fix(audit): bump crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204)

Invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared` when the underlying pointer is invalid. Lockfile-only bump; no code changes. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat(onboarding): unified multi-target model + scan matrix foundation
2026-07-10 15:30:45 +02:00 · 2026-07-10 12:23:51 +02:00
30 changed files with 12 additions and 2837 deletions
@@ -9,25 +9,10 @@ on:
 env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
-  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
-  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
-  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
-  # and HETZNER_S3_SECRET_KEY.
+  # sccache caches compilation artifacts within a job so that compiling
+  # both --features server and --features web shares common crate work.
  RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_BUCKET: breakpilot-sccache
-  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
-  SCCACHE_REGION: auto
-  SCCACHE_S3_USE_SSL: "true"
-  SCCACHE_S3_KEY_PREFIX: compliance-scanner
-  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
-  # compliance-agent depends on tramiton-core via git; use the system git so the
-  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
-  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
-  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
-  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
-  CARGO_NET_RETRY: "10"
-  CARGO_HTTP_MULTIPLEXING: "false"
+  SCCACHE_DIR: /tmp/sccache

 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -51,44 +36,16 @@ jobs:
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
-      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
-      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
-      # replacement only applies to crates.io-sourced crates.
-      - name: Use Kellnr crates.io mirror
-        run: |
-          : "${CARGO_HOME:=/usr/local/cargo}"
-          mkdir -p "$CARGO_HOME"
-          {
-            echo '[source.crates-io]'
-            echo 'replace-with = "kellnr"'
-            echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
-          } >> "$CARGO_HOME/config.toml"
-        env:
-          RUSTC_WRAPPER: ""
      - name: Install tools
        run: |
          rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
          chmod +x /usr/local/bin/sccache
          cargo install cargo-audit --locked
        env:
          RUSTC_WRAPPER: ""

-      # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
-      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
-      # with read:repository, owned by a user with access to sharang/tramiton).
-      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
-      - name: Configure git auth for private tramiton dependency
-        run: |
-          git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@gitea.meghsakha.com:22222/"
-        env:
-          RUSTC_WRAPPER: ""
-
      # Format (no compilation needed)
      - name: Format
        run: cargo fmt --all --check
@@ -692,7 +692,6 @@ dependencies = [
 "tower-http",
 "tracing",
 "tracing-subscriber",
- "tramiton-core",
 "urlencoding",
 "uuid",
 "walkdir",
@@ -4198,7 +4197,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit 0.23.10+spec-1.0.0",
+ "toml_edit",
 ]

 [[package]]
@@ -4997,15 +4996,6 @@ dependencies = [
 "syn",
 ]

-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5820,27 +5810,6 @@ dependencies = [
 "tokio",
 ]

-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5850,20 +5819,6 @@ dependencies = [
 "serde_core",
 ]

-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap 2.13.0",
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_write",
- "winnow",
-]
-
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5871,7 +5826,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
 "indexmap 2.13.0",
- "toml_datetime 0.7.5+spec-1.1.0",
+ "toml_datetime",
 "toml_parser",
 "winnow",
 ]
@@ -5885,12 +5840,6 @@ dependencies = [
 "winnow",
 ]

-[[package]]
-name = "toml_write"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
-
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6137,18 +6086,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "tramiton-core"
-version = "0.4.0"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
-dependencies = [
- "serde",
- "tempfile",
- "thiserror 1.0.69",
- "toml",
- "walkdir",
-]
-
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -10,11 +10,6 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
-# Native firmware build/target detection for bare-metal & RTOS artifacts.
-# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
-# available to the onboarding classifier. NOTE: CI must be able to fetch this
-# private repo (see the git-auth step in .gitea/workflows/ci.yml).
-tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -1,217 +0,0 @@
-//! Firmware classification via tramiton.
-//!
-//! tramiton is the company's firmware build/repro engine; we do not re-implement
-//! its detection. We depend on `tramiton-core` directly (same-company IP) and run
-//! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
-//! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
-//! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
-//! tramiton sources nor a real firmware tree.
-
-use std::path::Path;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{DetectedFact, TargetType};
-use compliance_core::traits::ClassifierVerdict;
-
-/// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
-/// Kept small and tramiton-independent so the classifier and the test mock don't
-/// need to construct a full tramiton plan.
-#[derive(Debug, Clone, Default)]
-pub struct FirmwareDetection {
-    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
-    pub provider: String,
-    /// Detection confidence: `low` | `medium` | `high`.
-    pub confidence: String,
-    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
-    pub build_system: String,
-    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
-    pub framework: Option<String>,
-    /// Target board / MCU / arch.
-    pub target: FirmwareTarget,
-    /// Unresolved gaps in the plan.
-    pub gaps: Vec<String>,
-}
-
-/// The detected firmware target (board / MCU / arch).
-#[derive(Debug, Clone, Default)]
-pub struct FirmwareTarget {
-    /// Board name.
-    pub board: Option<String>,
-    /// MCU part.
-    pub mcu: Option<String>,
-    /// Architecture.
-    pub arch: Option<String>,
-}
-
-/// A source of tramiton firmware detection.
-#[allow(async_fn_in_trait)]
-pub trait FirmwareDetector: Send + Sync {
-    /// Run detection over a path, returning a firmware detection if tramiton
-    /// could form a build plan.
-    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
-}
-
-/// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
-/// so it runs on a blocking thread to avoid stalling the async runtime. A path
-/// with no recognizable build system yields `Ok(None)`.
-pub struct TramitonNative;
-
-impl FirmwareDetector for TramitonNative {
-    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
-        let path = path.to_path_buf();
-        let plan = tokio::task::spawn_blocking(move || {
-            let repo = tramiton_core::Repo::new(&path);
-            tramiton_core::provider::analyze(&repo)
-        })
-        .await
-        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
-        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
-        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
-    }
-}
-
-/// Map tramiton's `BuildPlan` onto our minimal detection summary.
-fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
-    FirmwareDetection {
-        provider: bp.provider.clone(),
-        confidence: bp.confidence.to_string(),
-        build_system: bp.build_system.label().to_string(),
-        framework: bp.framework.clone(),
-        target: FirmwareTarget {
-            board: bp.target.board.clone(),
-            mcu: bp.target.mcu.clone(),
-            arch: bp.target.arch.clone(),
-        },
-        gaps: bp.gaps.clone(),
-    }
-}
-
-/// Map a firmware detection to a target type. Framework/build-system signals
-/// distinguish RTOS from bare-metal from Yocto.
-pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
-    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
-    let build_system = det.build_system.to_lowercase();
-    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
-
-    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
-    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
-        TargetType::EmbeddedLinuxYocto
-    } else if RTOS.iter().any(|k| signal.contains(k)) {
-        TargetType::FirmwareRtos
-    } else {
-        TargetType::FirmwareBareMetal
-    }
-}
-
-/// Map tramiton's confidence label to a `[0,1]` score.
-fn confidence_score(label: &str) -> f32 {
-    match label.to_lowercase().as_str() {
-        "high" => 0.9,
-        "medium" => 0.6,
-        "low" => 0.3,
-        _ => 0.4,
-    }
-}
-
-/// Turn a firmware detection into a classifier verdict, carrying the MCU / board
-/// / build-system as facts.
-pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
-    let target_type = detection_to_target_type(det);
-    let mut facts = vec![DetectedFact::new(
-        "build_system",
-        det.build_system.clone(),
-        "tramiton",
-    )];
-    if let Some(fw) = &det.framework {
-        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
-    }
-    if let Some(mcu) = &det.target.mcu {
-        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
-    }
-    if let Some(board) = &det.target.board {
-        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
-    }
-    if let Some(arch) = &det.target.arch {
-        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
-    }
-    ClassifierVerdict {
-        target_type,
-        confidence: confidence_score(&det.confidence),
-        facts,
-        rationale: format!(
-            "tramiton detected build system '{}'{}",
-            det.build_system,
-            det.framework
-                .as_ref()
-                .map(|f| format!(" (framework {f})"))
-                .unwrap_or_default()
-        ),
-    }
-}
-
-/// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
-pub struct MockFirmwareDetector {
-    /// The detection to return (or `None` for "no detection").
-    pub detection: Option<FirmwareDetection>,
-}
-
-impl FirmwareDetector for MockFirmwareDetector {
-    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
-        Ok(self.detection.clone())
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
-        FirmwareDetection {
-            provider: build_system.to_string(),
-            confidence: "high".to_string(),
-            build_system: build_system.to_string(),
-            framework: framework.map(|s| s.to_string()),
-            target: FirmwareTarget {
-                mcu: Some("stm32f429".to_string()),
-                ..Default::default()
-            },
-            gaps: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn zephyr_maps_to_rtos() {
-        assert_eq!(
-            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
-            TargetType::FirmwareRtos
-        );
-    }
-
-    #[test]
-    fn bare_cmake_maps_to_bare_metal() {
-        assert_eq!(
-            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
-            TargetType::FirmwareBareMetal
-        );
-    }
-
-    #[test]
-    fn bitbake_maps_to_yocto() {
-        assert_eq!(
-            detection_to_target_type(&detection("bitbake", None)),
-            TargetType::EmbeddedLinuxYocto
-        );
-    }
-
-    #[test]
-    fn verdict_carries_mcu_fact_and_confidence() {
-        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
-        assert_eq!(v.target_type, TargetType::FirmwareRtos);
-        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
-        assert!(v
-            .facts
-            .iter()
-            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
-    }
-}
@@ -1,357 +0,0 @@
-//! Heuristic target-type classification from artifact kinds and source markers.
-//!
-//! Complements the tramiton firmware detector: this handles web / backend /
-//! mobile / desktop / PLC by sniffing manifest files and file extensions in the
-//! ingested code trees, plus strong priors from the artifact kinds themselves
-//! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
-
-use std::collections::HashSet;
-use std::fs;
-use std::path::Path;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
-use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-
-/// Max directory depth scanned for marker files.
-const SCAN_DEPTH: usize = 2;
-
-/// Markers collected from a code tree.
-#[derive(Default)]
-struct Markers {
-    files: HashSet<String>,
-    dirs: HashSet<String>,
-    exts: HashSet<String>,
-}
-
-impl Markers {
-    fn has_file(&self, name: &str) -> bool {
-        self.files.contains(name)
-    }
-    fn has_ext(&self, ext: &str) -> bool {
-        self.exts.contains(ext)
-    }
-    fn any_dir_ends_with(&self, suffix: &str) -> bool {
-        self.dirs.iter().any(|d| d.ends_with(suffix))
-    }
-}
-
-/// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
-fn collect_markers(root: &Path) -> Markers {
-    let mut m = Markers::default();
-    scan_dir(root, 0, &mut m);
-    m
-}
-
-fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
-    let Ok(entries) = fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        let name = entry.file_name().to_string_lossy().to_lowercase();
-        if path.is_dir() {
-            m.dirs.insert(name);
-            if depth < SCAN_DEPTH {
-                scan_dir(&path, depth + 1, m);
-            }
-        } else {
-            if let Some(ext) = path.extension() {
-                m.exts.insert(ext.to_string_lossy().to_lowercase());
-            }
-            m.files.insert(name);
-        }
-    }
-}
-
-/// Whether a `package.json` at `root` looks like a front-end app.
-fn package_json_is_frontend(root: &Path) -> bool {
-    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
-        return false;
-    };
-    let c = content.to_lowercase();
-    ["react", "next", "vue", "@angular", "svelte", "vite"]
-        .iter()
-        .any(|f| c.contains(f))
-}
-
-/// The heuristic classifier: artifact-kind priors + source-tree markers.
-pub struct HeuristicClassifier;
-
-impl HeuristicClassifier {
-    /// Verdicts from the artifact kinds alone (no filesystem needed).
-    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
-        let mut out = Vec::new();
-        for a in input.artifacts {
-            let lower = a.source_ref.to_lowercase();
-            match a.kind {
-                ArtifactKind::PlcProject => out.push(verdict(
-                    TargetType::PlcSps,
-                    0.85,
-                    "PLC project artifact",
-                    vec![],
-                )),
-                ArtifactKind::MobilePackage => {
-                    let (tt, why) = if lower.ends_with(".ipa") {
-                        (TargetType::IosApp, "iOS package (.ipa)")
-                    } else {
-                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
-                    };
-                    out.push(verdict(tt, 0.85, why, vec![]));
-                }
-                ArtifactKind::ContainerImage => out.push(verdict(
-                    TargetType::BackendService,
-                    0.4,
-                    "container image",
-                    vec![],
-                )),
-                ArtifactKind::FirmwareImage => out.push(verdict(
-                    TargetType::FirmwareBareMetal,
-                    0.35,
-                    "firmware image (pending tramiton detection)",
-                    vec![],
-                )),
-                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
-                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
-                }
-                _ => {}
-            }
-        }
-        out
-    }
-
-    /// Verdicts from scanning the ingested code trees for manifest markers.
-    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
-        let mut out = Vec::new();
-        for a in input.artifacts {
-            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
-                continue;
-            }
-            let Some(path) = input.working_paths.get(&a.id) else {
-                continue;
-            };
-            let m = collect_markers(path);
-
-            // Mobile (checked first — strongest signal).
-            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
-                out.push(verdict(
-                    TargetType::AndroidApp,
-                    0.8,
-                    "Android manifest / gradle",
-                    facts_lang("kotlin/java"),
-                ));
-            }
-            if m.any_dir_ends_with(".xcodeproj")
-                || m.has_file("info.plist")
-                || m.has_file("podfile")
-                || m.has_ext("ipa")
-            {
-                out.push(verdict(
-                    TargetType::IosApp,
-                    0.8,
-                    "Xcode project / Info.plist",
-                    facts_lang("swift/objc"),
-                ));
-            }
-            // Desktop.
-            if m.has_ext("sln")
-                || m.has_ext("csproj")
-                || m.has_ext("vcxproj")
-                || m.has_ext("desktop")
-            {
-                out.push(verdict(
-                    TargetType::DesktopApp,
-                    0.7,
-                    "desktop project files",
-                    facts_lang("dotnet/native"),
-                ));
-            }
-            // PLC.
-            if m.has_ext("st") {
-                out.push(verdict(
-                    TargetType::PlcSps,
-                    0.8,
-                    "Structured Text sources",
-                    facts_lang("iec-61131-3"),
-                ));
-            }
-            // Web vs backend from package.json.
-            if m.has_file("package.json") {
-                if package_json_is_frontend(path) {
-                    out.push(verdict(
-                        TargetType::WebApp,
-                        0.65,
-                        "package.json with a front-end framework",
-                        facts_lang("javascript"),
-                    ));
-                } else {
-                    out.push(verdict(
-                        TargetType::BackendService,
-                        0.55,
-                        "package.json (no front-end framework)",
-                        facts_lang("javascript"),
-                    ));
-                }
-            }
-            // Backend languages.
-            for (file, lang) in [
-                ("cargo.toml", "rust"),
-                ("go.mod", "go"),
-                ("pom.xml", "java"),
-                ("requirements.txt", "python"),
-                ("pyproject.toml", "python"),
-            ] {
-                if m.has_file(file) {
-                    out.push(verdict(
-                        TargetType::BackendService,
-                        0.6,
-                        "backend build manifest",
-                        facts_lang(lang),
-                    ));
-                }
-            }
-            // Container-only.
-            if m.has_file("dockerfile") && out.is_empty() {
-                out.push(verdict(
-                    TargetType::BackendService,
-                    0.4,
-                    "Dockerfile",
-                    facts_lang("container"),
-                ));
-            }
-        }
-        out
-    }
-}
-
-impl TargetClassifier for HeuristicClassifier {
-    fn name(&self) -> &str {
-        "heuristic"
-    }
-
-    async fn classify(
-        &self,
-        input: &ClassificationInput<'_>,
-    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
-        let mut out = self.kind_priors(input);
-        out.extend(self.source_verdicts(input));
-        Ok(out)
-    }
-}
-
-fn verdict(
-    target_type: TargetType,
-    confidence: f32,
-    rationale: &str,
-    facts: Vec<DetectedFact>,
-) -> ClassifierVerdict {
-    ClassifierVerdict {
-        target_type,
-        confidence,
-        facts,
-        rationale: rationale.to_string(),
-    }
-}
-
-fn facts_lang(lang: &str) -> Vec<DetectedFact> {
-    vec![DetectedFact::new("language", lang, "heuristic")]
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Artifact;
-    use std::collections::HashMap;
-    use std::path::PathBuf;
-
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
-        let scratch = Scratch::new();
-        setup(&scratch.0);
-        let artifact = Artifact::git_repo("https://git/x", "main");
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let artifacts = vec![artifact];
-        let input = ClassificationInput {
-            artifacts: &artifacts,
-            working_paths: &wp,
-            description: None,
-        };
-        HeuristicClassifier
-            .classify(&input)
-            .await
-            .expect("classify")
-    }
-
-    #[tokio::test]
-    async fn frontend_package_json_is_webapp() {
-        let v = classify_tree(|root| {
-            fs::write(
-                root.join("package.json"),
-                r#"{"dependencies":{"react":"18"}}"#,
-            )
-            .unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
-    }
-
-    #[tokio::test]
-    async fn cargo_toml_is_backend() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
-        })
-        .await;
-        assert!(v
-            .iter()
-            .any(|x| x.target_type == TargetType::BackendService));
-    }
-
-    #[tokio::test]
-    async fn android_manifest_is_android() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
-    }
-
-    #[tokio::test]
-    async fn structured_text_is_plc() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
-    }
-
-    #[tokio::test]
-    async fn ipa_artifact_prior_is_ios() {
-        let artifacts = vec![Artifact::mobile_package("app.ipa")];
-        let wp = HashMap::new();
-        let input = ClassificationInput {
-            artifacts: &artifacts,
-            working_paths: &wp,
-            description: None,
-        };
-        let v = HeuristicClassifier
-            .classify(&input)
-            .await
-            .expect("classify");
-        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
-    }
-}
@@ -1,226 +0,0 @@
-//! Target classification.
-//!
-//! Runs the classifier registry over a target's artifacts and their ingested
-//! working paths, then merges and ranks the verdicts into a [`Classification`].
-//! The registry is the heuristic classifier (artifact kinds + source markers)
-//! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
-
-mod firmware;
-mod language;
-
-pub use firmware::{
-    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
-};
-pub use language::HeuristicClassifier;
-
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{
-    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
-};
-use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-
-use firmware::detection_to_verdict;
-
-/// Classify a target from its artifacts and their ingested working paths, using
-/// the heuristic classifier plus the tramiton firmware detector. Verdicts are
-/// merged (max confidence per target type) and ranked into a [`Classification`].
-pub async fn classify_target<D: FirmwareDetector>(
-    target: &OnboardedTarget,
-    working_paths: &HashMap<String, PathBuf>,
-    firmware_detector: &D,
-) -> Result<Classification, CoreError> {
-    let input = ClassificationInput {
-        artifacts: &target.artifacts,
-        working_paths,
-        description: target.description.as_deref(),
-    };
-
-    let mut verdicts = Vec::new();
-    let mut detected_by = Vec::new();
-
-    let heuristic = HeuristicClassifier.classify(&input).await?;
-    if !heuristic.is_empty() {
-        detected_by.push("heuristic".to_string());
-    }
-    verdicts.extend(heuristic);
-
-    // Tramiton firmware detection over firmware / code working paths.
-    let mut tramiton_used = false;
-    for artifact in &target.artifacts {
-        if !matches!(
-            artifact.kind,
-            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-        ) {
-            continue;
-        }
-        let Some(path) = working_paths.get(&artifact.id) else {
-            continue;
-        };
-        if let Some(detection) = firmware_detector.detect(path).await? {
-            verdicts.push(detection_to_verdict(&detection));
-            tramiton_used = true;
-        }
-    }
-    if tramiton_used {
-        detected_by.push("tramiton".to_string());
-    }
-
-    Ok(rank(verdicts, detected_by, target.target_type))
-}
-
-/// Merge verdicts by target type (keeping the max confidence and its rationale),
-/// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
-/// Falls back to the declared type when no verdict is produced.
-fn rank(
-    verdicts: Vec<ClassifierVerdict>,
-    detected_by: Vec<String>,
-    fallback: TargetType,
-) -> Classification {
-    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
-    let mut facts: Vec<DetectedFact> = Vec::new();
-    for verdict in verdicts {
-        for fact in verdict.facts {
-            if !facts
-                .iter()
-                .any(|e| e.key == fact.key && e.value == fact.value)
-            {
-                facts.push(fact);
-            }
-        }
-        let entry = best
-            .entry(verdict.target_type)
-            .or_insert((0.0, String::new()));
-        if verdict.confidence > entry.0 {
-            *entry = (verdict.confidence, verdict.rationale);
-        }
-    }
-
-    let mut candidates: Vec<TargetTypeCandidate> = best
-        .into_iter()
-        .map(
-            |(target_type, (confidence, rationale))| TargetTypeCandidate {
-                target_type,
-                confidence,
-                rationale,
-            },
-        )
-        .collect();
-    // Descending confidence; ties broken by type name for deterministic ordering.
-    candidates.sort_by(|a, b| {
-        b.confidence
-            .partial_cmp(&a.confidence)
-            .unwrap_or(std::cmp::Ordering::Equal)
-            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
-    });
-
-    let suggested = candidates
-        .first()
-        .map(|c| c.target_type)
-        .unwrap_or(fallback);
-
-    Classification {
-        suggested,
-        candidates,
-        facts,
-        detected_by,
-        detected_at: chrono::Utc::now(),
-        confirmed: false,
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Artifact;
-    use std::fs;
-    use std::path::Path;
-
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    fn no_firmware() -> MockFirmwareDetector {
-        MockFirmwareDetector { detection: None }
-    }
-
-    #[tokio::test]
-    async fn backend_repo_classifies_as_backend() {
-        let scratch = Scratch::new();
-        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
-
-        let artifact = Artifact::git_repo("https://git/x", "main");
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
-        target.artifacts.push(artifact);
-
-        let c = classify_target(&target, &wp, &no_firmware())
-            .await
-            .expect("classify");
-        assert_eq!(c.suggested, TargetType::BackendService);
-        assert!(c.detected_by.contains(&"heuristic".to_string()));
-        assert!(!c.confirmed);
-    }
-
-    #[tokio::test]
-    async fn firmware_detector_verdict_ranks_top() {
-        let scratch = Scratch::new();
-        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
-
-        let artifact =
-            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
-        target.artifacts.push(artifact);
-
-        let detector = MockFirmwareDetector {
-            detection: Some(FirmwareDetection {
-                provider: "zephyr".to_string(),
-                confidence: "high".to_string(),
-                build_system: "zephyr".to_string(),
-                framework: Some("zephyr".to_string()),
-                target: FirmwareTarget {
-                    mcu: Some("nrf52840".to_string()),
-                    ..Default::default()
-                },
-                gaps: vec![],
-            }),
-        };
-
-        let c = classify_target(&target, &wp, &detector)
-            .await
-            .expect("classify");
-        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
-        assert_eq!(c.suggested, TargetType::FirmwareRtos);
-        assert!(c.detected_by.contains(&"tramiton".to_string()));
-        assert!(c.facts.iter().any(|f| f.key == "mcu"));
-    }
-
-    #[tokio::test]
-    async fn no_signal_falls_back_to_declared_type() {
-        let scratch = Scratch::new();
-        let _ = Path::new(&scratch.0);
-        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
-        let wp = HashMap::new();
-        let c = classify_target(&target, &wp, &no_firmware())
-            .await
-            .expect("classify");
-        assert_eq!(c.suggested, TargetType::DesktopApp);
-        assert!(c.candidates.is_empty());
-    }
-}
@@ -45,8 +45,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
            .unwrap_or_else(|| "0 0 * * * *".to_string()),
        git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
            .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
-        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
-            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
        ssh_key_path: env_var_opt("SSH_KEY_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
        keycloak_url: env_var_opt("KEYCLOAK_URL"),
@@ -179,23 +179,6 @@ impl DatabasePool {
            .collect())
    }

-    /// Tenant ids for every provisioned tenant database, derived by stripping
-    /// the `<prefix>_` from the database names. Skips the admin database
-    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
-    /// at the cluster level and cannot be recovered here — in practice tenant
-    /// ids are UUIDs and never hit that path. Used by the migration CLI's
-    /// `--all` mode.
-    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
-        let prefix = format!("{}_", self.db_prefix);
-        Ok(self
-            .list_tenant_db_names()
-            .await?
-            .into_iter()
-            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
-            .filter(|id| !id.starts_with('_'))
-            .collect())
-    }
-
    /// Drop the database for a specific tenant. Used by GDPR delete
    /// and tenant offboarding. Idempotent — dropping a non-existent
    /// database is a no-op at the driver level.
@@ -538,13 +521,6 @@ impl Database {
        self.inner.collection("onboarded_targets")
    }

-    /// A typed handle to an arbitrary collection by name. For bookkeeping
-    /// collections without a dedicated model (e.g. `schema_migrations`,
-    /// `onboarding_migration_log`).
-    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
-        self.inner.collection(name)
-    }
-
    pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
        self.inner.collection("dast_scan_runs")
    }
@@ -1,154 +0,0 @@
-//! Content-addressed blob storage and archive extraction for ingest.
-//!
-//! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
-//! digest; per-run working directories live under `<base>/work/`.
-
-use std::fs::{self, File};
-use std::io::{self, Read};
-use std::path::{Path, PathBuf};
-
-use sha2::{Digest, Sha256};
-
-use crate::error::AgentError;
-
-/// Read buffer size for streaming hashes/copies (64 KiB).
-const BUF_LEN: usize = 64 * 1024;
-
-/// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
-/// byte length. Streams so large firmware images never load fully into memory.
-pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
-    let mut file = File::open(path)?;
-    let mut hasher = Sha256::new();
-    let mut buf = [0u8; BUF_LEN];
-    let mut total: u64 = 0;
-    loop {
-        let n = file.read(&mut buf)?;
-        if n == 0 {
-            break;
-        }
-        hasher.update(&buf[..n]);
-        total += n as u64;
-    }
-    Ok((hex::encode(hasher.finalize()), total))
-}
-
-/// Copy `src` into the content-addressed blob store under `base`, returning the
-/// stored path. Idempotent: an already-present blob is not rewritten.
-pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
-    if sha.len() < 2 {
-        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
-    }
-    let dir = base.join("blobs").join(&sha[0..2]);
-    fs::create_dir_all(&dir)?;
-    let dest = dir.join(sha);
-    if !dest.exists() {
-        fs::copy(src, &dest)?;
-    }
-    Ok(dest)
-}
-
-/// Extract a zip archive into `dest` (created if needed). `enclosed_name`
-/// sanitizes each entry path, so this is safe against zip-slip traversal.
-pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
-    let file = File::open(archive)?;
-    let mut zip =
-        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
-    fs::create_dir_all(dest)?;
-    for i in 0..zip.len() {
-        let mut entry = zip
-            .by_index(i)
-            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
-        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
-        let Some(rel) = entry.enclosed_name() else {
-            continue;
-        };
-        let out = dest.join(rel);
-        if entry.is_dir() {
-            fs::create_dir_all(&out)?;
-        } else {
-            if let Some(parent) = out.parent() {
-                fs::create_dir_all(parent)?;
-            }
-            let mut outfile = File::create(&out)?;
-            io::copy(&mut entry, &mut outfile)?;
-        }
-    }
-    Ok(())
-}
-
-/// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
-pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
-    base.join("work").join(target_id).join(artifact_id)
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    /// A unique scratch directory, removed on drop.
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir scratch");
-            Self(p)
-        }
-        fn path(&self) -> &Path {
-            &self.0
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    #[test]
-    fn hash_is_stable_and_reports_size() {
-        let dir = Scratch::new();
-        let f = dir.path().join("a.bin");
-        fs::write(&f, b"hello world").expect("write");
-        let (sha, size) = hash_file(&f).expect("hash");
-        assert_eq!(size, 11);
-        // Known SHA-256 of "hello world".
-        assert_eq!(
-            sha,
-            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
-        );
-    }
-
-    #[test]
-    fn store_is_content_addressed_and_idempotent() {
-        let base = Scratch::new();
-        let src = base.path().join("src.bin");
-        fs::write(&src, b"payload").expect("write");
-        let (sha, _) = hash_file(&src).expect("hash");
-        let p1 = store_file(base.path(), &src, &sha).expect("store");
-        let p2 = store_file(base.path(), &src, &sha).expect("store again");
-        assert_eq!(p1, p2);
-        assert!(p1.ends_with(&sha));
-        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
-        assert_eq!(fs::read(&p1).expect("read"), b"payload");
-    }
-
-    #[test]
-    fn extract_zip_writes_entries() {
-        let base = Scratch::new();
-        let archive = base.path().join("a.zip");
-        {
-            let file = File::create(&archive).expect("create");
-            let mut w = zip::ZipWriter::new(file);
-            let opts: zip::write::SimpleFileOptions = Default::default();
-            w.start_file("dir/hello.txt", opts).expect("start");
-            io::Write::write_all(&mut w, b"hi").expect("write");
-            w.finish().expect("finish");
-        }
-        let dest = base.path().join("out");
-        extract_zip(&archive, &dest).expect("extract");
-        assert_eq!(
-            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
-            "hi"
-        );
-    }
-}
@@ -1,334 +0,0 @@
-//! Artifact ingest.
-//!
-//! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
-//! path plus recorded metadata (content hash, size, discovered facts) that the
-//! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
-//! is also the reconciliation key against sibling products (a firmware sha256
-//! matches tramiton's `Artifact.sha256`).
-
-mod blob;
-
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-
-use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
-use compliance_core::AgentConfig;
-
-use crate::error::AgentError;
-use crate::pipeline::git::{GitOps, RepoCredentials};
-
-/// The paths and identifiers an ingest needs. Decoupled from the full
-/// [`AgentConfig`] so ingest is testable without a complete config.
-pub struct IngestContext<'a> {
-    /// Base directory for content-addressed blobs and working dirs.
-    pub artifact_store_base: &'a Path,
-    /// Base directory for git clones.
-    pub git_clone_base: &'a str,
-    /// Default SSH key path (used when an artifact provides none).
-    pub ssh_key_path: &'a str,
-    /// The id of the target these artifacts belong to (namespaces working dirs).
-    pub target_id: &'a str,
-}
-
-impl<'a> IngestContext<'a> {
-    /// Build an ingest context from the agent config for a given target.
-    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
-        Self {
-            artifact_store_base: Path::new(&config.artifact_store_base_path),
-            git_clone_base: &config.git_clone_base_path,
-            ssh_key_path: &config.ssh_key_path,
-            target_id,
-        }
-    }
-}
-
-/// The result of ingesting one artifact.
-pub struct IngestedArtifact {
-    /// The artifact this corresponds to ([`Artifact::id`]).
-    pub artifact_id: String,
-    /// The artifact kind.
-    pub kind: ArtifactKind,
-    /// Local working path (clone dir, extracted dir, or blob file). `None` for
-    /// artifacts with no on-disk form (live URL, plaintext, container ref).
-    pub working_path: Option<PathBuf>,
-    /// SHA-256 of the content (blobs) or git head SHA (git repos).
-    pub content_hash: Option<String>,
-    /// Stored blob size in bytes, when applicable.
-    pub size_bytes: Option<u64>,
-    /// Facts discovered during ingest.
-    pub facts: Vec<DetectedFact>,
-}
-
-/// All ingested artifacts for a target, keyed by artifact id.
-pub struct IngestSet {
-    /// The ingested artifacts, keyed by [`Artifact::id`].
-    pub by_artifact: HashMap<String, IngestedArtifact>,
-}
-
-impl IngestSet {
-    /// The working paths of every ingested artifact that has one — the input the
-    /// classifier expects.
-    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
-        self.by_artifact
-            .iter()
-            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
-            .collect()
-    }
-
-    /// The ingest result for a specific artifact.
-    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
-        self.by_artifact.get(artifact_id)
-    }
-}
-
-/// Ingest every artifact on a target.
-pub fn ingest_all(
-    target: &OnboardedTarget,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestSet, AgentError> {
-    let mut by_artifact = HashMap::new();
-    for artifact in &target.artifacts {
-        let ingested = ingest_artifact(artifact, ctx)?;
-        by_artifact.insert(artifact.id.clone(), ingested);
-    }
-    Ok(IngestSet { by_artifact })
-}
-
-/// Ingest a single artifact, dispatching on its kind.
-pub fn ingest_artifact(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestedArtifact, AgentError> {
-    match artifact.kind {
-        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
-        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
-            ingest_blob(artifact, ctx, true)
-        }
-        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
-        ArtifactKind::ContainerImage => Ok(metadata_only(
-            artifact,
-            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
-        )),
-        ArtifactKind::LiveUrl => Ok(metadata_only(
-            artifact,
-            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
-        )),
-        ArtifactKind::PlaintextDescription => Ok(metadata_only(
-            artifact,
-            DetectedFact::new(
-                "description_len",
-                artifact.source_ref.len().to_string(),
-                "ingest",
-            ),
-        )),
-    }
-}
-
-/// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
-fn ingest_git(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestedArtifact, AgentError> {
-    let creds = credentials_for(artifact, ctx.ssh_key_path);
-    let git_ops = GitOps::new(ctx.git_clone_base, creds);
-    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
-    let head = GitOps::get_head_sha(&repo_path).ok();
-    Ok(IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: Some(repo_path),
-        content_hash: head,
-        size_bytes: None,
-        facts: Vec::new(),
-    })
-}
-
-/// Store a blob artifact content-addressed. When `extract` is set and the blob
-/// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
-/// working directory; otherwise the working path is the stored blob.
-fn ingest_blob(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-    extract: bool,
-) -> Result<IngestedArtifact, AgentError> {
-    let base = ctx.artifact_store_base;
-    let src = local_source(artifact)?;
-    let (sha, size) = blob::hash_file(&src)?;
-    let stored = blob::store_file(base, &src, &sha)?;
-
-    let mut facts = Vec::new();
-    let working_path = if extract {
-        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
-        match blob::extract_zip(&stored, &dest) {
-            Ok(()) => dest,
-            Err(e) => {
-                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
-                // note it so later stages can decide what to do.
-                facts.push(DetectedFact::new(
-                    "archive_unextracted",
-                    e.to_string(),
-                    "ingest",
-                ));
-                stored.clone()
-            }
-        }
-    } else {
-        stored.clone()
-    };
-
-    Ok(IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: Some(working_path),
-        content_hash: Some(sha),
-        size_bytes: Some(size),
-        facts,
-    })
-}
-
-/// An artifact with no on-disk form: record a single fact, no hash/path.
-fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
-    IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: None,
-        content_hash: None,
-        size_bytes: None,
-        facts: vec![fact],
-    }
-}
-
-/// The local file backing a blob artifact: its `stored_path` if already
-/// uploaded, else its `source_ref` interpreted as a filesystem path.
-fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
-    let path = artifact
-        .stored_path
-        .as_deref()
-        .unwrap_or(artifact.source_ref.as_str());
-    let path = PathBuf::from(path);
-    if !path.exists() {
-        return Err(AgentError::Other(format!(
-            "artifact {} source not found at {}",
-            artifact.id,
-            path.display()
-        )));
-    }
-    Ok(path)
-}
-
-/// Build git credentials from an artifact's auth plus a default SSH key path.
-fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
-    let auth = artifact.auth.as_ref();
-    RepoCredentials {
-        ssh_key_path: auth
-            .and_then(|a| a.ssh_key_path.clone())
-            .or_else(|| Some(default_ssh_key_path.to_string())),
-        auth_token: auth.and_then(|a| a.secret.clone()),
-        auth_username: auth.and_then(|a| a.username.clone()),
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{ArtifactAuth, TargetType};
-
-    /// A unique scratch directory, removed on drop.
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
-            std::fs::create_dir_all(&p).expect("mkdir scratch");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
-        IngestContext {
-            artifact_store_base: store,
-            git_clone_base: "/tmp/cs-ingest-test-repos",
-            ssh_key_path: "/tmp/cs-ingest-test-ssh",
-            target_id,
-        }
-    }
-
-    #[test]
-    fn firmware_blob_is_hashed_and_stored() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let fw = scratch.0.join("fw.bin");
-        std::fs::write(&fw, b"firmware-bytes").expect("write");
-
-        let ctx = ctx_for(&store, "t1");
-        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-
-        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
-        assert_eq!(out.size_bytes, Some(14));
-        let sha = out.content_hash.expect("hash");
-        assert_eq!(sha.len(), 64);
-        // working path is the content-addressed blob
-        let wp = out.working_path.expect("working path");
-        assert!(wp.starts_with(store.join("blobs")));
-    }
-
-    #[test]
-    fn live_url_has_no_blob() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let ctx = ctx_for(&store, "t1");
-        let artifact = Artifact::live_url("https://example.com");
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-        assert!(out.working_path.is_none());
-        assert!(out.content_hash.is_none());
-        assert!(out.facts.iter().any(|f| f.key == "live_url"));
-    }
-
-    #[test]
-    fn ingest_all_collects_working_paths() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let fw = scratch.0.join("fw.bin");
-        std::fs::write(&fw, b"abc").expect("write");
-        let ctx = ctx_for(&store, "t1");
-
-        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
-        target
-            .artifacts
-            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
-        target.artifacts.push(Artifact::live_url("https://x"));
-
-        let set = ingest_all(&target, &ctx).expect("ingest all");
-        assert_eq!(set.by_artifact.len(), 2);
-        // Only the firmware artifact yields a working path.
-        assert_eq!(set.working_paths().len(), 1);
-    }
-
-    #[test]
-    fn credentials_prefer_artifact_auth() {
-        let mut artifact = Artifact::git_repo("https://git/x", "main");
-        artifact.auth = Some(ArtifactAuth {
-            method: "token".to_string(),
-            username: Some("bob".to_string()),
-            secret: Some("pat".to_string()),
-            ..Default::default()
-        });
-        let creds = credentials_for(&artifact, "/default/ssh/key");
-        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
-        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
-    }
-
-    #[test]
-    fn credentials_fall_back_to_default_ssh_key() {
-        let artifact = Artifact::git_repo("git@host:x.git", "main");
-        let creds = credentials_for(&artifact, "/default/ssh/key");
-        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
-        assert!(creds.auth_token.is_none());
-    }
-}
@@ -2,13 +2,10 @@

 pub mod agent;
 pub mod api;
-pub mod classify;
 pub mod config;
 pub mod database;
 pub mod error;
-pub mod ingest;
 pub mod llm;
-pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;
@@ -1,50 +1,4 @@
-use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
-
-/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
-/// unified `onboarded_targets` collection per tenant.
-///
-/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
-async fn run_migration(
-    args: &[String],
-    pool: &database::DatabasePool,
-) -> Result<(), compliance_agent::error::AgentError> {
-    if args.get(2).map(String::as_str) != Some("onboarding") {
-        eprintln!(
-            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
-        );
-        std::process::exit(2);
-    }
-    let has = |flag: &str| args.iter().any(|a| a == flag);
-    let dry_run = has("--dry-run");
-    let revert = has("--revert");
-    let tenant = args
-        .iter()
-        .position(|a| a == "--tenant")
-        .and_then(|i| args.get(i + 1))
-        .cloned();
-
-    let tenants: Vec<String> = if has("--all") {
-        pool.list_tenant_ids().await?
-    } else if let Some(t) = tenant {
-        vec![t]
-    } else {
-        eprintln!("specify --all or --tenant <id>");
-        std::process::exit(2);
-    };
-
-    for tenant_id in tenants {
-        let db = pool.for_tenant_id(&tenant_id).await?;
-        if revert {
-            migrate::onboarding::revert(&db).await?;
-            println!("[{tenant_id}] reverted onboarding backfill");
-        } else {
-            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
-            let prefix = if dry_run { "(dry-run) " } else { "" };
-            println!("[{tenant_id}] {prefix}{report:?}");
-        }
-    }
-    Ok(())
-}
+use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};

 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -77,13 +31,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let db_pool =
        database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;

-    // One-shot subcommands run and exit without starting the servers.
-    let args: Vec<String> = std::env::args().collect();
-    if args.get(1).map(String::as_str) == Some("migrate") {
-        run_migration(&args, &db_pool).await?;
-        return Ok(());
-    }
-
    let agent = agent::ComplianceAgent::new(config.clone(), db_pool);

    tracing::info!("Starting scheduler...");
@@ -1,8 +0,0 @@
-//! One-time data migrations.
-//!
-//! Currently just the onboarding backfill ([`onboarding`]), which folds the
-//! legacy `repositories` and `dast_targets` collections into the unified
-//! `onboarded_targets` collection, preserving `_id` so every downstream record
-//! keyed by `repo_id` / `target_id` keeps resolving.
-
-pub mod onboarding;
@@ -1,406 +0,0 @@
-//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
-//!
-//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
-//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
-//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
-//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
-//! existing webhook URLs keep working. The mapping functions are pure and unit
-//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
-//! thin driver over them.
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
-    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
-};
-use futures_util::TryStreamExt;
-use mongodb::bson::{doc, Document};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// Marker id in `schema_migrations` recording that the backfill has run.
-const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
-
-/// Summary of a backfill run.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct MigrationReport {
-    /// Repositories turned into onboarded targets.
-    pub repos_migrated: u64,
-    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
-    pub dast_targets_folded: u64,
-    /// DAST targets with no repo link, migrated as standalone targets.
-    pub dast_targets_standalone: u64,
-    /// Records skipped because a target with that `_id` already existed.
-    pub skipped_existing: u64,
-}
-
-/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
-/// are backend services; a browser app is a web app.
-fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
-    match kind {
-        DastTargetType::WebApp => TargetType::WebApp,
-        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
-    }
-}
-
-/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
-/// auth). Shared by fold-in and standalone migration.
-pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
-    let mut artifact = Artifact::live_url(dast.base_url.clone());
-    artifact.web = Some(WebArtifactConfig {
-        target_kind: dast.target_type.clone(),
-        excluded_paths: dast.excluded_paths.clone(),
-        max_crawl_depth: dast.max_crawl_depth,
-        rate_limit: dast.rate_limit,
-        allow_destructive: dast.allow_destructive,
-    });
-    artifact.auth = dast.auth_config.clone().map(Into::into);
-    artifact
-}
-
-/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
-/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
-/// and auth; tracker config folds into `scan_config`.
-///
-/// `target_type` is a safe default (`BackendService`) — the classifier can
-/// refine it later; `classification` is left `None` (unconfirmed).
-pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
-    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
-    target.id = repo.id;
-
-    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
-    artifact.git = Some(GitArtifactConfig {
-        default_branch: repo.default_branch.clone(),
-        last_scanned_commit: repo.last_scanned_commit.clone(),
-        local_path: repo.local_path.clone(),
-    });
-    if repo.auth_token.is_some() || repo.auth_username.is_some() {
-        artifact.auth = Some(compliance_core::models::ArtifactAuth {
-            method: "token".to_string(),
-            username: repo.auth_username.clone(),
-            secret: repo.auth_token.clone(),
-            ..Default::default()
-        });
-    }
-    target.artifacts.push(artifact);
-
-    if repo.tracker_type.is_some() {
-        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
-            tracker_type: repo.tracker_type.clone(),
-            owner: repo.tracker_owner.clone(),
-            repo: repo.tracker_repo.clone(),
-            token: repo.tracker_token.clone(),
-        });
-    }
-
-    target.scan_schedule = repo.scan_schedule.clone();
-    target.webhook_enabled = repo.webhook_enabled;
-    target.webhook_secret = repo.webhook_secret.clone();
-    target.findings_count = repo.findings_count;
-    target.created_at = repo.created_at;
-    target.updated_at = repo.updated_at;
-    target
-}
-
-/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
-/// target. If the repo default was `BackendService` but the DAST target is a
-/// browser web app, promote the type to `WebApp`.
-pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
-    if matches!(dast.target_type, DastTargetType::WebApp)
-        && target.target_type == TargetType::BackendService
-    {
-        target.target_type = TargetType::WebApp;
-    }
-    if !target.has(ArtifactKind::LiveUrl) {
-        target.artifacts.push(dast_to_artifact(dast));
-    }
-}
-
-/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
-pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
-    let mut target =
-        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
-    target.id = dast.id;
-    target.artifacts.push(dast_to_artifact(dast));
-    target.created_at = dast.created_at;
-    target.updated_at = dast.updated_at;
-    target
-}
-
-/// Whether the onboarding backfill has already been applied to this database.
-pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
-    let found = db
-        .collection_named::<Document>("schema_migrations")
-        .find_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(found.is_some())
-}
-
-/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
-/// tenant database.
-///
-/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
-/// skipped, so re-running is safe. With `dry_run`, computes the report without
-/// writing. The legacy collections are never deleted; the only mutation outside
-/// `onboarded_targets` is the history relink of folded DAST targets, which is
-/// logged so [`revert`] can undo it.
-pub async fn backfill_onboarded_targets(
-    db: &Database,
-    dry_run: bool,
-) -> Result<MigrationReport, AgentError> {
-    let mut report = MigrationReport::default();
-
-    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
-    let mut repos = db.repositories().find(doc! {}).await?;
-    while let Some(repo) = repos.try_next().await? {
-        let Some(id) = repo.id else { continue };
-        if db
-            .onboarded_targets()
-            .find_one(doc! { "_id": id })
-            .await?
-            .is_some()
-        {
-            report.skipped_existing += 1;
-            continue;
-        }
-        if !dry_run {
-            db.onboarded_targets()
-                .insert_one(repo_to_target(&repo))
-                .await?;
-        }
-        report.repos_migrated += 1;
-    }
-
-    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
-    let mut dasts = db.dast_targets().find(doc! {}).await?;
-    while let Some(dast) = dasts.try_next().await? {
-        let Some(dast_id) = dast.id else { continue };
-        let repo_oid = dast
-            .repo_id
-            .as_deref()
-            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
-        let linked = match repo_oid {
-            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
-            None => None,
-        };
-
-        match (linked, repo_oid) {
-            // Fold into an existing repo-derived target.
-            (Some(mut target), Some(oid)) => {
-                if target.has(ArtifactKind::LiveUrl) {
-                    report.skipped_existing += 1; // already folded on a prior run
-                    continue;
-                }
-                fold_dast_into_target(&mut target, &dast);
-                if !dry_run {
-                    db.onboarded_targets()
-                        .replace_one(doc! { "_id": oid }, &target)
-                        .await?;
-                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
-                }
-                report.dast_targets_folded += 1;
-            }
-            // No linked repo target: migrate as a standalone target (keeps _id).
-            _ => {
-                if db
-                    .onboarded_targets()
-                    .find_one(doc! { "_id": dast_id })
-                    .await?
-                    .is_some()
-                {
-                    report.skipped_existing += 1;
-                    continue;
-                }
-                if !dry_run {
-                    db.onboarded_targets()
-                        .insert_one(dast_to_standalone_target(&dast))
-                        .await?;
-                }
-                report.dast_targets_standalone += 1;
-            }
-        }
-    }
-
-    if !dry_run {
-        db.collection_named::<Document>("schema_migrations")
-            .update_one(
-                doc! { "_id": MIGRATION_MARKER },
-                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
-            )
-            .upsert(true)
-            .await?;
-    }
-    Ok(report)
-}
-
-/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
-/// unified target id, logging each move so [`revert`] can undo it.
-///
-/// Note: if multiple DAST targets fold into the same repo target, revert
-/// restores only the last-logged mapping — a rare edge. The source collections
-/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
-async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
-    db.dast_scan_runs()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.pentest_sessions()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.collection_named::<Document>("onboarding_migration_log")
-        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
-        .await?;
-    Ok(())
-}
-
-/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
-/// and the log, and clear the marker. The legacy collections are untouched, so
-/// this restores the pre-migration state.
-pub async fn revert(db: &Database) -> Result<(), AgentError> {
-    let log = db.collection_named::<Document>("onboarding_migration_log");
-    let mut cursor = log.find(doc! {}).await?;
-    while let Some(entry) = cursor.try_next().await? {
-        if let (Ok(old), Ok(new)) = (
-            entry.get_str("old_target_id"),
-            entry.get_str("new_target_id"),
-        ) {
-            db.dast_scan_runs()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-            db.pentest_sessions()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-        }
-    }
-    db.onboarded_targets().drop().await?;
-    log.drop().await?;
-    db.collection_named::<Document>("schema_migrations")
-        .delete_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{DastAuthConfig, TrackerType};
-
-    fn repo() -> TrackedRepository {
-        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
-        r.id = Some(mongodb::bson::oid::ObjectId::new());
-        r.default_branch = "develop".to_string();
-        r.last_scanned_commit = Some("abc123".to_string());
-        r.auth_token = Some("pat".to_string());
-        r.auth_username = Some("bob".to_string());
-        r.tracker_type = Some(TrackerType::Gitea);
-        r.tracker_owner = Some("acme".to_string());
-        r.findings_count = 7;
-        r
-    }
-
-    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
-        let mut d = DastTarget::new(
-            "acme-web".to_string(),
-            "https://acme.example.com".to_string(),
-            kind,
-        );
-        d.id = Some(mongodb::bson::oid::ObjectId::new());
-        d.repo_id = repo_id;
-        d.max_crawl_depth = 5;
-        d.auth_config = Some(DastAuthConfig {
-            method: "bearer".to_string(),
-            login_url: None,
-            username: None,
-            password: None,
-            token: Some("tok".to_string()),
-            headers: None,
-        });
-        d
-    }
-
-    #[test]
-    fn repo_maps_preserving_id_and_git_artifact() {
-        let r = repo();
-        let t = repo_to_target(&r);
-        assert_eq!(t.id, r.id); // id preserved
-        assert_eq!(t.findings_count, 7);
-        assert_eq!(t.scan_schedule, r.scan_schedule);
-        let git = t.code_artifact().expect("git artifact");
-        assert_eq!(git.kind, ArtifactKind::GitRepo);
-        assert_eq!(git.source_ref, "https://git/acme.git");
-        let gc = git.git.as_ref().expect("git config");
-        assert_eq!(gc.default_branch, "develop");
-        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
-        let auth = git.auth.as_ref().expect("auth");
-        assert_eq!(auth.secret.as_deref(), Some("pat"));
-        assert_eq!(auth.username.as_deref(), Some("bob"));
-        assert_eq!(
-            t.scan_config
-                .issue_tracker
-                .as_ref()
-                .and_then(|it| it.tracker_type.clone()),
-            Some(TrackerType::Gitea)
-        );
-    }
-
-    #[test]
-    fn standalone_dast_maps_preserving_id_and_live_url() {
-        let d = dast(None, DastTargetType::WebApp);
-        let t = dast_to_standalone_target(&d);
-        assert_eq!(t.id, d.id);
-        assert_eq!(t.target_type, TargetType::WebApp);
-        let url = t.live_url().expect("live url");
-        assert_eq!(url.source_ref, "https://acme.example.com");
-        let web = url.web.as_ref().expect("web config");
-        assert_eq!(web.max_crawl_depth, 5);
-        assert_eq!(
-            url.auth.as_ref().and_then(|a| a.secret.clone()),
-            Some("tok".to_string())
-        );
-    }
-
-    #[test]
-    fn rest_api_dast_maps_to_backend_service() {
-        let d = dast(None, DastTargetType::RestApi);
-        assert_eq!(
-            dast_to_standalone_target(&d).target_type,
-            TargetType::BackendService
-        );
-    }
-
-    #[test]
-    fn fold_adds_live_url_and_promotes_webapp() {
-        let mut t = repo_to_target(&repo());
-        assert_eq!(t.target_type, TargetType::BackendService);
-        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
-        assert_eq!(t.target_type, TargetType::WebApp); // promoted
-        assert!(t.has(ArtifactKind::LiveUrl));
-        assert!(t.has(ArtifactKind::GitRepo));
-    }
-
-    #[test]
-    fn fold_is_idempotent_on_live_url() {
-        let mut t = repo_to_target(&repo());
-        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
-        fold_dast_into_target(&mut t, &d);
-        fold_dast_into_target(&mut t, &d);
-        let live_urls = t
-            .artifacts
-            .iter()
-            .filter(|a| a.kind == ArtifactKind::LiveUrl)
-            .count();
-        assert_eq!(live_urls, 1);
-    }
-}
@@ -328,7 +328,6 @@ mod tests {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: String::new(),
-            artifact_store_base_path: String::new(),
            ssh_key_path: String::new(),
            keycloak_url: None,
            keycloak_realm: None,
@@ -44,7 +44,6 @@ impl TestServer {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
            github_token: None,
            github_webhook_secret: None,
@@ -1,156 +0,0 @@
-// Integration tests for the onboarding backfill migration.
-//
-// Requires MongoDB (set TEST_MONGODB_URI if not at the default).
-// Not run in CI (which is `--lib` only) — run locally:
-//   cargo test -p compliance-agent --test e2e migration
-
-use compliance_agent::database::{Database, DatabasePool};
-use compliance_agent::migrate::onboarding;
-use compliance_core::models::{
-    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
-};
-use mongodb::bson::{doc, Document};
-
-async fn fresh_db() -> (DatabasePool, String, Database) {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
-    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
-    let pool = DatabasePool::connect(&uri, &prefix)
-        .await
-        .expect("connect mongo");
-    let db = pool.for_tenant_id("t1").await.expect("tenant db");
-    (pool, prefix, db)
-}
-
-async fn cleanup(pool: &DatabasePool, prefix: &str) {
-    if let Ok(names) = pool.client().list_database_names().await {
-        for n in names {
-            if n.starts_with(prefix) {
-                pool.client().database(&n).drop().await.ok();
-            }
-        }
-    }
-}
-
-#[tokio::test]
-async fn backfill_folds_relinks_is_idempotent_and_reversible() {
-    let (pool, prefix, db) = fresh_db().await;
-
-    // Seed a repo.
-    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
-    let repo_id = db
-        .repositories()
-        .insert_one(repo)
-        .await
-        .expect("insert repo")
-        .inserted_id
-        .as_object_id()
-        .expect("repo oid");
-
-    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
-    let mut linked = DastTarget::new(
-        "acme-web".into(),
-        "https://acme.example.com".into(),
-        DastTargetType::WebApp,
-    );
-    linked.repo_id = Some(repo_id.to_hex());
-    let linked_id = db
-        .dast_targets()
-        .insert_one(linked)
-        .await
-        .expect("insert linked dast")
-        .inserted_id
-        .as_object_id()
-        .expect("linked oid");
-
-    // A repo-less DAST target (standalone).
-    let standalone = DastTarget::new(
-        "acme-api".into(),
-        "https://api.acme.com".into(),
-        DastTargetType::RestApi,
-    );
-    let standalone_id = db
-        .dast_targets()
-        .insert_one(standalone)
-        .await
-        .expect("insert standalone dast")
-        .inserted_id
-        .as_object_id()
-        .expect("standalone oid");
-
-    // A DAST scan run pointing at the linked target — should be relinked to the repo.
-    db.collection_named::<Document>("dast_scan_runs")
-        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
-        .await
-        .expect("insert dast run");
-
-    // --- Backfill ---
-    assert!(!onboarding::already_applied(&db).await.unwrap());
-    let report = onboarding::backfill_onboarded_targets(&db, false)
-        .await
-        .expect("backfill");
-    assert_eq!(report.repos_migrated, 1);
-    assert_eq!(report.dast_targets_folded, 1);
-    assert_eq!(report.dast_targets_standalone, 1);
-    assert!(onboarding::already_applied(&db).await.unwrap());
-
-    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
-    let repo_target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": repo_id })
-        .await
-        .unwrap()
-        .expect("repo target");
-    assert!(repo_target.has(ArtifactKind::GitRepo));
-    assert!(repo_target.has(ArtifactKind::LiveUrl));
-    assert_eq!(repo_target.target_type, TargetType::WebApp);
-
-    // Standalone target: preserved _id, live-url, backend service.
-    let standalone_target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": standalone_id })
-        .await
-        .unwrap()
-        .expect("standalone target");
-    assert!(standalone_target.has(ArtifactKind::LiveUrl));
-    assert_eq!(standalone_target.target_type, TargetType::BackendService);
-
-    // The DAST run was relinked from the old dast id to the repo (unified) id.
-    let run = db
-        .collection_named::<Document>("dast_scan_runs")
-        .find_one(doc! {})
-        .await
-        .unwrap()
-        .expect("run");
-    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
-
-    // --- Idempotent: re-run migrates nothing new ---
-    let again = onboarding::backfill_onboarded_targets(&db, false)
-        .await
-        .expect("backfill again");
-    assert_eq!(again.repos_migrated, 0);
-    assert_eq!(again.dast_targets_folded, 0);
-    assert_eq!(again.dast_targets_standalone, 0);
-    assert!(again.skipped_existing >= 2);
-
-    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
-    onboarding::revert(&db).await.expect("revert");
-    assert_eq!(
-        db.onboarded_targets()
-            .count_documents(doc! {})
-            .await
-            .unwrap(),
-        0
-    );
-    let run_after = db
-        .collection_named::<Document>("dast_scan_runs")
-        .find_one(doc! {})
-        .await
-        .unwrap()
-        .expect("run");
-    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
-    assert!(!onboarding::already_applied(&db).await.unwrap());
-
-    cleanup(&pool, &prefix).await;
-}
@@ -7,4 +7,3 @@
 // Or nightly: (via CI with MongoDB service container)

 mod api;
-mod migration;
@@ -24,9 +24,6 @@ pub struct AgentConfig {
    pub scan_schedule: String,
    pub cve_monitor_schedule: String,
    pub git_clone_base_path: String,
-    /// Base directory for content-addressed artifact blobs and per-run working
-    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
-    pub artifact_store_base_path: String,
    pub ssh_key_path: String,
    pub keycloak_url: Option<String>,
    pub keycloak_realm: Option<String>,
@@ -33,10 +33,9 @@ pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
 pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
 pub use onboarding::{
-    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
-    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
-    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
-    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
+    Artifact, ArtifactAuth, ArtifactKind, Classification, DetectedFact, GitArtifactConfig,
+    IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat, TargetScanConfig,
+    TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
 pub use pentest::{
    AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
@@ -22,7 +22,7 @@ use super::scan::ScanType;
 /// Targets look endlessly varied but fall into a small enumerable set classified
 /// by where the analyzable signal lives. This drives the scan-applicability
 /// matrix and the onboarding wizard's type selection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum TargetType {
    /// Browser-facing web application (front end + server).
@@ -411,134 +411,6 @@ pub struct TargetScanConfig {
    pub issue_tracker: Option<IssueTrackerConfig>,
 }

-/// A sibling product in the company suite that may already hold authoritative
-/// data for a target. compliance-scanner reconciles with these rather than
-/// recomputing what they already know.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ExternalSystem {
-    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
-    /// attestation).
-    Tramiton,
-    /// Code assistant (downstream remediation consumer).
-    Werkpilot,
-    /// Compliance-controls RAG (atomic controls derived from laws).
-    BreakpilotCompliance,
-}
-
-impl std::fmt::Display for ExternalSystem {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Tramiton => write!(f, "tramiton"),
-            Self::Werkpilot => write!(f, "werkpilot"),
-            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
-        }
-    }
-}
-
-/// A link from this target to a record in a sibling product, used to reconcile
-/// existing evidence instead of recomputing it.
-///
-/// For tramiton, `project_id` is the shared cross-product key and
-/// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
-/// (which equals tramiton's `Artifact.sha256`).
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ExternalRef {
-    /// Which sibling product this reference points at.
-    pub system: ExternalSystem,
-    /// The sibling product's project identifier, if known.
-    pub project_id: Option<String>,
-    /// Content digest of the subject artifact (firmware sha256), if known.
-    pub subject_sha256: Option<String>,
-    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
-    #[serde(default)]
-    pub status: String,
-    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
-    /// `LicenseGrant`), if the tenant provided one.
-    pub license_grant: Option<String>,
-    /// When evidence was last reconciled from this system.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub last_reconciled_at: Option<DateTime<Utc>>,
-}
-
-impl ExternalRef {
-    /// A freshly linked (not yet reconciled) reference to a sibling system.
-    pub fn linked(system: ExternalSystem) -> Self {
-        Self {
-            system,
-            project_id: None,
-            subject_sha256: None,
-            status: "linked".to_string(),
-            license_grant: None,
-            last_reconciled_at: None,
-        }
-    }
-}
-
-/// A regulatory / standards framework a target must comply with. Drives which
-/// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ComplianceFramework {
-    /// EU Cyber Resilience Act.
-    Cra,
-    /// IEC 62443 (industrial automation & control systems security).
-    Iec62443,
-    /// EU General Data Protection Regulation.
-    Gdpr,
-    /// SOC 2.
-    Soc2,
-    /// ISO/IEC 27001.
-    Iso27001,
-    /// EU Radio Equipment Directive (RED) cybersecurity articles.
-    RedDirective,
-}
-
-impl std::fmt::Display for ComplianceFramework {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Cra => write!(f, "cra"),
-            Self::Iec62443 => write!(f, "iec_62443"),
-            Self::Gdpr => write!(f, "gdpr"),
-            Self::Soc2 => write!(f, "soc2"),
-            Self::Iso27001 => write!(f, "iso_27001"),
-            Self::RedDirective => write!(f, "red_directive"),
-        }
-    }
-}
-
-/// The compliance scope of a target: which frameworks apply and, optionally, the
-/// jurisdiction. Captured at onboarding (with per-target-type defaults from
-/// [`default_compliance_profile`]).
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct ComplianceProfile {
-    /// Applicable frameworks.
-    #[serde(default)]
-    pub frameworks: Vec<ComplianceFramework>,
-    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
-    pub jurisdiction: Option<String>,
-}
-
-/// The sensible default compliance scope for a target type. Firmware / PLC /
-/// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
-pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
-    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
-    let frameworks = match target_type {
-        TargetType::PlcSps
-        | TargetType::FirmwareBareMetal
-        | TargetType::FirmwareRtos
-        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
-        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
-        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
-            vec![Gdpr, Cra]
-        }
-    };
-    ComplianceProfile {
-        frameworks,
-        jurisdiction: None,
-    }
-}
-
 /// A target onboarded for scanning: the unified replacement for the legacy
 /// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -562,12 +434,6 @@ pub struct OnboardedTarget {
    /// How this target should be scanned.
    #[serde(default)]
    pub scan_config: TargetScanConfig,
-    /// The compliance scope (applicable frameworks / jurisdiction).
-    #[serde(default)]
-    pub compliance_profile: ComplianceProfile,
-    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
-    #[serde(default)]
-    pub external_refs: Vec<ExternalRef>,
    /// Cron schedule for recurring scans, if any.
    pub scan_schedule: Option<String>,
    /// Whether inbound webhooks are enabled for this target.
@@ -606,8 +472,6 @@ impl OnboardedTarget {
            artifacts: Vec::new(),
            classification: None,
            scan_config: TargetScanConfig::default(),
-            compliance_profile: default_compliance_profile(target_type),
-            external_refs: Vec::new(),
            scan_schedule: None,
            webhook_enabled: false,
            webhook_secret: Some(webhook_secret),
@@ -720,34 +584,4 @@ mod tests {
        let b = Artifact::firmware_image("fw.bin");
        assert_ne!(a.id, b.id);
    }
-
-    #[test]
-    fn firmware_default_profile_is_cra_and_62443() {
-        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
-        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
-        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
-    }
-
-    #[test]
-    fn webapp_default_profile_is_gdpr_and_soc2() {
-        let p = default_compliance_profile(TargetType::WebApp);
-        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
-        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
-    }
-
-    #[test]
-    fn new_target_gets_default_profile_and_no_external_refs() {
-        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
-        assert!(!t.compliance_profile.frameworks.is_empty());
-        assert!(t.external_refs.is_empty());
-    }
-
-    #[test]
-    fn external_ref_linked_defaults() {
-        let r = ExternalRef::linked(ExternalSystem::Tramiton);
-        assert_eq!(r.system, ExternalSystem::Tramiton);
-        assert_eq!(r.status, "linked");
-        assert!(r.project_id.is_none());
-        assert!(r.last_reconciled_at.is_none());
-    }
 }
@@ -1,45 +0,0 @@
-//! The compliance-controls provider port.
-//!
-//! The mapping engine turns findings into compliance status against a corpus of
-//! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
-//! a tenant-owned RAG of atomic controls derived from laws
-//! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
-//! source so the mapping engine does not hardcode a catalog.
-
-use crate::error::CoreError;
-use crate::models::ComplianceFramework;
-
-/// A control retrieved from a controls corpus.
-#[derive(Debug, Clone)]
-pub struct Control {
-    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
-    pub id: String,
-    /// The framework this control belongs to.
-    pub framework: ComplianceFramework,
-    /// Short human-readable title.
-    pub title: String,
-    /// The control text / requirement.
-    pub text: String,
-    /// Free-form source reference (catalog name, law citation, ...).
-    pub source: Option<String>,
-}
-
-/// A query for relevant controls.
-pub struct ControlQuery<'a> {
-    /// Frameworks in scope for the target.
-    pub frameworks: &'a [ComplianceFramework],
-    /// Free-text describing what to map (a finding summary, a component, ...).
-    pub context: &'a str,
-    /// Maximum number of controls to return.
-    pub limit: usize,
-}
-
-/// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
-#[allow(async_fn_in_trait)]
-pub trait ControlsProvider: Send + Sync {
-    /// Stable identifier for this provider.
-    fn name(&self) -> &str;
-
-    /// Retrieve the controls most relevant to the query.
-    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
-}
@@ -1,58 +0,0 @@
-//! The external-evidence provider port.
-//!
-//! A sibling product (tramiton, for firmware) may already hold authoritative
-//! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
-//! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
-//! reproducible-build lock, an attestation — instead of recomputing it. The key
-//! used to match is the artifact content digest (a firmware sha256, which equals
-//! [`crate::models::Artifact::content_hash`]).
-//!
-//! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
-//! client later) plus a deterministic mock for tests, so nothing here depends on
-//! an external binary.
-
-use std::path::Path;
-
-use crate::error::CoreError;
-use crate::models::{Artifact, ExternalSystem};
-
-/// A single reconcilable evidence document fetched from a sibling product.
-#[derive(Debug, Clone)]
-pub struct EvidenceDocument {
-    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
-    pub kind: String,
-    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
-    pub format: String,
-    /// The raw document payload.
-    pub content: String,
-}
-
-/// The evidence a provider could return for a target's artifact.
-#[derive(Debug, Clone, Default)]
-pub struct ReconciledEvidence {
-    /// The sibling's project identifier, if resolved.
-    pub project_id: Option<String>,
-    /// The subject content digest the evidence pertains to.
-    pub subject_sha256: Option<String>,
-    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
-    pub documents: Vec<EvidenceDocument>,
-}
-
-/// A source of externally-held, reconcilable evidence for an artifact.
-#[allow(async_fn_in_trait)]
-pub trait EvidenceProvider: Send + Sync {
-    /// Which sibling product this provider integrates.
-    fn system(&self) -> ExternalSystem;
-
-    /// Whether this provider can handle the given artifact + working path
-    /// (e.g. tramiton handles firmware images / embedded source trees).
-    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
-
-    /// Reconcile existing evidence for the artifact, keyed by its content digest.
-    /// Returns `Ok(None)` when the provider has nothing for this artifact.
-    async fn reconcile(
-        &self,
-        artifact: &Artifact,
-        working_path: Option<&Path>,
-    ) -> Result<Option<ReconciledEvidence>, CoreError>;
-}
@@ -1,16 +1,12 @@
 pub mod classifier;
-pub mod controls;
 pub mod dast_agent;
-pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;

 pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
-pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};
@@ -12,8 +12,6 @@ pub enum Route {
        OverviewPage {},
        #[route("/repositories")]
        RepositoriesPage {},
-        #[route("/onboard")]
-        OnboardingPage {},
        #[route("/findings")]
        FindingsPage {},
        #[route("/findings/:id")]
@@ -28,11 +28,6 @@ pub fn Sidebar() -> Element {
            route: Route::RepositoriesPage {},
            icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
        },
-        NavItem {
-            label: "Onboard",
-            route: Route::OnboardingPage {},
-            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
-        },
        NavItem {
            label: "Findings",
            route: Route::FindingsPage {},
@@ -10,7 +10,6 @@ pub mod issues;
 pub mod mcp;
 pub mod mcp_tokens;
 pub mod notifications;
-pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;
@@ -1,107 +0,0 @@
-//! Server functions for the onboarding wizard — proxy to the agent's
-//! `/api/v1/targets` endpoints.
-
-use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-/// One artifact the wizard collects for a target.
-#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
-pub struct ArtifactInputDto {
-    pub kind: String,
-    pub source_ref: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plc_format: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct TargetsResponse {
-    pub data: Vec<serde_json::Value>,
-    pub total: Option<u64>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct TargetResponse {
-    pub data: serde_json::Value,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ApplicableScansData {
-    #[serde(default)]
-    pub scans: Vec<serde_json::Value>,
-    #[serde(default)]
-    pub pentest_supported: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ApplicableScansResponse {
-    pub data: ApplicableScansData,
-}
-
-/// List onboarded targets.
-#[server]
-pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get("/api/v1/targets")
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Create a target with the collected artifacts.
-#[server]
-pub async fn create_target(
-    name: String,
-    target_type: String,
-    description: Option<String>,
-    artifacts: Vec<ArtifactInputDto>,
-) -> Result<TargetResponse, ServerFnError> {
-    let body = serde_json::json!({
-        "name": name,
-        "target_type": target_type,
-        "description": description,
-        "artifacts": artifacts,
-    });
-    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
-        .await?
-        .json(&body)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Run kind-based classification on a target.
-#[server]
-pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/detect"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Fetch the scan-applicability matrix for a target.
-#[server]
-pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
@@ -12,7 +12,6 @@ pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
 pub mod mcp_tokens;
-pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
@@ -33,7 +32,6 @@ pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
 pub use mcp_tokens::McpTokensPage;
-pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
@@ -1,377 +0,0 @@
-use dioxus::prelude::*;
-
-use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::{
-    create_target, detect_target, fetch_applicable_scans, ArtifactInputDto,
-};
-
-/// (value, label, one-line description) for the 9 target families.
-const TARGET_TYPES: &[(&str, &str, &str)] = &[
-    ("web_app", "Web Application", "Front end + server"),
-    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
-    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
-    ("android_app", "Android App", "APK / AAB"),
-    ("ios_app", "iOS App", "IPA"),
-    (
-        "firmware_bare_metal",
-        "Firmware — bare metal",
-        "No operating system",
-    ),
-    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
-    (
-        "embedded_linux_yocto",
-        "Embedded Linux / Yocto",
-        "BSP + image",
-    ),
-    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
-];
-
-/// (value, label) for the artifact kinds a user can attach.
-const ARTIFACT_KINDS: &[(&str, &str)] = &[
-    ("git_repo", "Git repository"),
-    ("source_archive", "Source archive (zip)"),
-    ("firmware_image", "Firmware image"),
-    ("mobile_package", "Mobile package (APK/IPA)"),
-    ("container_image", "Container image"),
-    ("live_url", "Live URL"),
-    ("plc_project", "PLC project"),
-    ("plaintext_description", "Description (text)"),
-];
-
-const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
-
-/// One row in the applicable-scans list on the success step.
-#[component]
-fn ScanRow(scan: serde_json::Value) -> Element {
-    let name = scan
-        .get("scan")
-        .and_then(|v| v.as_str())
-        .unwrap_or("?")
-        .to_string();
-    let rationale = scan
-        .get("rationale")
-        .and_then(|v| v.as_str())
-        .unwrap_or("")
-        .to_string();
-    let blocked = scan
-        .get("blocked_reason")
-        .and_then(|v| v.as_str())
-        .map(String::from);
-    let default_on = scan
-        .get("default_on")
-        .and_then(|v| v.as_bool())
-        .unwrap_or(false);
-    let badge_class = if blocked.is_some() {
-        "badge badge-info"
-    } else if default_on {
-        "badge badge-success"
-    } else {
-        "badge"
-    };
-    rsx! {
-        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
-            span { class: "{badge_class}", "{name}" }
-            span { style: "opacity: 0.8;", "{rationale}" }
-            if let Some(b) = blocked {
-                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
-            }
-        }
-    }
-}
-
-fn kind_label(kind: &str) -> &str {
-    ARTIFACT_KINDS
-        .iter()
-        .find(|(v, _)| *v == kind)
-        .map(|(_, l)| *l)
-        .unwrap_or(kind)
-}
-
-fn type_label(value: &str) -> &str {
-    TARGET_TYPES
-        .iter()
-        .find(|(v, _, _)| *v == value)
-        .map(|(_, l, _)| *l)
-        .unwrap_or(value)
-}
-
-#[component]
-pub fn OnboardingPage() -> Element {
-    let mut step = use_signal(|| 0usize);
-    let mut name = use_signal(String::new);
-    let mut target_type = use_signal(String::new);
-    let mut description = use_signal(String::new);
-    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
-
-    // "Add artifact" mini-form.
-    let mut new_kind = use_signal(|| "git_repo".to_string());
-    let mut new_source = use_signal(String::new);
-    let mut new_branch = use_signal(|| "main".to_string());
-
-    // Create + result state.
-    let mut creating = use_signal(|| false);
-    let mut error = use_signal(|| Option::<String>::None);
-    let mut scans = use_signal(Vec::<serde_json::Value>::new);
-    let mut suggested = use_signal(|| Option::<String>::None);
-
-    let step_now = step();
-    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
-    let has_artifacts = !artifacts().is_empty();
-
-    rsx! {
-        PageHeader {
-            title: "Onboard a target",
-            description: "Add a target, attach its artifacts, and see which scans apply.",
-        }
-
-        // Stepper.
-        div { class: "wizard-steps",
-            for (i, label) in STEP_LABELS.iter().enumerate() {
-                div {
-                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
-                    span { class: "wizard-step-dot", "{i + 1}" }
-                    span { class: "wizard-step-label", "{label}" }
-                }
-            }
-        }
-
-        if let Some(err) = error() {
-            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
-                div { class: "card-header", "Error" }
-                div { style: "padding: 12px;", "{err}" }
-            }
-        }
-
-        div { class: "card",
-            // ---- Step 0: target type + name ----
-            if step_now == 0 {
-                div { class: "card-header", "What kind of software is this?" }
-                div { style: "padding: 16px;",
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            placeholder: "acme-web",
-                            value: "{name}",
-                            oninput: move |e| name.set(e.value()),
-                        }
-                    }
-                    div {
-                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
-                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
-                            div {
-                                class: "card",
-                                style: if target_type() == value {
-                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
-                                } else {
-                                    "padding: 12px; cursor: pointer;"
-                                },
-                                onclick: move |_| target_type.set(value.to_string()),
-                                div { style: "font-weight: 600;", "{tlabel}" }
-                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
-                            }
-                        }
-                    }
-                }
-            }
-
-            // ---- Step 1: artifacts ----
-            if step_now == 1 {
-                div { class: "card-header", "Attach artifacts" }
-                div { style: "padding: 16px;",
-                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
-                        div { class: "form-group", style: "margin: 0;",
-                            label { "Kind" }
-                            select {
-                                value: "{new_kind}",
-                                oninput: move |e| new_kind.set(e.value()),
-                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
-                                    option { value: "{value}", "{klabel}" }
-                                }
-                            }
-                        }
-                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                            label { "Reference (URL / path / text)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "https://git.example.com/acme.git",
-                                value: "{new_source}",
-                                oninput: move |e| new_source.set(e.value()),
-                            }
-                        }
-                        if new_kind() == "git_repo" {
-                            div { class: "form-group", style: "margin: 0;",
-                                label { "Branch" }
-                                input {
-                                    r#type: "text",
-                                    value: "{new_branch}",
-                                    oninput: move |e| new_branch.set(e.value()),
-                                }
-                            }
-                        }
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| {
-                                let kind = new_kind();
-                                if !new_source().trim().is_empty() {
-                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
-                                    artifacts.write().push(ArtifactInputDto {
-                                        kind,
-                                        source_ref: new_source(),
-                                        branch,
-                                        plc_format: None,
-                                    });
-                                    new_source.set(String::new());
-                                }
-                            },
-                            "+ Add"
-                        }
-                    }
-
-                    div { style: "margin-top: 16px;",
-                        if has_artifacts {
-                            for (i, a) in artifacts().iter().enumerate() {
-                                div {
-                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
-                                    span {
-                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
-                                        "{a.source_ref}"
-                                    }
-                                    button {
-                                        class: "btn btn-ghost-danger btn-sm",
-                                        onclick: move |_| { artifacts.write().remove(i); },
-                                        "Remove"
-                                    }
-                                }
-                            }
-                        } else {
-                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
-                        }
-                    }
-                }
-            }
-
-            // ---- Step 2: review + create ----
-            if step_now == 2 {
-                div { class: "card-header", "Review" }
-                div { style: "padding: 16px;",
-                    div { class: "wizard-summary",
-                        div { strong { "Name: " } "{name()}" }
-                        div { strong { "Type: " } "{type_label(&target_type())}" }
-                        div { strong { "Artifacts:" } }
-                        ul {
-                            for a in artifacts() {
-                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
-                            }
-                        }
-                    }
-                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
-                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
-                    }
-                }
-            }
-
-            // ---- Step 3: created ----
-            if step_now == 3 {
-                div { class: "card-header", "Target onboarded" }
-                div { style: "padding: 16px;",
-                    p {
-                        strong { "{name()}" }
-                        " was created."
-                        if let Some(s) = suggested() {
-                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
-                        }
-                    }
-                    h4 { style: "margin-top: 16px;", "Applicable scans" }
-                    if scans().is_empty() {
-                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
-                    } else {
-                        for s in scans() {
-                            ScanRow { scan: s }
-                        }
-                    }
-                    div { style: "margin-top: 16px;",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| {
-                                step.set(0);
-                                name.set(String::new());
-                                target_type.set(String::new());
-                                description.set(String::new());
-                                artifacts.write().clear();
-                                scans.write().clear();
-                                suggested.set(None);
-                                error.set(None);
-                            },
-                            "Onboard another"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ---- Footer navigation ----
-        if step_now < 3 {
-            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
-                button {
-                    class: "btn btn-back",
-                    disabled: step_now == 0,
-                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
-                    "Back"
-                }
-                if step_now < 2 {
-                    button {
-                        class: "btn btn-primary",
-                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
-                        onclick: move |_| step.set(step() + 1),
-                        "Next"
-                    }
-                } else {
-                    button {
-                        class: "btn btn-primary",
-                        disabled: creating(),
-                        onclick: move |_| {
-                            let n = name();
-                            let tt = target_type();
-                            let desc = description();
-                            let arts = artifacts();
-                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
-                            creating.set(true);
-                            error.set(None);
-                            spawn(async move {
-                                match create_target(n, tt, d, arts).await {
-                                    Ok(resp) => {
-                                        let id = resp
-                                            .data
-                                            .get("_id")
-                                            .and_then(|o| o.get("$oid"))
-                                            .and_then(|s| s.as_str())
-                                            .map(String::from);
-                                        if let Some(id) = id {
-                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
-                                                scans.set(sc.data.scans);
-                                            }
-                                            if let Ok(det) = detect_target(id).await {
-                                                suggested.set(
-                                                    det.data
-                                                        .get("classification")
-                                                        .and_then(|c| c.get("suggested"))
-                                                        .and_then(|s| s.as_str())
-                                                        .map(String::from),
-                                                );
-                                            }
-                                        }
-                                        step.set(3);
-                                    }
-                                    Err(e) => error.set(Some(e.to_string())),
-                                }
-                                creating.set(false);
-                            });
-                        },
-                        if creating() { "Creating..." } else { "Create target" }
-                    }
-                }
-            }
-        }
-    }
-}