, StreamExt};
 use tracing::{error, info};
 
 use crate::error::AgentError;
 use crate::llm::LlmClient;
 
-const EMBED_BATCH_SIZE: usize = 20;
-const EMBED_CONCURRENCY: usize = 4;
-const EMBED_FLUSH_EVERY: usize = 200;
-
 /// RAG pipeline for building embeddings and performing retrieval
 pub struct RagPipeline {
     llm: Arc<LlmClient>,
@@ -82,33 +77,25 @@ impl RagPipeline {
             .await
             .map_err(|e| AgentError::Other(format!("Failed to delete old embeddings: {e}")))?;
 
-        // Step 3: Batch embed with bounded concurrency. Flush to Mongo and
+        // Step 3: Batch embed (small batches to stay within model limits)
-        // update progress periodically so the dashboard can show live status.
+        let batch_size = 20;
-        let mut pending = Vec::with_capacity(EMBED_FLUSH_EVERY);
+        let mut all_embeddings = Vec::new();
         let mut embedded_count = 0u32;
 
-        // Build the list of batch indices to process.
+        for batch_start in (0..chunks.len()).step_by(batch_size) {
-        let batches: Vec<(usize, usize)> = (0..chunks.len())
+            let batch_end = (batch_start + batch_size).min(chunks.len());
-            .step_by(EMBED_BATCH_SIZE)
+            let batch_chunks = &chunks[batch_start..batch_end];
-            .map(|start| (start, (start + EMBED_BATCH_SIZE).min(chunks.len())))
-            .collect();
 
-        let mut batch_iter = batches.into_iter();
+            // Prepare texts: context_header + content
-        let mut in_flight = FuturesUnordered::new();
+            let texts: Vec<String> = batch_chunks
+                .iter()
+                .map(|c| format!("{}\n{}", c.context_header, c.content))
+                .collect();
 
-        // Prime up to EMBED_CONCURRENCY batches.
+            match self.llm.embed(texts).await {
-        for _ in 0..EMBED_CONCURRENCY {
+                Ok(vectors) => {
-            if let Some((start, end)) = batch_iter.next() {
-                in_flight.push(self.embed_batch(&chunks[start..end], start, end));
-            }
-        }
-
-        while let Some(result) = in_flight.next().await {
-            match result {
-                Ok((start, end, vectors)) => {
-                    let batch_chunks = &chunks[start..end];
                     for (chunk, embedding) in batch_chunks.iter().zip(vectors) {
-                        pending.push(CodeEmbedding {
+                        all_embeddings.push(CodeEmbedding {
                             id: None,
                             repo_id: repo_id.to_string(),
                             graph_build_id: graph_build_id.to_string(),
@@ -126,45 +113,9 @@ impl RagPipeline {
                         });
                     }
                     embedded_count += batch_chunks.len() as u32;
-
-                    // Flush pending embeddings to Mongo periodically and update progress.
-                    if pending.len() >= EMBED_FLUSH_EVERY {
-                        self.embedding_store
-                            .store_embeddings(&pending)
-                            .await
-                            .map_err(|e| {
-                                AgentError::Other(format!("Failed to store embeddings: {e}"))
-                            })?;
-                        pending.clear();
-                    }
-
-                    // Always update the progress counter on the build doc — even if
-                    // we haven't flushed embeddings yet — so the UI shows movement.
-                    if let Err(e) = self
-                        .embedding_store
-                        .update_build(
-                            repo_id,
-                            graph_build_id,
-                            EmbeddingBuildStatus::Running,
-                            embedded_count,
-                            None,
-                        )
-                        .await
-                    {
-                        error!("[{repo_id}] Failed to update build progress: {e}");
-                    }
-
-                    // Queue the next batch to keep concurrency saturated.
-                    if let Some((s, e)) = batch_iter.next() {
-                        in_flight.push(self.embed_batch(&chunks[s..e], s, e));
-                    }
                 }
                 Err(e) => {
                     error!("[{repo_id}] Embedding batch failed: {e}");
-                    // Flush whatever we have so partial progress isn't lost.
-                    if !pending.is_empty() {
-                        let _ = self.embedding_store.store_embeddings(&pending).await;
-                    }
                     build.status = EmbeddingBuildStatus::Failed;
                     build.error_message = Some(e.to_string());
                     build.completed_at = Some(Utc::now());
@@ -183,13 +134,11 @@ impl RagPipeline {
             }
         }
 
-        // Step 4: Flush any remaining embeddings
+        // Step 4: Store all embeddings
-        if !pending.is_empty() {
+        self.embedding_store
-            self.embedding_store
+            .store_embeddings(&all_embeddings)
-                .store_embeddings(&pending)
+            .await
-                .await
+            .map_err(|e| AgentError::Other(format!("Failed to store embeddings: {e}")))?;
-                .map_err(|e| AgentError::Other(format!("Failed to store embeddings: {e}")))?;
-        }
 
         // Step 5: Update build status
         build.status = EmbeddingBuildStatus::Completed;
@@ -212,21 +161,4 @@ impl RagPipeline {
         );
         Ok(build)
     }
-
-    /// Embed one batch of chunks. Returns the (start, end, vectors) tuple so
-    /// out-of-order completion from `FuturesUnordered` can still be reconciled
-    /// against the original chunk slice.
-    async fn embed_batch(
-        &self,
-        batch_chunks: &[compliance_graph::graph::chunking::CodeChunk],
-        start: usize,
-        end: usize,
-    ) -> Result<(usize, usize, Vec<Vec<f64>>), AgentError> {
-        let texts: Vec<String> = batch_chunks
-            .iter()
-            .map(|c| format!("{}\n{}", c.context_header, c.content))
-            .collect();
-        let vectors = self.llm.embed(texts).await?;
-        Ok((start, end, vectors))
-    }
 }

compliance-agent/src/scheduler.rs

@@ -4,21 +4,8 @@ use tokio_cron_scheduler::{Job, JobScheduler};
 use compliance_core::models::ScanTrigger;
 
 use crate::agent::ComplianceAgent;
-use crate::database::Database;
 use crate::error::AgentError;
 
-/// Default tenant the scheduler runs against when neither the tenant
-/// registry nor `SCHEDULER_TENANT_IDS` are configured. Matches the
-/// dev-injector default so a bare `cargo run` has the scheduler
-/// scanning whatever lives in `<prefix>_dev`.
-const DEFAULT_SCHEDULER_TENANT_ID: &str = "dev";
-
-/// Request timeout when fetching the live tenant list from the
-/// registry. Kept short — if the registry is slow we'd rather fall
-/// back to env-configured ids and finish the tick than block the
-/// scheduler loop.
-const REGISTRY_FETCH_TIMEOUT_SECS: u64 = 5;
-
 pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError> {
     let sched = JobScheduler::new()
         .await
@@ -31,14 +18,7 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
         let agent = scan_agent.clone();
         Box::pin(async move {
             tracing::info!("Scheduled scan triggered");
-            let tenants = scheduler_tenants(&agent).await;
+            scan_all_repos(&agent).await;
-            tracing::debug!(
-                tenant_count = tenants.len(),
-                "Scheduled scan: tenants resolved"
-            );
-            for tenant_id in tenants {
-                scan_all_repos(&agent, &tenant_id).await;
-            }
         })
     })
     .map_err(|e| AgentError::Scheduler(format!("Failed to create scan job: {e}")))?;
@@ -54,14 +34,7 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
         let agent = cve_agent.clone();
         Box::pin(async move {
             tracing::info!("CVE monitor triggered");
-            let tenants = scheduler_tenants(&agent).await;
+            monitor_cves(&agent).await;
-            tracing::debug!(
-                tenant_count = tenants.len(),
-                "CVE monitor: tenants resolved"
-            );
-            for tenant_id in tenants {
-                monitor_cves(&agent, &tenant_id).await;
-            }
         })
     })
     .map_err(|e| AgentError::Scheduler(format!("Failed to create CVE monitor job: {e}")))?;
@@ -75,14 +48,8 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
         .await
         .map_err(|e| AgentError::Scheduler(format!("Failed to start scheduler: {e}")))?;
 
-    let tenants = scheduler_tenants(agent).await;
-    let source = if agent.config.tenant_registry_url.is_some() {
-        "tenant-registry (env fallback)"
-    } else {
-        "env (SCHEDULER_TENANT_IDS)"
-    };
     tracing::info!(
-        "Scheduler started: scans='{}', CVE monitor='{}', tenant source={source}, tenants={tenants:?}",
+        "Scheduler started: scans='{}', CVE monitor='{}'",
         agent.config.scan_schedule,
         agent.config.cve_monitor_schedule,
     );
@@ -93,205 +60,13 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
     }
 }
 
-/// Tenants the scheduler iterates each tick.
+async fn scan_all_repos(agent: &ComplianceAgent) {
-///
-/// Resolution order:
-/// 1. **Tenant registry** at `agent.config.tenant_registry_url`
-///    (`GET /v1/tenants`). Fresh on every tick — picks up newly
-///    provisioned tenants without an agent restart.
-/// 2. **`SCHEDULER_TENANT_IDS`** env (comma-separated) — fallback when
-///    the registry is unreachable, the response is malformed, or no
-///    registry URL is configured.
-/// 3. **`DEFAULT_SCHEDULER_TENANT_ID`** (`"dev"`) — last-ditch fallback
-///    so the scheduler keeps doing something useful in dev.
-///
-/// We never panic out of this function — the scheduler must keep
-/// firing even if the registry is offline.
-async fn scheduler_tenants(agent: &ComplianceAgent) -> Vec<String> {
-    if let Some(url) = agent.config.tenant_registry_url.as_deref() {
-        match fetch_tenants_from_registry(&agent.http, url).await {
-            Ok(v) if !v.is_empty() => return v,
-            Ok(_) => {
-                tracing::warn!("tenant-registry returned empty list; falling back to env");
-            }
-            Err(e) => {
-                tracing::warn!(
-                    url = %url,
-                    error = %e,
-                    "tenant-registry fetch failed; falling back to env"
-                );
-            }
-        }
-    }
-    tenants_from_env()
-}
-
-fn tenants_from_env() -> Vec<String> {
-    std::env::var("SCHEDULER_TENANT_IDS")
-        .ok()
-        .map(|s| {
-            s.split(',')
-                .map(str::trim)
-                .filter(|s| !s.is_empty())
-                .map(String::from)
-                .collect::<Vec<_>>()
-        })
-        .filter(|v| !v.is_empty())
-        .unwrap_or_else(|| vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()])
-}
-
-/// Shape we accept from the registry. Liberal in what we accept:
-/// the registry can return any field shape as long as either `id` or
-/// `tenant_id` is present. Other fields are ignored.
-#[derive(serde::Deserialize)]
-struct RegistryTenant {
-    #[serde(alias = "tenant_id")]
-    id: String,
-    /// Filter out non-running tenants if status is present. Missing
-    /// status defaults to "active" so older registry deployments keep
-    /// working.
-    #[serde(default = "default_status")]
-    status: String,
-}
-
-fn default_status() -> String {
-    "active".to_string()
-}
-
-#[derive(serde::Deserialize)]
-struct RegistryListResponse {
-    data: Vec<RegistryTenant>,
-}
-
-async fn fetch_tenants_from_registry(
-    http: &reqwest::Client,
-    base_url: &str,
-) -> Result<Vec<String>, String> {
-    let url = format!("{}/v1/tenants", base_url.trim_end_matches('/'));
-    let resp = http
-        .get(&url)
-        .timeout(std::time::Duration::from_secs(REGISTRY_FETCH_TIMEOUT_SECS))
-        .send()
-        .await
-        .map_err(|e| format!("request failed: {e}"))?;
-    if !resp.status().is_success() {
-        return Err(format!("registry returned {}", resp.status()));
-    }
-    let body: RegistryListResponse = resp
-        .json()
-        .await
-        .map_err(|e| format!("invalid JSON: {e}"))?;
-    Ok(filter_active(body.data))
-}
-
-/// Frozen/Archived tenants don't need scheduled scans; the M7.1
-/// status gate would 402/410 anyway. Skip them so we don't waste
-/// cycles. Active / trial / demo / anything-else-unknown all run.
-fn filter_active(rows: Vec<RegistryTenant>) -> Vec<String> {
-    rows.into_iter()
-        .filter(|t| !matches!(t.status.as_str(), "frozen" | "archived"))
-        .map(|t| t.id)
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn tenant(id: &str, status: &str) -> RegistryTenant {
-        RegistryTenant {
-            id: id.to_string(),
-            status: status.to_string(),
-        }
-    }
-
-    #[test]
-    fn filter_active_keeps_running_skips_frozen_archived() {
-        let rows = vec![
-            tenant("a", "active"),
-            tenant("b", "trial"),
-            tenant("c", "demo"),
-            tenant("d", "frozen"),
-            tenant("e", "archived"),
-            tenant("f", "weird-but-not-known-dead"),
-        ];
-        let out = filter_active(rows);
-        assert_eq!(out, vec!["a", "b", "c", "f"]);
-    }
-
-    #[test]
-    fn deserialize_registry_response_accepts_id_or_tenant_id() {
-        let body = r#"{"data":[
-            {"id":"a","status":"active"},
-            {"tenant_id":"b","status":"trial"},
-            {"id":"c"}
-        ]}"#;
-        let parsed: RegistryListResponse = serde_json::from_str(body).unwrap();
-        assert_eq!(parsed.data.len(), 3);
-        assert_eq!(parsed.data[0].id, "a");
-        assert_eq!(parsed.data[1].id, "b");
-        assert_eq!(parsed.data[2].id, "c");
-        // Default status for the third entry should be "active"
-        assert_eq!(parsed.data[2].status, "active");
-    }
-
-    /// Combined into a single test: cargo runs tests in parallel and
-    /// env vars are process-global, so two separate tests touching
-    /// `SCHEDULER_TENANT_IDS` race each other. Doing both checks in
-    /// one test keeps them in a deterministic order.
-    #[test]
-    fn tenants_from_env_resolution() {
-        std::env::remove_var("SCHEDULER_TENANT_IDS");
-        assert_eq!(
-            tenants_from_env(),
-            vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()],
-            "unset → default"
-        );
-
-        std::env::set_var("SCHEDULER_TENANT_IDS", "acme, globex ,,hello");
-        let out = tenants_from_env();
-        std::env::remove_var("SCHEDULER_TENANT_IDS");
-        assert_eq!(
-            out,
-            vec!["acme", "globex", "hello"],
-            "splits + trims + drops empty"
-        );
-
-        std::env::set_var("SCHEDULER_TENANT_IDS", "");
-        let out = tenants_from_env();
-        std::env::remove_var("SCHEDULER_TENANT_IDS");
-        assert_eq!(
-            out,
-            vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()],
-            "empty → default"
-        );
-    }
-}
-
-/// Resolve the per-tenant database. Logs and returns `None` on failure
-/// so the loop in the caller can continue with other tenants.
-async fn tenant_db(agent: &ComplianceAgent, tenant_id: &str) -> Option<Database> {
-    match agent.db_pool.for_tenant_id(tenant_id).await {
-        Ok(db) => Some(db),
-        Err(e) => {
-            tracing::error!("Scheduler: cannot open tenant database '{tenant_id}': {e}");
-            None
-        }
-    }
-}
-
-async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
     use futures_util::StreamExt;
 
-    let db = match tenant_db(agent, tenant_id).await {
+    let cursor = match agent.db.repositories().find(doc! {}).await {
-        Some(db) => db,
-        None => return,
-    };
-
-    let cursor = match db.repositories().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list repos for scheduled scan: {e}");
             return;
         }
     };
@@ -300,175 +75,31 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
 
     for repo in repos {
         let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-        if let Err(e) = agent
+        if let Err(e) = agent.run_scan(&repo_id, ScanTrigger::Scheduled).await {
-            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
+            tracing::error!("Scheduled scan failed for {}: {e}", repo.name);
-            .await
-        {
-            tracing::error!(
-                "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                repo.name
-            );
         }
     }
 }
 
-async fn monitor_cves(agent: &ComplianceAgent, tenant_id: &str) {
+async fn monitor_cves(agent: &ComplianceAgent) {
-    use compliance_core::models::notification::{parse_severity, CveNotification};
-    use compliance_core::models::SbomEntry;
     use futures_util::StreamExt;
 
-    let db = match tenant_db(agent, tenant_id).await {
+    // Re-scan all SBOM entries for new CVEs
-        Some(db) => db,
+    let cursor = match agent.db.sbom_entries().find(doc! {}).await {
-        None => return,
-    };
-
-    // Fetch all SBOM entries grouped by repo
-    let cursor = match db.sbom_entries().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("CVE monitor: failed to list SBOM entries for '{tenant_id}': {e}");
+            tracing::error!("Failed to list SBOM entries for CVE monitoring: {e}");
             return;
         }
     };
-    let entries: Vec<SbomEntry> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+
+    let entries: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+
     if entries.is_empty() {
-        tracing::debug!("CVE monitor: no SBOM entries for tenant '{tenant_id}', skipping");
         return;
     }
 
-    tracing::info!(
+    tracing::info!("CVE monitor: checking {} dependencies", entries.len());
-        "CVE monitor: checking {} dependencies for new CVEs (tenant '{tenant_id}')",
+    // The actual CVE checking is handled by the CveScanner in the pipeline
-        entries.len()
+    // This is a simplified version that just logs the activity
-    );
-
-    // Build a repo_id → repo_name lookup
-    let repo_ids: std::collections::HashSet<String> =
-        entries.iter().map(|e| e.repo_id.clone()).collect();
-    let mut repo_names: std::collections::HashMap<String, String> =
-        std::collections::HashMap::new();
-    for rid in &repo_ids {
-        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(rid) {
-            if let Ok(Some(repo)) = db.repositories().find_one(doc! { "_id": oid }).await {
-                repo_names.insert(rid.clone(), repo.name.clone());
-            }
-        }
-    }
-
-    // Use the existing CveScanner to query OSV.dev
-    let nvd_key = agent.config.nvd_api_key.as_ref().map(|k| {
-        use secrecy::ExposeSecret;
-        k.expose_secret().to_string()
-    });
-    let scanner = crate::pipeline::cve::CveScanner::new(
-        agent.http.clone(),
-        agent.config.searxng_url.clone(),
-        nvd_key,
-    );
-
-    // Group entries by repo for scanning
-    let mut entries_by_repo: std::collections::HashMap<String, Vec<SbomEntry>> =
-        std::collections::HashMap::new();
-    for entry in entries {
-        entries_by_repo
-            .entry(entry.repo_id.clone())
-            .or_default()
-            .push(entry);
-    }
-
-    let mut new_notifications = 0u32;
-
-    for (repo_id, mut repo_entries) in entries_by_repo {
-        let repo_name = repo_names
-            .get(&repo_id)
-            .cloned()
-            .unwrap_or_else(|| repo_id.clone());
-
-        // Scan dependencies for CVEs
-        let alerts = match scanner.scan_dependencies(&repo_id, &mut repo_entries).await {
-            Ok(a) => a,
-            Err(e) => {
-                tracing::warn!("CVE monitor: scan failed for {repo_name}: {e}");
-                continue;
-            }
-        };
-
-        // Upsert CVE alerts (existing logic)
-        for alert in &alerts {
-            let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
-            let update = doc! { "$setOnInsert": mongodb::bson::to_bson(alert).unwrap_or_default() };
-            let _ = db
-                .cve_alerts()
-                .update_one(filter, update)
-                .upsert(true)
-                .await;
-        }
-
-        // Update SBOM entries with discovered vulnerabilities
-        for entry in &repo_entries {
-            if entry.known_vulnerabilities.is_empty() {
-                continue;
-            }
-            if let Some(entry_id) = &entry.id {
-                let _ = db
-                    .sbom_entries()
-                    .update_one(
-                        doc! { "_id": entry_id },
-                        doc! { "$set": {
-                            "known_vulnerabilities": mongodb::bson::to_bson(&entry.known_vulnerabilities).unwrap_or_default(),
-                            "updated_at": mongodb::bson::DateTime::now(),
-                        }},
-                    )
-                    .await;
-            }
-        }
-
-        // Create notifications for NEW CVEs (dedup against existing notifications)
-        for alert in &alerts {
-            let filter = doc! {
-                "cve_id": &alert.cve_id,
-                "repo_id": &alert.repo_id,
-                "package_name": &alert.affected_package,
-                "package_version": &alert.affected_version,
-            };
-            // Only insert if not already exists (upsert with $setOnInsert)
-            let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
-            let mut notification = CveNotification::new(
-                alert.cve_id.clone(),
-                repo_id.clone(),
-                repo_name.clone(),
-                alert.affected_package.clone(),
-                alert.affected_version.clone(),
-                severity,
-            );
-            notification.cvss_score = alert.cvss_score;
-            notification.summary = alert.summary.clone();
-            notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
-
-            let update = doc! {
-                "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
-            };
-            match db
-                .cve_notifications()
-                .update_one(filter, update)
-                .upsert(true)
-                .await
-            {
-                Ok(result) if result.upserted_id.is_some() => {
-                    new_notifications += 1;
-                }
-                Err(e) => {
-                    tracing::warn!("CVE monitor: failed to create notification: {e}");
-                }
-                _ => {} // Already exists
-            }
-        }
-    }
-
-    if new_notifications > 0 {
-        tracing::info!(
-            "CVE monitor: created {new_notifications} new notification(s) for tenant '{tenant_id}'"
-        );
-    } else {
-        tracing::info!("CVE monitor: no new CVEs found for tenant '{tenant_id}'");
-    }
 }

compliance-agent/src/trackers/gitea.rs

@@ -98,8 +98,7 @@ impl IssueTracker for GiteaTracker {
             _ => "open",
         };
 
-        let resp = self
+        self.http
-            .http
             .patch(&url)
             .header(
                 "Authorization",
@@ -110,14 +109,6 @@ impl IssueTracker for GiteaTracker {
             .await
             .map_err(|e| CoreError::IssueTracker(format!("Gitea update issue failed: {e}")))?;
 
-        if !resp.status().is_success() {
-            let status = resp.status();
-            let text = resp.text().await.unwrap_or_default();
-            return Err(CoreError::IssueTracker(format!(
-                "Gitea update issue returned {status}: {text}"
-            )));
-        }
-
         Ok(())
     }
 
@@ -132,8 +123,7 @@ impl IssueTracker for GiteaTracker {
             "/repos/{owner}/{repo}/issues/{external_id}/comments"
         ));
 
-        let resp = self
+        self.http
-            .http
             .post(&url)
             .header(
                 "Authorization",
@@ -144,14 +134,6 @@ impl IssueTracker for GiteaTracker {
             .await
             .map_err(|e| CoreError::IssueTracker(format!("Gitea add comment failed: {e}")))?;
 
-        if !resp.status().is_success() {
-            let status = resp.status();
-            let text = resp.text().await.unwrap_or_default();
-            return Err(CoreError::IssueTracker(format!(
-                "Gitea add comment returned {status}: {text}"
-            )));
-        }
-
         Ok(())
     }
 
@@ -176,8 +158,7 @@ impl IssueTracker for GiteaTracker {
             })
             .collect();
 
-        let resp = self
+        self.http
-            .http
             .post(&url)
             .header(
                 "Authorization",
@@ -192,48 +173,6 @@ impl IssueTracker for GiteaTracker {
             .await
             .map_err(|e| CoreError::IssueTracker(format!("Gitea PR review failed: {e}")))?;
 
-        if !resp.status().is_success() {
-            let status = resp.status();
-            let text = resp.text().await.unwrap_or_default();
-
-            // If inline comments caused the failure, retry with just the summary body
-            if !comments.is_empty() {
-                tracing::warn!(
-                    "Gitea PR review with inline comments failed ({status}): {text}, retrying as plain comment"
-                );
-                let fallback_url = self.api_url(&format!(
-                    "/repos/{owner}/{repo}/issues/{pr_number}/comments"
-                ));
-                let fallback_resp = self
-                    .http
-                    .post(&fallback_url)
-                    .header(
-                        "Authorization",
-                        format!("token {}", self.token.expose_secret()),
-                    )
-                    .json(&serde_json::json!({ "body": body }))
-                    .send()
-                    .await
-                    .map_err(|e| {
-                        CoreError::IssueTracker(format!("Gitea PR comment fallback failed: {e}"))
-                    })?;
-
-                if !fallback_resp.status().is_success() {
-                    let fb_status = fallback_resp.status();
-                    let fb_text = fallback_resp.text().await.unwrap_or_default();
-                    return Err(CoreError::IssueTracker(format!(
-                        "Gitea PR comment fallback returned {fb_status}: {fb_text}"
-                    )));
-                }
-
-                return Ok(());
-            }
-
-            return Err(CoreError::IssueTracker(format!(
-                "Gitea PR review returned {status}: {text}"
-            )));
-        }
-
         Ok(())
     }
 

compliance-agent/src/webhooks/gitea.rs

@@ -14,30 +14,24 @@ type HmacSha256 = Hmac<Sha256>;
 
 pub async fn handle_gitea_webhook(
     Extension(agent): Extension<Arc<ComplianceAgent>>,
-    Path((tenant_id, repo_id)): Path<(String, String)>,
+    Path(repo_id): Path<String>,
     headers: HeaderMap,
     body: Bytes,
 ) -> StatusCode {
-    // Look up the repo in the tenant's database to get its webhook secret
+    // Look up the repo to get its webhook secret
     let oid = match mongodb::bson::oid::ObjectId::parse_str(&repo_id) {
         Ok(oid) => oid,
         Err(_) => return StatusCode::NOT_FOUND,
     };
-    let db = match agent.db_pool.for_tenant_id(&tenant_id).await {
+    let repo = match agent
-        Ok(db) => db,
+        .db
-        Err(e) => {
-            tracing::warn!("Gitea webhook: cannot open tenant database '{tenant_id}': {e}");
-            return StatusCode::NOT_FOUND;
-        }
-    };
-    let repo = match db
         .repositories()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {
         Ok(Some(repo)) => repo,
         _ => {
-            tracing::warn!("Gitea webhook: repo {repo_id} not found in tenant '{tenant_id}'");
+            tracing::warn!("Gitea webhook: repo {repo_id} not found");
             return StatusCode::NOT_FOUND;
         }
     };
@@ -72,21 +66,15 @@ pub async fn handle_gitea_webhook(
         "push" => {
             let agent_clone = (*agent).clone();
             let repo_id = repo_id.clone();
-            let tenant_id = tenant_id.clone();
             tokio::spawn(async move {
-                tracing::info!(
+                tracing::info!("Gitea push webhook: triggering scan for {repo_id}");
-                    "Gitea push webhook: triggering scan for {repo_id} in tenant {tenant_id}"
+                if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
-                );
-                if let Err(e) = agent_clone
-                    .run_scan(&tenant_id, &repo_id, ScanTrigger::Webhook)
-                    .await
-                {
                     tracing::error!("Webhook-triggered scan failed: {e}");
                 }
             });
             StatusCode::OK
         }
-        "pull_request" => handle_pull_request(agent, &tenant_id, &repo_id, &payload).await,
+        "pull_request" => handle_pull_request(agent, &repo_id, &payload).await,
         _ => {
             tracing::debug!("Gitea webhook: ignoring event '{event}'");
             StatusCode::OK
@@ -96,7 +84,6 @@ pub async fn handle_gitea_webhook(
 
 async fn handle_pull_request(
     agent: Arc<ComplianceAgent>,
-    tenant_id: &str,
     repo_id: &str,
     payload: &serde_json::Value,
 ) -> StatusCode {
@@ -119,14 +106,13 @@ async fn handle_pull_request(
     }
 
     let repo_id = repo_id.to_string();
-    let tenant_id = tenant_id.to_string();
     let head_sha = head_sha.to_string();
     let base_sha = base_sha.to_string();
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         tracing::info!("Gitea PR webhook: reviewing PR #{pr_number} on {repo_id}");
         if let Err(e) = agent_clone
-            .run_pr_review(&tenant_id, &repo_id, pr_number, &base_sha, &head_sha)
+            .run_pr_review(&repo_id, pr_number, &base_sha, &head_sha)
             .await
         {
             tracing::error!("PR review failed for #{pr_number}: {e}");

compliance-agent/src/webhooks/github.rs

@@ -14,30 +14,24 @@ type HmacSha256 = Hmac<Sha256>;
 
 pub async fn handle_github_webhook(
     Extension(agent): Extension<Arc<ComplianceAgent>>,
-    Path((tenant_id, repo_id)): Path<(String, String)>,
+    Path(repo_id): Path<String>,
     headers: HeaderMap,
     body: Bytes,
 ) -> StatusCode {
-    // Look up the repo in the tenant's database to get its webhook secret
+    // Look up the repo to get its webhook secret
     let oid = match mongodb::bson::oid::ObjectId::parse_str(&repo_id) {
         Ok(oid) => oid,
         Err(_) => return StatusCode::NOT_FOUND,
     };
-    let db = match agent.db_pool.for_tenant_id(&tenant_id).await {
+    let repo = match agent
-        Ok(db) => db,
+        .db
-        Err(e) => {
-            tracing::warn!("GitHub webhook: cannot open tenant database '{tenant_id}': {e}");
-            return StatusCode::NOT_FOUND;
-        }
-    };
-    let repo = match db
         .repositories()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {
         Ok(Some(repo)) => repo,
         _ => {
-            tracing::warn!("GitHub webhook: repo {repo_id} not found in tenant '{tenant_id}'");
+            tracing::warn!("GitHub webhook: repo {repo_id} not found");
             return StatusCode::NOT_FOUND;
         }
     };
@@ -72,21 +66,15 @@ pub async fn handle_github_webhook(
         "push" => {
             let agent_clone = (*agent).clone();
             let repo_id = repo_id.clone();
-            let tenant_id = tenant_id.clone();
             tokio::spawn(async move {
-                tracing::info!(
+                tracing::info!("GitHub push webhook: triggering scan for {repo_id}");
-                    "GitHub push webhook: triggering scan for {repo_id} in tenant {tenant_id}"
+                if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
-                );
-                if let Err(e) = agent_clone
-                    .run_scan(&tenant_id, &repo_id, ScanTrigger::Webhook)
-                    .await
-                {
                     tracing::error!("Webhook-triggered scan failed: {e}");
                 }
             });
             StatusCode::OK
         }
-        "pull_request" => handle_pull_request(agent, &tenant_id, &repo_id, &payload).await,
+        "pull_request" => handle_pull_request(agent, &repo_id, &payload).await,
         _ => {
             tracing::debug!("GitHub webhook: ignoring event '{event}'");
             StatusCode::OK
@@ -96,7 +84,6 @@ pub async fn handle_github_webhook(
 
 async fn handle_pull_request(
     agent: Arc<ComplianceAgent>,
-    tenant_id: &str,
     repo_id: &str,
     payload: &serde_json::Value,
 ) -> StatusCode {
@@ -118,14 +105,13 @@ async fn handle_pull_request(
     }
 
     let repo_id = repo_id.to_string();
-    let tenant_id = tenant_id.to_string();
     let head_sha = head_sha.to_string();
     let base_sha = base_sha.to_string();
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         tracing::info!("GitHub PR webhook: reviewing PR #{pr_number} on {repo_id}");
         if let Err(e) = agent_clone
-            .run_pr_review(&tenant_id, &repo_id, pr_number, &base_sha, &head_sha)
+            .run_pr_review(&repo_id, pr_number, &base_sha, &head_sha)
             .await
         {
             tracing::error!("PR review failed for #{pr_number}: {e}");

compliance-agent/src/webhooks/gitlab.rs

@@ -10,30 +10,24 @@ use crate::agent::ComplianceAgent;
 
 pub async fn handle_gitlab_webhook(
     Extension(agent): Extension<Arc<ComplianceAgent>>,
-    Path((tenant_id, repo_id)): Path<(String, String)>,
+    Path(repo_id): Path<String>,
     headers: HeaderMap,
     body: Bytes,
 ) -> StatusCode {
-    // Look up the repo in the tenant's database to get its webhook secret
+    // Look up the repo to get its webhook secret
     let oid = match mongodb::bson::oid::ObjectId::parse_str(&repo_id) {
         Ok(oid) => oid,
         Err(_) => return StatusCode::NOT_FOUND,
     };
-    let db = match agent.db_pool.for_tenant_id(&tenant_id).await {
+    let repo = match agent
-        Ok(db) => db,
+        .db
-        Err(e) => {
-            tracing::warn!("GitLab webhook: cannot open tenant database '{tenant_id}': {e}");
-            return StatusCode::NOT_FOUND;
-        }
-    };
-    let repo = match db
         .repositories()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {
         Ok(Some(repo)) => repo,
         _ => {
-            tracing::warn!("GitLab webhook: repo {repo_id} not found in tenant '{tenant_id}'");
+            tracing::warn!("GitLab webhook: repo {repo_id} not found");
             return StatusCode::NOT_FOUND;
         }
     };
@@ -65,21 +59,15 @@ pub async fn handle_gitlab_webhook(
         "push" => {
             let agent_clone = (*agent).clone();
             let repo_id = repo_id.clone();
-            let tenant_id = tenant_id.clone();
             tokio::spawn(async move {
-                tracing::info!(
+                tracing::info!("GitLab push webhook: triggering scan for {repo_id}");
-                    "GitLab push webhook: triggering scan for {repo_id} in tenant {tenant_id}"
+                if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
-                );
-                if let Err(e) = agent_clone
-                    .run_scan(&tenant_id, &repo_id, ScanTrigger::Webhook)
-                    .await
-                {
                     tracing::error!("Webhook-triggered scan failed: {e}");
                 }
             });
             StatusCode::OK
         }
-        "merge_request" => handle_merge_request(agent, &tenant_id, &repo_id, &payload).await,
+        "merge_request" => handle_merge_request(agent, &repo_id, &payload).await,
         _ => {
             tracing::debug!("GitLab webhook: ignoring event '{event_type}'");
             StatusCode::OK
@@ -89,7 +77,6 @@ pub async fn handle_gitlab_webhook(
 
 async fn handle_merge_request(
     agent: Arc<ComplianceAgent>,
-    tenant_id: &str,
     repo_id: &str,
     payload: &serde_json::Value,
 ) -> StatusCode {
@@ -114,14 +101,13 @@ async fn handle_merge_request(
     }
 
     let repo_id = repo_id.to_string();
-    let tenant_id = tenant_id.to_string();
     let head_sha = head_sha.to_string();
     let base_sha = base_sha.to_string();
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         tracing::info!("GitLab MR webhook: reviewing MR !{mr_iid} on {repo_id}");
         if let Err(e) = agent_clone
-            .run_pr_review(&tenant_id, &repo_id, mr_iid, &base_sha, &head_sha)
+            .run_pr_review(&repo_id, mr_iid, &base_sha, &head_sha)
             .await
         {
             tracing::error!("MR review failed for !{mr_iid}: {e}");