refactor: rip out the legacy TrackedRepository / repositories path

Onboarded targets are now the sole persisted entity. The legacy
`TrackedRepository` model, the `repositories` collection, the `/repositories`
API, the Repositories dashboard page, the one-shot migration, and the
`UNIFIED_PIPELINE` transition flag are all removed. Net −1.7k LOC.

Agent
- New internal `pipeline::repo_view::RepoView` (non-persisted) replaces the
  `TrackedRepository` model; it's projected from an `OnboardedTarget` + its code
  artifact by `RepoView::from_target` (the old `repo_view_from_target`), so the
  scan/PR-review pipeline is byte-for-byte the same behaviour it already ran on
  the unified path — only the type's origin changed.
- `run_scan` always runs the unified `run_target`; the legacy `orchestrator::run`
  and the `unified_pipeline` flag are gone. `run_pr_review` resolves the target
  from `onboarded_targets`.
- Webhooks (github/gitea/gitlab), the CVE monitor, graph build, chat embeddings,
  health stats, and the pentest repo lookup all read `onboarded_targets`.
- `delete_target` now cascades the full downstream set (findings, sbom, scans,
  cve, tracker issues, graph, embeddings, DAST targets + pentest sessions and
  their children) — matching the old repository delete.
- `get_ssh_public_key` moved to the health handler; `repositories()` accessor,
  `repos.rs`, and `migrate/` deleted.

Core
- `TrackedRepository` removed; `ScanTrigger` stays. `unified_pipeline` config
  field removed.

Dashboard
- Repositories page + route deleted; overview / graph / chat / pentest-wizard
  read onboarded targets; `infrastructure/repositories.rs` trimmed to just the
  SSH-key fetch.

Tests
- Legacy repositories-API and migration integration tests removed; tenant
  isolation, cascade-delete, and stats tests repointed to `/targets` /
  `onboarded_targets`. `git.rs` gains a `sanitize_repo_dir` unit test.

Local: fmt clean; agent/mcp clippy clean; dashboard server+web compile; core +
agent lib tests (32) pass; integration tests compile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -29,10 +29,13 @@ env:
   CARGO_NET_RETRY: "10"
   CARGO_HTTP_MULTIPLEXING: "false"
 
-# Cancel in-progress runs for the same branch/PR
+# Cancel superseded PR runs, but NEVER cancel main-branch runs — those build and
+# deploy per-service images, and cancelling one merge's deploy when the next
+# merge lands leaves a service un-deployed (as happened between two back-to-back
+# merges). So cancel-in-progress only for pull_request events.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   # ---------------------------------------------------------------------------
@@ -191,13 +194,18 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
+        env:
+          # PAT for fetching the private tramiton-core git dependency during the
+          # image build (injected as a BuildKit secret, never baked into a layer).
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-agent
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -212,13 +220,16 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
+        env:
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-dashboard
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -254,13 +265,16 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
+        env:
+          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-mcp
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')

Cargo.lock

@@ -693,6 +693,8 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "tramiton-core",
+ "tramiton-repro",
+ "tramiton-sbom",
  "urlencoding",
  "uuid",
  "walkdir",
@@ -2101,7 +2103,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3696,7 +3698,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3767,6 +3769,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "octocrab"
 version = "0.44.1"
@@ -4668,7 +4679,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4681,7 +4692,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5559,10 +5570,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
 dependencies = [
  "fastrand",
- "getrandom 0.4.1",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6139,8 +6150,8 @@ dependencies = [
 
 [[package]]
 name = "tramiton-core"
-version = "0.4.0"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
+version = "0.4.1"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
 dependencies = [
  "serde",
  "tempfile",
@@ -6149,6 +6160,34 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "tramiton-repro"
+version = "0.4.1"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+dependencies = [
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+ "thiserror 1.0.69",
+ "toml",
+ "tramiton-core",
+ "walkdir",
+]
+
+[[package]]
+name = "tramiton-sbom"
+version = "0.4.1"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
+dependencies = [
+ "object",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tramiton-core",
+ "tramiton-repro",
+]
+
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -6707,7 +6746,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]

Dockerfile.agent

@@ -2,7 +2,22 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-agent
+# compliance-agent depends on the private tramiton-core git repo. Authenticate
+# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
+# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
+
+# A throwaway stage that packs a real nix store (store paths + the validity DB)
+# into a compressed bootstrap tarball. Only the tarball is copied into the final
+# image, so we don't carry a raw /nix copy layer.
+FROM nixos/nix:latest AS nixseed
+RUN tar -C / -czf /nix-bootstrap.tar.gz nix
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
@@ -31,7 +46,30 @@ RUN pip3 install --break-system-packages semgrep
 # Install ruff for Python linting
 RUN pip3 install --break-system-packages ruff
 
+# Real nix for the tramiton reproducible-build firmware SBOM.
+#
+# nix-portable's proot fallback can't run here: user namespaces are blocked by
+# the container's default seccomp/apparmor profile, and orca exposes no way to
+# relax it. So ship a *real* nix and disable its build sandbox
+# (`sandbox = false`) — a plain gcc/make firmware build needs no user namespace,
+# so it runs fine under the locked-down profile with no proot involved.
+#
+# The store is shipped as a bootstrap tarball and seeded onto /nix at first
+# start (see docker/agent-entrypoint.sh), so a persistent /nix volume survives
+# redeploys. A missing/broken nix just falls back to the analysis-only SBOM.
+COPY --from=nixseed /nix-bootstrap.tar.gz /opt/nix-bootstrap.tar.gz
+ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
+RUN mkdir -p /etc/nix && printf '%s\n' \
+      'experimental-features = nix-command flakes' \
+      'sandbox = false' \
+      'build-users-group =' \
+      'substituters = https://cache.nixos.org' \
+      'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
+      > /etc/nix/nix.conf
+
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
+COPY docker/agent-entrypoint.sh /usr/local/bin/agent-entrypoint.sh
+RUN chmod +x /usr/local/bin/agent-entrypoint.sh
 
 # Copy documentation for the help chat assistant
 COPY --from=builder /app/README.md /app/README.md
@@ -43,5 +81,6 @@ RUN mkdir -p /data/compliance-scanner/ssh
 
 EXPOSE 3001 3002
 
-ENTRYPOINT ["compliance-agent"]
+# Seeds /nix (fresh volume) from the bootstrap tarball, then runs the agent.
+ENTRYPOINT ["/usr/local/bin/agent-entrypoint.sh"]
 

Dockerfile.dashboard

@@ -7,7 +7,16 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-RUN dx build --release --package compliance-dashboard
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the dashboard.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

Dockerfile.mcp

@@ -2,7 +2,16 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-RUN cargo build --release -p compliance-mcp
+# compliance-agent (a workspace member) depends on the private tramiton-core git
+# repo, so the workspace resolve needs it even to build the mcp binary.
+# Authenticate the fetch with a PAT passed as a BuildKit secret.
+RUN --mount=type=secret,id=tramiton_token \
+    if [ -s /run/secrets/tramiton_token ]; then \
+      git config --global \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
+    fi && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*

compliance-agent/Cargo.toml

@@ -14,7 +14,12 @@ compliance-dast = { path = "../compliance-dast" }
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this
 # private repo (see the git-auth step in .gitea/workflows/ci.yml).
-tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
+tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+# tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
+# yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
+tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
+# tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
+tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }

compliance-agent/src/agent.rs

@@ -63,7 +63,22 @@ impl ComplianceAgent {
         let db = self.db_pool.for_tenant_id(tenant_id).await?;
         let orchestrator =
             PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run(repo_id, trigger).await
+        orchestrator.run_target(repo_id, trigger).await
+    }
+
+    /// Alias for [`Self::run_scan`] — every scan runs the unified onboarded-target
+    /// pipeline. Kept as a distinct name for the `/targets/{id}/scan` endpoint's
+    /// intent.
+    pub async fn run_target_scan(
+        &self,
+        tenant_id: &str,
+        target_id: &str,
+        trigger: compliance_core::models::ScanTrigger,
+    ) -> Result<(), crate::error::AgentError> {
+        let db = self.db_pool.for_tenant_id(tenant_id).await?;
+        let orchestrator =
+            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
+        orchestrator.run_target(target_id, trigger).await
     }
 
     /// Run a PR review: scan the diff and post review comments.
@@ -76,16 +91,19 @@ impl ComplianceAgent {
         head_sha: &str,
     ) -> Result<(), crate::error::AgentError> {
         let db = self.db_pool.for_tenant_id(tenant_id).await?;
-        let repo = db
-            .repositories()
-            .find_one(mongodb::bson::doc! {
-                "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id)
-                    .map_err(|e| crate::error::AgentError::Other(e.to_string()))?
-            })
+        let oid = mongodb::bson::oid::ObjectId::parse_str(repo_id)
+            .map_err(|e| crate::error::AgentError::Other(e.to_string()))?;
+        let target = db
+            .onboarded_targets()
+            .find_one(mongodb::bson::doc! { "_id": oid })
             .await?
             .ok_or_else(|| {
-                crate::error::AgentError::Other(format!("Repository {repo_id} not found"))
+                crate::error::AgentError::Other(format!("Target {repo_id} not found"))
             })?;
+        let code = target.code_artifact().ok_or_else(|| {
+            crate::error::AgentError::Other(format!("Target {repo_id} has no code artifact"))
+        })?;
+        let repo = crate::pipeline::repo_view::RepoView::from_target(&target, code);
 
         let orchestrator =
             PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());

compliance-agent/src/api/handlers/chat.rs

@@ -146,7 +146,7 @@ pub async fn build_embeddings(
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         let repo = match db
-            .repositories()
+            .onboarded_targets()
             .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
             .await
         {
@@ -194,14 +194,22 @@ pub async fn build_embeddings(
                 }
             };
 
+        let code = match repo.code_artifact() {
+            Some(c) => c,
+            None => {
+                tracing::error!("Target {repo_id} has no code artifact for embedding build");
+                return;
+            }
+        };
+        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
         let creds = crate::pipeline::git::RepoCredentials {
             ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
+            auth_token: view.auth_token.clone(),
+            auth_username: view.auth_username.clone(),
         };
         let git_ops =
             crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
+        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
             Ok(p) => p,
             Err(e) => {
                 tracing::error!("Failed to clone repo for embedding build: {e}");

compliance-agent/src/api/handlers/graph.rs

@@ -255,7 +255,7 @@ pub async fn get_file_content(
 
     // Look up the repository to get repo name
     let repo = db
-        .repositories()
+        .onboarded_targets()
         .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
@@ -317,7 +317,7 @@ pub async fn trigger_build(
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         let repo = match db
-            .repositories()
+            .onboarded_targets()
             .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
             .await
         {
@@ -328,14 +328,22 @@ pub async fn trigger_build(
             }
         };
 
+        let code = match repo.code_artifact() {
+            Some(c) => c,
+            None => {
+                tracing::error!("Target {repo_id} has no code artifact for graph build");
+                return;
+            }
+        };
+        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
         let creds = crate::pipeline::git::RepoCredentials {
             ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: repo.auth_token.clone(),
-            auth_username: repo.auth_username.clone(),
+            auth_token: view.auth_token.clone(),
+            auth_username: view.auth_username.clone(),
         };
         let git_ops =
             crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
+        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
             Ok(p) => p,
             Err(e) => {
                 tracing::error!("Failed to clone repo for graph build: {e}");

compliance-agent/src/api/handlers/health.rs

@@ -10,6 +10,18 @@ pub async fn health() -> Json<serde_json::Value> {
     Json(serde_json::json!({ "status": "ok" }))
 }
 
+/// GET /api/v1/settings/ssh-public-key — the agent's SSH deploy public key,
+/// for adding as a read-only deploy key on private git targets.
+#[tracing::instrument(skip_all)]
+pub async fn get_ssh_public_key(
+    axum::extract::Extension(agent): AgentExt,
+) -> Result<Json<serde_json::Value>, axum::http::StatusCode> {
+    let public_path = format!("{}.pub", agent.config.ssh_key_path);
+    let public_key =
+        std::fs::read_to_string(&public_path).map_err(|_| axum::http::StatusCode::NOT_FOUND)?;
+    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
+}
+
 #[tracing::instrument(skip_all)]
 pub async fn stats_overview(
     axum::extract::Extension(agent): AgentExt,
@@ -19,7 +31,7 @@ pub async fn stats_overview(
     let db = &db;
 
     let total_repositories = db
-        .repositories()
+        .onboarded_targets()
         .count_documents(doc! {})
         .await
         .unwrap_or(0);

compliance-agent/src/api/handlers/mod.rs

@@ -9,9 +9,9 @@ pub mod help_chat;
 pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
-pub mod repos;
 pub mod sbom;
 pub mod scans;
 
@@ -20,6 +20,5 @@ pub use dto::*;
 pub use findings::*;
 pub use health::*;
 pub use issues::*;
-pub use repos::*;
 pub use sbom::*;
 pub use scans::*;

compliance-agent/src/api/handlers/onboarding.rs

@@ -0,0 +1,504 @@
+//! Onboarding API — CRUD for unified targets, artifact add, classification, and
+//! the scan-applicability matrix. The wizard (and future integrations) drive
+//! onboarding through these endpoints.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use axum::extract::{Extension, Path, Query};
+use axum::http::StatusCode;
+use axum::Json;
+use mongodb::bson::{doc, oid::ObjectId, to_bson};
+use serde::{Deserialize, Serialize};
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
+    TargetType,
+};
+use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
+use compliance_core::tenant_ctx::TenantCtx;
+
+use crate::agent::ComplianceAgent;
+use crate::classify::{classify_target, MockFirmwareDetector};
+
+use super::dto::tenant_db;
+use super::{collect_cursor_async, ApiResponse, PaginationParams};
+
+type AgentExt = Extension<Arc<ComplianceAgent>>;
+
+/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
+/// id) from it, so clients never set internal fields.
+#[derive(Deserialize)]
+pub struct ArtifactInput {
+    pub kind: ArtifactKind,
+    pub source_ref: String,
+    #[serde(default)]
+    pub branch: Option<String>,
+    #[serde(default)]
+    pub plc_format: Option<PlcFormat>,
+}
+
+impl ArtifactInput {
+    fn build(&self) -> Artifact {
+        let s = self.source_ref.clone();
+        match self.kind {
+            ArtifactKind::GitRepo => {
+                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
+            }
+            ArtifactKind::LiveUrl => Artifact::live_url(s),
+            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
+            ArtifactKind::SourceArchive => Artifact::source_archive(s),
+            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
+            ArtifactKind::ContainerImage => Artifact::container_image(s),
+            ArtifactKind::PlcProject => {
+                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
+            }
+            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub struct CreateTargetRequest {
+    pub name: String,
+    pub target_type: TargetType,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub artifacts: Vec<ArtifactInput>,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateTargetRequest {
+    pub name: Option<String>,
+    pub target_type: Option<TargetType>,
+    pub scan_config: Option<TargetScanConfig>,
+    pub compliance_profile: Option<ComplianceProfile>,
+    pub scan_schedule: Option<String>,
+    /// Replace the target's artifacts wholesale (used by the dashboard editor).
+    #[serde(default)]
+    pub artifacts: Option<Vec<ArtifactInput>>,
+}
+
+/// One applicable-scan option, serialized for the wizard.
+#[derive(Serialize)]
+pub struct ScanOptionDto {
+    pub scan: String,
+    pub default_on: bool,
+    pub rationale: String,
+    pub required_artifact: Option<String>,
+    pub blocked_reason: Option<String>,
+}
+
+#[derive(Serialize)]
+pub struct ApplicableScansResponse {
+    pub scans: Vec<ScanOptionDto>,
+    pub pentest_supported: bool,
+}
+
+fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
+    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
+}
+
+/// GET /api/v1/targets — list onboarded targets (paginated).
+#[tracing::instrument(skip_all)]
+pub async fn list_targets(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Query(params): Query<PaginationParams>,
+) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
+    let db = tenant_db(&agent, &tenant).await?;
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = db
+        .onboarded_targets()
+        .count_documents(doc! {})
+        .await
+        .unwrap_or(0);
+    let targets = match db
+        .onboarded_targets()
+        .find(doc! {})
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch onboarded targets: {e}");
+            Vec::new()
+        }
+    };
+    Ok(Json(ApiResponse {
+        data: targets,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+/// POST /api/v1/targets — create an onboarded target.
+#[tracing::instrument(skip_all)]
+pub async fn create_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<CreateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let mut target = OnboardedTarget::new(req.name, req.target_type);
+    target.description = req.description;
+    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
+
+    let db = tenant_db(&agent, &tenant).await?;
+    let res = db
+        .onboarded_targets()
+        .insert_one(&target)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.id = res.inserted_id.as_object_id();
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// GET /api/v1/targets/{id} — fetch one target.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn get_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// PATCH /api/v1/targets/{id} — update mutable fields.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn update_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateTargetRequest>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+
+    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
+    if let Some(name) = req.name {
+        set.insert("name", name);
+    }
+    if let Some(tt) = req.target_type {
+        set.insert(
+            "target_type",
+            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(sc) = req.scan_config {
+        set.insert(
+            "scan_config",
+            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(cp) = req.compliance_profile {
+        set.insert(
+            "compliance_profile",
+            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+    if let Some(ss) = req.scan_schedule {
+        set.insert("scan_schedule", ss);
+    }
+    if let Some(arts) = req.artifacts {
+        let built: Vec<Artifact> = arts.iter().map(ArtifactInput::build).collect();
+        set.insert(
+            "artifacts",
+            to_bson(&built).map_err(|_| StatusCode::BAD_REQUEST)?,
+        );
+    }
+
+    db.onboarded_targets()
+        .update_one(doc! { "_id": oid }, doc! { "$set": set })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn delete_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    db.onboarded_targets()
+        .delete_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    // Cascade all data keyed by repo_id == target id (best-effort).
+    let db = &db;
+    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db
+        .tracker_issues()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db
+        .impact_analyses()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db
+        .code_embeddings()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db
+        .embedding_builds()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+
+    // DAST targets linked to this target, and all their downstream data.
+    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
+        use futures_util::StreamExt;
+        while let Some(Ok(dt)) = cursor.next().await {
+            let dast_target_id = dt.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !dast_target_id.is_empty() {
+                cascade_delete_dast_target(db, &dast_target_id).await;
+            }
+        }
+    }
+
+    // Pentest sessions linked directly to this target (not via a DAST target).
+    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
+        use futures_util::StreamExt;
+        while let Some(Ok(session)) = cursor.next().await {
+            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !session_id.is_empty() {
+                let _ = db
+                    .attack_chain_nodes()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .pentest_messages()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .dast_findings()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+            }
+        }
+    }
+    let _ = db
+        .pentest_sessions()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+
+    Ok(Json(serde_json::json!({ "status": "deleted" })))
+}
+
+/// Delete a DAST target and everything downstream of it (pentest sessions +
+/// their attack chains / messages / findings, DAST scan runs + findings).
+async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
+    use futures_util::StreamExt;
+    if let Ok(mut cursor) = db
+        .pentest_sessions()
+        .find(doc! { "target_id": target_id })
+        .await
+    {
+        while let Some(Ok(session)) = cursor.next().await {
+            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !session_id.is_empty() {
+                let _ = db
+                    .attack_chain_nodes()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .pentest_messages()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .dast_findings()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+            }
+        }
+    }
+    let _ = db
+        .pentest_sessions()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    let _ = db
+        .dast_findings()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    let _ = db
+        .dast_scan_runs()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
+        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
+    }
+}
+
+/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn add_artifact(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(input): Json<ArtifactInput>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn applicable_scans_for_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    let scans = applicable_scans(&target)
+        .into_iter()
+        .map(|o| ScanOptionDto {
+            scan: o.scan.to_string(),
+            default_on: o.default_on,
+            rationale: o.rationale,
+            required_artifact: o.required_artifact.map(|k| k.to_string()),
+            blocked_reason: o.blocked_reason,
+        })
+        .collect();
+
+    Ok(Json(ApiResponse {
+        data: ApplicableScansResponse {
+            scans,
+            pentest_supported: supports_pentest(target.target_type),
+        },
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
+///
+/// This is the lightweight pass: it classifies from artifact kinds without
+/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
+/// ingest, with tramiton firmware analysis) is a follow-up background step.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn detect_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let mut target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // No ingested working paths here → kind-based classification only; the mock
+    // firmware detector is never invoked (no firmware working path present).
+    let empty = HashMap::new();
+    let detector = MockFirmwareDetector { detection: None };
+    let classification = classify_target(&target, &empty, &detector)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let classification_bson =
+        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    target.classification = Some(classification);
+
+    Ok(Json(ApiResponse {
+        data: target,
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
+///
+/// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
+/// legacy path). Runs in the background and returns immediately.
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn trigger_target_scan(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    // 404 if the target doesn't exist for this tenant.
+    if db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .is_none()
+    {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let agent_clone = (*agent).clone();
+    let tenant_id = tenant.0.tenant_id.clone();
+    tokio::spawn(async move {
+        // Always the unified target pipeline — this endpoint is about an
+        // onboarded target by construction, independent of the global
+        // `unified_pipeline` transition flag used by the legacy paths.
+        if let Err(e) = agent_clone
+            .run_target_scan(
+                &tenant_id,
+                &id,
+                compliance_core::models::ScanTrigger::Manual,
+            )
+            .await
+        {
+            tracing::error!("Manual target scan failed for {id}: {e}");
+        }
+    });
+    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
+}

compliance-agent/src/api/handlers/pentest_handlers/session.rs

@@ -113,14 +113,14 @@ pub async fn create_session(
         session.config = Some(config.clone());
         session.repo_id = target.repo_id.clone();
 
-        // Resolve repo_id from git_repo_url if provided
+        // Resolve repo_id (target id) from git_repo_url if provided
         if let Some(ref git_url) = config.git_repo_url {
-            if let Ok(Some(repo)) = db
-                .repositories()
-                .find_one(doc! { "git_url": git_url })
+            if let Ok(Some(target)) = db
+                .onboarded_targets()
+                .find_one(doc! { "artifacts.source_ref": git_url })
                 .await
             {
-                session.repo_id = repo.id.map(|oid| oid.to_hex());
+                session.repo_id = target.id.map(|oid| oid.to_hex());
             }
         }
 
@@ -380,17 +380,20 @@ pub async fn lookup_repo(
 ) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
     let db = tenant_db(&agent, &tenant).await?;
     let repo = db
-        .repositories()
-        .find_one(doc! { "git_url": &params.url })
+        .onboarded_targets()
+        .find_one(doc! { "artifacts.source_ref": &params.url })
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
 
     let data = match repo {
-        Some(r) => serde_json::json!({
-            "name": r.name,
-            "default_branch": r.default_branch,
-            "last_scanned_commit": r.last_scanned_commit,
-        }),
+        Some(r) => {
+            let git = r.code_artifact().and_then(|c| c.git.as_ref());
+            serde_json::json!({
+                "name": r.name,
+                "default_branch": git.map(|g| g.default_branch.clone()),
+                "last_scanned_commit": git.and_then(|g| g.last_scanned_commit.clone()),
+            })
+        }
         None => serde_json::Value::Null,
     };
 

compliance-agent/src/api/handlers/repos.rs

@@ -1,339 +0,0 @@
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::doc;
-
-use super::dto::*;
-use compliance_core::models::*;
-use compliance_core::tenant_ctx::TenantCtx;
-
-#[tracing::instrument(skip_all)]
-pub async fn list_repositories(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> ApiResult<Vec<TrackedRepository>> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .repositories()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-
-    let repos = match db
-        .repositories()
-        .find(doc! {})
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch repositories: {e}");
-            Vec::new()
-        }
-    };
-
-    Ok(Json(ApiResponse {
-        data: repos,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn add_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<AddRepositoryRequest>,
-) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
-    // Validate repository access before saving
-    let creds = crate::pipeline::git::RepoCredentials {
-        ssh_key_path: Some(agent.config.ssh_key_path.clone()),
-        auth_token: req.auth_token.clone(),
-        auth_username: req.auth_username.clone(),
-    };
-
-    if let Err(e) = crate::pipeline::git::GitOps::test_access(&req.git_url, &creds) {
-        return Err((
-            StatusCode::BAD_REQUEST,
-            format!("Cannot access repository: {e}"),
-        ));
-    }
-
-    let mut repo = TrackedRepository::new(req.name, req.git_url);
-    repo.default_branch = req.default_branch;
-    repo.auth_token = req.auth_token;
-    repo.auth_username = req.auth_username;
-    repo.tracker_type = req.tracker_type;
-    repo.tracker_owner = req.tracker_owner;
-    repo.tracker_repo = req.tracker_repo;
-    repo.tracker_token = req.tracker_token;
-    repo.scan_schedule = req.scan_schedule;
-
-    let db = tenant_db(&agent, &tenant)
-        .await
-        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-    db.repositories().insert_one(&repo).await.map_err(|_| {
-        (
-            StatusCode::CONFLICT,
-            "Repository already exists".to_string(),
-        )
-    })?;
-
-    Ok(Json(ApiResponse {
-        data: repo,
-        total: None,
-        page: None,
-    }))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn update_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateRepositoryRequest>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut set_doc = doc! { "updated_at": mongodb::bson::DateTime::now() };
-
-    if let Some(name) = &req.name {
-        set_doc.insert("name", name);
-    }
-    if let Some(branch) = &req.default_branch {
-        set_doc.insert("default_branch", branch);
-    }
-    if let Some(token) = &req.auth_token {
-        set_doc.insert("auth_token", token);
-    }
-    if let Some(username) = &req.auth_username {
-        set_doc.insert("auth_username", username);
-    }
-    if let Some(tracker_type) = &req.tracker_type {
-        set_doc.insert("tracker_type", tracker_type.to_string());
-    }
-    if let Some(owner) = &req.tracker_owner {
-        set_doc.insert("tracker_owner", owner);
-    }
-    if let Some(repo) = &req.tracker_repo {
-        set_doc.insert("tracker_repo", repo);
-    }
-    if let Some(token) = &req.tracker_token {
-        set_doc.insert("tracker_token", token);
-    }
-    if let Some(schedule) = &req.scan_schedule {
-        set_doc.insert("scan_schedule", schedule);
-    }
-
-    let result = db
-        .repositories()
-        .update_one(doc! { "_id": oid }, doc! { "$set": set_doc })
-        .await
-        .map_err(|e| {
-            tracing::warn!("Failed to update repository: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    Ok(Json(serde_json::json!({ "status": "updated" })))
-}
-
-#[tracing::instrument(skip_all)]
-pub async fn get_ssh_public_key(
-    Extension(agent): AgentExt,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let public_path = format!("{}.pub", agent.config.ssh_key_path);
-    let public_key = std::fs::read_to_string(&public_path).map_err(|_| StatusCode::NOT_FOUND)?;
-    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn trigger_scan(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let agent_clone = (*agent).clone();
-    let tenant_id = tenant.0.tenant_id.clone();
-    tokio::spawn(async move {
-        if let Err(e) = agent_clone
-            .run_scan(&tenant_id, &id, ScanTrigger::Manual)
-            .await
-        {
-            tracing::error!("Manual scan failed for {id}: {e}");
-        }
-    });
-
-    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
-}
-
-/// Return the webhook secret for a repository (used by dashboard to display it)
-pub async fn get_webhook_config(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let repo = db
-        .repositories()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    let tracker_type = repo
-        .tracker_type
-        .as_ref()
-        .map(|t| t.to_string())
-        .unwrap_or_else(|| "gitea".to_string());
-
-    Ok(Json(serde_json::json!({
-        "webhook_secret": repo.webhook_secret,
-        "tracker_type": tracker_type,
-    })))
-}
-
-#[tracing::instrument(skip_all, fields(repo_id = %id))]
-pub async fn delete_repository(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let db = &db;
-
-    // Delete the repository
-    let result = db
-        .repositories()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    if result.deleted_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    // Cascade delete all related data
-    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .tracker_issues()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .impact_analyses()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .code_embeddings()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .embedding_builds()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    // Cascade delete DAST targets linked to this repo, and all their downstream data
-    // (scan runs, findings, pentest sessions, attack chains, messages)
-    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(target)) = cursor.next().await {
-            let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !target_id.is_empty() {
-                cascade_delete_dast_target(db, &target_id).await;
-            }
-        }
-    }
-
-    // Also delete pentest sessions linked directly to this repo (not via target)
-    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                // Delete DAST findings produced by this session
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    Ok(Json(serde_json::json!({ "status": "deleted" })))
-}
-
-/// Cascade-delete a DAST target and all its downstream data.
-async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
-    // Delete pentest sessions for this target (and their attack chains + messages)
-    if let Ok(mut cursor) = db
-        .pentest_sessions()
-        .find(doc! { "target_id": target_id })
-        .await
-    {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-
-    // Delete DAST scan runs and their findings
-    let _ = db
-        .dast_findings()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-    let _ = db
-        .dast_scan_runs()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-
-    // Delete the target itself
-    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
-        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
-    }
-}

compliance-agent/src/api/handlers/sbom.rs

@@ -282,7 +282,7 @@ pub async fn license_summary(
             }
         })
         .collect();
-    summaries.sort_by(|a, b| b.count.cmp(&a.count));
+    summaries.sort_by_key(|s| std::cmp::Reverse(s.count));
 
     Ok(Json(ApiResponse {
         data: summaries,

compliance-agent/src/api/routes.rs

@@ -11,19 +11,32 @@ pub fn build_router() -> Router {
             "/api/v1/settings/ssh-public-key",
             get(handlers::get_ssh_public_key),
         )
-        .route("/api/v1/repositories", get(handlers::list_repositories))
-        .route("/api/v1/repositories", post(handlers::add_repository))
+        // Unified onboarding targets (#131).
         .route(
-            "/api/v1/repositories/{id}/scan",
-            post(handlers::trigger_scan),
+            "/api/v1/targets",
+            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
         )
         .route(
-            "/api/v1/repositories/{id}",
-            delete(handlers::delete_repository).patch(handlers::update_repository),
+            "/api/v1/targets/{id}",
+            get(handlers::onboarding::get_target)
+                .patch(handlers::onboarding::update_target)
+                .delete(handlers::onboarding::delete_target),
         )
         .route(
-            "/api/v1/repositories/{id}/webhook-config",
-            get(handlers::get_webhook_config),
+            "/api/v1/targets/{id}/artifacts",
+            post(handlers::onboarding::add_artifact),
+        )
+        .route(
+            "/api/v1/targets/{id}/applicable-scans",
+            get(handlers::onboarding::applicable_scans_for_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/detect",
+            post(handlers::onboarding::detect_target),
+        )
+        .route(
+            "/api/v1/targets/{id}/scan",
+            post(handlers::onboarding::trigger_target_scan),
         )
         .route("/api/v1/findings", get(handlers::list_findings))
         .route("/api/v1/findings/{id}", get(handlers::get_finding))

compliance-agent/src/database.rs

@@ -249,16 +249,6 @@ impl Database {
     }
 
     pub async fn ensure_indexes(&self) -> Result<(), AgentError> {
-        // repositories: unique git_url
-        self.repositories()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "git_url": 1 })
-                    .options(IndexOptions::builder().unique(true).build())
-                    .build(),
-            )
-            .await?;
-
         // findings: unique fingerprint
         self.findings()
             .create_index(
@@ -479,10 +469,6 @@ impl Database {
         Ok(())
     }
 
-    pub fn repositories(&self) -> Collection<TrackedRepository> {
-        self.inner.collection("repositories")
-    }
-
     pub fn findings(&self) -> Collection<Finding> {
         self.inner.collection("findings")
     }

compliance-agent/src/lib.rs

@@ -8,7 +8,6 @@ pub mod database;
 pub mod error;
 pub mod ingest;
 pub mod llm;
-pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;

compliance-agent/src/main.rs

@@ -1,50 +1,4 @@
-use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
-
-/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
-/// unified `onboarded_targets` collection per tenant.
-///
-/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
-async fn run_migration(
-    args: &[String],
-    pool: &database::DatabasePool,
-) -> Result<(), compliance_agent::error::AgentError> {
-    if args.get(2).map(String::as_str) != Some("onboarding") {
-        eprintln!(
-            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
-        );
-        std::process::exit(2);
-    }
-    let has = |flag: &str| args.iter().any(|a| a == flag);
-    let dry_run = has("--dry-run");
-    let revert = has("--revert");
-    let tenant = args
-        .iter()
-        .position(|a| a == "--tenant")
-        .and_then(|i| args.get(i + 1))
-        .cloned();
-
-    let tenants: Vec<String> = if has("--all") {
-        pool.list_tenant_ids().await?
-    } else if let Some(t) = tenant {
-        vec![t]
-    } else {
-        eprintln!("specify --all or --tenant <id>");
-        std::process::exit(2);
-    };
-
-    for tenant_id in tenants {
-        let db = pool.for_tenant_id(&tenant_id).await?;
-        if revert {
-            migrate::onboarding::revert(&db).await?;
-            println!("[{tenant_id}] reverted onboarding backfill");
-        } else {
-            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
-            let prefix = if dry_run { "(dry-run) " } else { "" };
-            println!("[{tenant_id}] {prefix}{report:?}");
-        }
-    }
-    Ok(())
-}
+use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -77,13 +31,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let db_pool =
         database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
-    // One-shot subcommands run and exit without starting the servers.
-    let args: Vec<String> = std::env::args().collect();
-    if args.get(1).map(String::as_str) == Some("migrate") {
-        run_migration(&args, &db_pool).await?;
-        return Ok(());
-    }
-
     let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
 
     tracing::info!("Starting scheduler...");

compliance-agent/src/migrate/mod.rs

@@ -1,8 +0,0 @@
-//! One-time data migrations.
-//!
-//! Currently just the onboarding backfill ([`onboarding`]), which folds the
-//! legacy `repositories` and `dast_targets` collections into the unified
-//! `onboarded_targets` collection, preserving `_id` so every downstream record
-//! keyed by `repo_id` / `target_id` keeps resolving.
-
-pub mod onboarding;

compliance-agent/src/migrate/onboarding.rs

@@ -1,406 +0,0 @@
-//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
-//!
-//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
-//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
-//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
-//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
-//! existing webhook URLs keep working. The mapping functions are pure and unit
-//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
-//! thin driver over them.
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
-    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
-};
-use futures_util::TryStreamExt;
-use mongodb::bson::{doc, Document};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// Marker id in `schema_migrations` recording that the backfill has run.
-const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
-
-/// Summary of a backfill run.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct MigrationReport {
-    /// Repositories turned into onboarded targets.
-    pub repos_migrated: u64,
-    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
-    pub dast_targets_folded: u64,
-    /// DAST targets with no repo link, migrated as standalone targets.
-    pub dast_targets_standalone: u64,
-    /// Records skipped because a target with that `_id` already existed.
-    pub skipped_existing: u64,
-}
-
-/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
-/// are backend services; a browser app is a web app.
-fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
-    match kind {
-        DastTargetType::WebApp => TargetType::WebApp,
-        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
-    }
-}
-
-/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
-/// auth). Shared by fold-in and standalone migration.
-pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
-    let mut artifact = Artifact::live_url(dast.base_url.clone());
-    artifact.web = Some(WebArtifactConfig {
-        target_kind: dast.target_type.clone(),
-        excluded_paths: dast.excluded_paths.clone(),
-        max_crawl_depth: dast.max_crawl_depth,
-        rate_limit: dast.rate_limit,
-        allow_destructive: dast.allow_destructive,
-    });
-    artifact.auth = dast.auth_config.clone().map(Into::into);
-    artifact
-}
-
-/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
-/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
-/// and auth; tracker config folds into `scan_config`.
-///
-/// `target_type` is a safe default (`BackendService`) — the classifier can
-/// refine it later; `classification` is left `None` (unconfirmed).
-pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
-    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
-    target.id = repo.id;
-
-    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
-    artifact.git = Some(GitArtifactConfig {
-        default_branch: repo.default_branch.clone(),
-        last_scanned_commit: repo.last_scanned_commit.clone(),
-        local_path: repo.local_path.clone(),
-    });
-    if repo.auth_token.is_some() || repo.auth_username.is_some() {
-        artifact.auth = Some(compliance_core::models::ArtifactAuth {
-            method: "token".to_string(),
-            username: repo.auth_username.clone(),
-            secret: repo.auth_token.clone(),
-            ..Default::default()
-        });
-    }
-    target.artifacts.push(artifact);
-
-    if repo.tracker_type.is_some() {
-        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
-            tracker_type: repo.tracker_type.clone(),
-            owner: repo.tracker_owner.clone(),
-            repo: repo.tracker_repo.clone(),
-            token: repo.tracker_token.clone(),
-        });
-    }
-
-    target.scan_schedule = repo.scan_schedule.clone();
-    target.webhook_enabled = repo.webhook_enabled;
-    target.webhook_secret = repo.webhook_secret.clone();
-    target.findings_count = repo.findings_count;
-    target.created_at = repo.created_at;
-    target.updated_at = repo.updated_at;
-    target
-}
-
-/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
-/// target. If the repo default was `BackendService` but the DAST target is a
-/// browser web app, promote the type to `WebApp`.
-pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
-    if matches!(dast.target_type, DastTargetType::WebApp)
-        && target.target_type == TargetType::BackendService
-    {
-        target.target_type = TargetType::WebApp;
-    }
-    if !target.has(ArtifactKind::LiveUrl) {
-        target.artifacts.push(dast_to_artifact(dast));
-    }
-}
-
-/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
-pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
-    let mut target =
-        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
-    target.id = dast.id;
-    target.artifacts.push(dast_to_artifact(dast));
-    target.created_at = dast.created_at;
-    target.updated_at = dast.updated_at;
-    target
-}
-
-/// Whether the onboarding backfill has already been applied to this database.
-pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
-    let found = db
-        .collection_named::<Document>("schema_migrations")
-        .find_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(found.is_some())
-}
-
-/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
-/// tenant database.
-///
-/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
-/// skipped, so re-running is safe. With `dry_run`, computes the report without
-/// writing. The legacy collections are never deleted; the only mutation outside
-/// `onboarded_targets` is the history relink of folded DAST targets, which is
-/// logged so [`revert`] can undo it.
-pub async fn backfill_onboarded_targets(
-    db: &Database,
-    dry_run: bool,
-) -> Result<MigrationReport, AgentError> {
-    let mut report = MigrationReport::default();
-
-    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
-    let mut repos = db.repositories().find(doc! {}).await?;
-    while let Some(repo) = repos.try_next().await? {
-        let Some(id) = repo.id else { continue };
-        if db
-            .onboarded_targets()
-            .find_one(doc! { "_id": id })
-            .await?
-            .is_some()
-        {
-            report.skipped_existing += 1;
-            continue;
-        }
-        if !dry_run {
-            db.onboarded_targets()
-                .insert_one(repo_to_target(&repo))
-                .await?;
-        }
-        report.repos_migrated += 1;
-    }
-
-    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
-    let mut dasts = db.dast_targets().find(doc! {}).await?;
-    while let Some(dast) = dasts.try_next().await? {
-        let Some(dast_id) = dast.id else { continue };
-        let repo_oid = dast
-            .repo_id
-            .as_deref()
-            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
-        let linked = match repo_oid {
-            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
-            None => None,
-        };
-
-        match (linked, repo_oid) {
-            // Fold into an existing repo-derived target.
-            (Some(mut target), Some(oid)) => {
-                if target.has(ArtifactKind::LiveUrl) {
-                    report.skipped_existing += 1; // already folded on a prior run
-                    continue;
-                }
-                fold_dast_into_target(&mut target, &dast);
-                if !dry_run {
-                    db.onboarded_targets()
-                        .replace_one(doc! { "_id": oid }, &target)
-                        .await?;
-                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
-                }
-                report.dast_targets_folded += 1;
-            }
-            // No linked repo target: migrate as a standalone target (keeps _id).
-            _ => {
-                if db
-                    .onboarded_targets()
-                    .find_one(doc! { "_id": dast_id })
-                    .await?
-                    .is_some()
-                {
-                    report.skipped_existing += 1;
-                    continue;
-                }
-                if !dry_run {
-                    db.onboarded_targets()
-                        .insert_one(dast_to_standalone_target(&dast))
-                        .await?;
-                }
-                report.dast_targets_standalone += 1;
-            }
-        }
-    }
-
-    if !dry_run {
-        db.collection_named::<Document>("schema_migrations")
-            .update_one(
-                doc! { "_id": MIGRATION_MARKER },
-                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
-            )
-            .upsert(true)
-            .await?;
-    }
-    Ok(report)
-}
-
-/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
-/// unified target id, logging each move so [`revert`] can undo it.
-///
-/// Note: if multiple DAST targets fold into the same repo target, revert
-/// restores only the last-logged mapping — a rare edge. The source collections
-/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
-async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
-    db.dast_scan_runs()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.pentest_sessions()
-        .update_many(
-            doc! { "target_id": old_id },
-            doc! { "$set": { "target_id": new_id } },
-        )
-        .await?;
-    db.collection_named::<Document>("onboarding_migration_log")
-        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
-        .await?;
-    Ok(())
-}
-
-/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
-/// and the log, and clear the marker. The legacy collections are untouched, so
-/// this restores the pre-migration state.
-pub async fn revert(db: &Database) -> Result<(), AgentError> {
-    let log = db.collection_named::<Document>("onboarding_migration_log");
-    let mut cursor = log.find(doc! {}).await?;
-    while let Some(entry) = cursor.try_next().await? {
-        if let (Ok(old), Ok(new)) = (
-            entry.get_str("old_target_id"),
-            entry.get_str("new_target_id"),
-        ) {
-            db.dast_scan_runs()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-            db.pentest_sessions()
-                .update_many(
-                    doc! { "target_id": new },
-                    doc! { "$set": { "target_id": old } },
-                )
-                .await?;
-        }
-    }
-    db.onboarded_targets().drop().await?;
-    log.drop().await?;
-    db.collection_named::<Document>("schema_migrations")
-        .delete_one(doc! { "_id": MIGRATION_MARKER })
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{DastAuthConfig, TrackerType};
-
-    fn repo() -> TrackedRepository {
-        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
-        r.id = Some(mongodb::bson::oid::ObjectId::new());
-        r.default_branch = "develop".to_string();
-        r.last_scanned_commit = Some("abc123".to_string());
-        r.auth_token = Some("pat".to_string());
-        r.auth_username = Some("bob".to_string());
-        r.tracker_type = Some(TrackerType::Gitea);
-        r.tracker_owner = Some("acme".to_string());
-        r.findings_count = 7;
-        r
-    }
-
-    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
-        let mut d = DastTarget::new(
-            "acme-web".to_string(),
-            "https://acme.example.com".to_string(),
-            kind,
-        );
-        d.id = Some(mongodb::bson::oid::ObjectId::new());
-        d.repo_id = repo_id;
-        d.max_crawl_depth = 5;
-        d.auth_config = Some(DastAuthConfig {
-            method: "bearer".to_string(),
-            login_url: None,
-            username: None,
-            password: None,
-            token: Some("tok".to_string()),
-            headers: None,
-        });
-        d
-    }
-
-    #[test]
-    fn repo_maps_preserving_id_and_git_artifact() {
-        let r = repo();
-        let t = repo_to_target(&r);
-        assert_eq!(t.id, r.id); // id preserved
-        assert_eq!(t.findings_count, 7);
-        assert_eq!(t.scan_schedule, r.scan_schedule);
-        let git = t.code_artifact().expect("git artifact");
-        assert_eq!(git.kind, ArtifactKind::GitRepo);
-        assert_eq!(git.source_ref, "https://git/acme.git");
-        let gc = git.git.as_ref().expect("git config");
-        assert_eq!(gc.default_branch, "develop");
-        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
-        let auth = git.auth.as_ref().expect("auth");
-        assert_eq!(auth.secret.as_deref(), Some("pat"));
-        assert_eq!(auth.username.as_deref(), Some("bob"));
-        assert_eq!(
-            t.scan_config
-                .issue_tracker
-                .as_ref()
-                .and_then(|it| it.tracker_type.clone()),
-            Some(TrackerType::Gitea)
-        );
-    }
-
-    #[test]
-    fn standalone_dast_maps_preserving_id_and_live_url() {
-        let d = dast(None, DastTargetType::WebApp);
-        let t = dast_to_standalone_target(&d);
-        assert_eq!(t.id, d.id);
-        assert_eq!(t.target_type, TargetType::WebApp);
-        let url = t.live_url().expect("live url");
-        assert_eq!(url.source_ref, "https://acme.example.com");
-        let web = url.web.as_ref().expect("web config");
-        assert_eq!(web.max_crawl_depth, 5);
-        assert_eq!(
-            url.auth.as_ref().and_then(|a| a.secret.clone()),
-            Some("tok".to_string())
-        );
-    }
-
-    #[test]
-    fn rest_api_dast_maps_to_backend_service() {
-        let d = dast(None, DastTargetType::RestApi);
-        assert_eq!(
-            dast_to_standalone_target(&d).target_type,
-            TargetType::BackendService
-        );
-    }
-
-    #[test]
-    fn fold_adds_live_url_and_promotes_webapp() {
-        let mut t = repo_to_target(&repo());
-        assert_eq!(t.target_type, TargetType::BackendService);
-        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
-        assert_eq!(t.target_type, TargetType::WebApp); // promoted
-        assert!(t.has(ArtifactKind::LiveUrl));
-        assert!(t.has(ArtifactKind::GitRepo));
-    }
-
-    #[test]
-    fn fold_is_idempotent_on_live_url() {
-        let mut t = repo_to_target(&repo());
-        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
-        fold_dast_into_target(&mut t, &d);
-        fold_dast_into_target(&mut t, &d);
-        let live_urls = t
-            .artifacts
-            .iter()
-            .filter(|a| a.kind == ArtifactKind::LiveUrl)
-            .count();
-        assert_eq!(live_urls, 1);
-    }
-}

compliance-agent/src/pipeline/firmware_sbom.rs

@@ -0,0 +1,152 @@
+//! Firmware SBOM via tramiton.
+//!
+//! Phase 2 (full, the default): drive a **reproducible build** with tramiton's
+//! `NixBackend` — `analyze` → `seal_and_build` → a sealed lock whose libraries
+//! are pinned and whose firmware artifact carries a content hash — then render
+//! the SBOM from the lock plus deep binary SCA of pre-compiled inputs. This is
+//! the complete bill of materials (toolchain + every fetched library + the
+//! firmware image), the same one `tramiton sbom` produces.
+//!
+//! Phase 1 fallback (analysis-only): when no nix backend is available or the
+//! build fails, fall back to the resolvable libraries + toolchain from the build
+//! plan alone (no build). A scan therefore always yields *something*, and a nix
+//! that can't run in the deployment never breaks a scan.
+
+use std::path::Path;
+
+use compliance_core::models::{SbomEntry, TargetType};
+use tramiton_repro::ReproBackend;
+use tramiton_sbom::ComponentKind;
+
+/// Whether firmware SBOM applies to this target family.
+pub fn is_firmware_target(target_type: TargetType) -> bool {
+    matches!(
+        target_type,
+        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos | TargetType::EmbeddedLinuxYocto
+    )
+}
+
+/// Build SBOM entries for a firmware target from its source tree. Prefers a full
+/// reproducible build (sealed lock); falls back to analysis-only. Returns an
+/// empty vector when tramiton cannot even form a build plan.
+pub async fn firmware_sbom_entries(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let p = path.to_path_buf();
+    let repo = repo_id.to_string();
+    // The whole analyze → seal → build → render sequence is blocking (it shells
+    // out to nix), so keep it off the async runtime. Bound it: a firmware build
+    // that hangs must not wedge the scan (the orphaned task is abandoned).
+    let handle = tokio::task::spawn_blocking(move || build_sbom_blocking(&p, &repo));
+    match tokio::time::timeout(std::time::Duration::from_secs(900), handle).await {
+        Ok(Ok(entries)) => entries,
+        Ok(Err(e)) => {
+            tracing::warn!(repo_id, error = %e, "Firmware SBOM: task join error");
+            Vec::new()
+        }
+        Err(_) => {
+            tracing::warn!(repo_id, "Firmware SBOM: build exceeded 15m; skipping");
+            Vec::new()
+        }
+    }
+}
+
+fn build_sbom_blocking(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let repo = tramiton_core::Repo::new(path);
+    let plan = match tramiton_core::provider::analyze(&repo) {
+        Ok(Some(bp)) => bp,
+        Ok(None) => return Vec::new(),
+        Err(e) => {
+            tracing::warn!(repo_id, error = %e, "Firmware SBOM: tramiton analyze failed");
+            return Vec::new();
+        }
+    };
+
+    // Phase 2: reproducible build → sealed lock → complete SBOM.
+    if let Some(backend) = tramiton_repro::NixBackend::detect() {
+        match tramiton_repro::seal_and_build(&backend, &plan, path) {
+            Ok(lock) => {
+                let mut sbom = tramiton_sbom::Sbom::from_lock(&lock, repo_id);
+                // Deep binary SCA of any pre-compiled inputs in the tree.
+                sbom.components.extend(tramiton_sbom::binary::scan(path));
+                let entries = sbom_to_entries(&sbom, repo_id);
+                tracing::info!(
+                    repo_id,
+                    backend = backend.name(),
+                    count = entries.len(),
+                    "Firmware SBOM: sealed reproducible build"
+                );
+                return entries;
+            }
+            Err(e) => {
+                tracing::warn!(repo_id, error = %e, "Firmware SBOM: reproducible build failed; falling back to analysis-only")
+            }
+        }
+    } else {
+        tracing::info!(
+            repo_id,
+            "Firmware SBOM: no nix backend available; analysis-only SBOM"
+        );
+    }
+
+    // Phase 1 fallback: analysis-only (toolchain + resolvable libraries).
+    analysis_entries(&plan, repo_id)
+}
+
+/// Map a rendered [`tramiton_sbom::Sbom`] (primary firmware + components) into
+/// our [`SbomEntry`] rows. Source-file (`File`) components are dropped — they are
+/// build inputs, not a dependency inventory.
+fn sbom_to_entries(sbom: &tramiton_sbom::Sbom, repo_id: &str) -> Vec<SbomEntry> {
+    let mut entries = Vec::new();
+    if let Some(primary) = &sbom.primary {
+        entries.push(component_to_entry(primary, repo_id));
+    }
+    for c in &sbom.components {
+        if matches!(c.kind, ComponentKind::File) {
+            continue;
+        }
+        entries.push(component_to_entry(c, repo_id));
+    }
+    entries
+}
+
+fn component_to_entry(c: &tramiton_sbom::Component, repo_id: &str) -> SbomEntry {
+    let manager = match c.kind {
+        ComponentKind::Firmware => "firmware",
+        ComponentKind::Library => "library",
+        ComponentKind::Toolchain => "toolchain",
+        ComponentKind::File => "file",
+    };
+    let mut entry = SbomEntry::new(
+        repo_id.to_string(),
+        c.name.clone(),
+        c.version.clone().unwrap_or_default(),
+        manager.to_string(),
+    );
+    entry.purl = c.source.clone();
+    entry
+}
+
+/// Analysis-only components from the build plan: the cross-toolchain plus the
+/// resolvable fetched libraries, without a build.
+fn analysis_entries(bp: &tramiton_core::BuildPlan, repo_id: &str) -> Vec<SbomEntry> {
+    let mut entries = Vec::new();
+    if let Some(id) = bp.toolchain.id.clone() {
+        let version = bp.toolchain.version.clone().unwrap_or_default();
+        entries.push(SbomEntry::new(
+            repo_id.to_string(),
+            id,
+            version,
+            "toolchain".to_string(),
+        ));
+    }
+    for lib in tramiton_repro::lock::libraries_from_inputs(&bp.inputs) {
+        let mut entry = SbomEntry::new(
+            repo_id.to_string(),
+            lib.name,
+            lib.revision,
+            "library".to_string(),
+        );
+        entry.purl = lib.source;
+        entries.push(entry);
+    }
+    entries
+}

compliance-agent/src/pipeline/git.rs

@@ -80,7 +80,10 @@ impl GitOps {
 
     #[tracing::instrument(skip_all, fields(repo_name = %repo_name))]
     pub fn clone_or_fetch(&self, git_url: &str, repo_name: &str) -> Result<PathBuf, AgentError> {
-        let repo_path = self.base_path.join(repo_name);
+        // Names can contain slashes or other path-hostile characters (a target
+        // named after a repo path, say); collapse to one safe directory segment
+        // so the clone path never nests or breaks.
+        let repo_path = self.base_path.join(sanitize_repo_dir(repo_name));
 
         if repo_path.exists() {
             tracing::info!("fetching updates for existing repo");
@@ -135,7 +138,7 @@ impl GitOps {
     /// Build credentials from agent config + per-repo overrides
     pub fn make_repo_credentials(
         config: &compliance_core::AgentConfig,
-        repo: &compliance_core::models::TrackedRepository,
+        repo: &crate::pipeline::repo_view::RepoView,
     ) -> RepoCredentials {
         RepoCredentials {
             ssh_key_path: Some(config.ssh_key_path.clone()),
@@ -253,3 +256,46 @@ pub struct DiffFile {
     pub path: String,
     pub hunks: String,
 }
+
+/// Collapse a repository name into a single filesystem-safe directory segment.
+/// Names may carry slashes or other path-hostile characters (a target named
+/// after a repo path, for instance); those would otherwise nest or break the
+/// clone path, so map anything outside `[A-Za-z0-9._-]` to `_`.
+fn sanitize_repo_dir(name: &str) -> String {
+    let mapped: String = name
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' {
+                c
+            } else {
+                '_'
+            }
+        })
+        .collect();
+    let trimmed = mapped.trim_matches(|c| c == '.' || c == '_');
+    if trimmed.is_empty() {
+        "repo".to_string()
+    } else {
+        trimmed.to_string()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::sanitize_repo_dir;
+
+    #[test]
+    fn sanitizes_path_hostile_names() {
+        assert_eq!(
+            sanitize_repo_dir("zephyr-example-app"),
+            "zephyr-example-app"
+        );
+        assert_eq!(
+            sanitize_repo_dir("ChristianRinn/bare_metal_stm32f411xe"),
+            "ChristianRinn_bare_metal_stm32f411xe"
+        );
+        assert_eq!(sanitize_repo_dir("../../etc/passwd"), "etc_passwd");
+        assert_eq!(sanitize_repo_dir("a b:c"), "a_b_c");
+        assert_eq!(sanitize_repo_dir("///"), "repo");
+    }
+}

compliance-agent/src/pipeline/issue_creation.rs

@@ -1,5 +1,6 @@
 use mongodb::bson::doc;
 
+use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;
 
 use super::orchestrator::{extract_base_url, PipelineOrchestrator};
@@ -10,7 +11,7 @@ use crate::trackers;
 impl PipelineOrchestrator {
     /// Build an issue tracker client from a repository's tracker configuration.
     /// Returns `None` if the repo has no tracker configured.
-    pub(super) fn build_tracker(&self, repo: &TrackedRepository) -> Option<TrackerDispatch> {
+    pub(super) fn build_tracker(&self, repo: &RepoView) -> Option<TrackerDispatch> {
         let tracker_type = repo.tracker_type.as_ref()?;
         // Per-repo token takes precedence, fall back to global config
         match tracker_type {
@@ -81,7 +82,7 @@ impl PipelineOrchestrator {
     #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
     pub(super) async fn create_tracker_issues(
         &self,
-        repo: &TrackedRepository,
+        repo: &RepoView,
         repo_id: &str,
         new_findings: &[Finding],
     ) -> Result<(), AgentError> {

compliance-agent/src/pipeline/mod.rs

@@ -1,6 +1,7 @@
 pub mod code_review;
 pub mod cve;
 pub mod dedup;
+pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
@@ -8,7 +9,9 @@ mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
+pub mod plan;
 mod pr_review;
+pub mod repo_view;
 pub mod sbom;
 pub mod semgrep;
 mod tracker_dispatch;

compliance-agent/src/pipeline/orchestrator.rs

@@ -15,6 +15,8 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
+use crate::pipeline::plan::build_scan_plan;
+use crate::pipeline::repo_view::RepoView;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;
 
@@ -50,72 +52,8 @@ impl PipelineOrchestrator {
         }
     }
 
-    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, trigger = ?trigger))]
-    pub async fn run(&self, repo_id: &str, trigger: ScanTrigger) -> Result<(), AgentError> {
-        // Look up the repository
-        let repo = self
-            .db
-            .repositories()
-            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id).map_err(|e| AgentError::Other(e.to_string()))? })
-            .await?
-            .ok_or_else(|| AgentError::Other(format!("Repository {repo_id} not found")))?;
-
-        // Create scan run
-        let scan_run = ScanRun::new(repo_id.to_string(), trigger);
-        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
-        let scan_run_id = insert
-            .inserted_id
-            .as_object_id()
-            .map(|id| id.to_hex())
-            .unwrap_or_default();
-
-        let result = self.run_pipeline(&repo, &scan_run_id).await;
-
-        // Update scan run status
-        match &result {
-            Ok(count) => {
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! {
-                            "$set": {
-                                "status": "completed",
-                                "current_phase": "completed",
-                                "new_findings_count": *count as i64,
-                                "completed_at": mongodb::bson::DateTime::now(),
-                            }
-                        },
-                    )
-                    .await?;
-            }
-            Err(e) => {
-                tracing::error!(repo_id, error = %e, "Scan pipeline failed");
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! {
-                            "$set": {
-                                "status": "failed",
-                                "error_message": e.to_string(),
-                                "completed_at": mongodb::bson::DateTime::now(),
-                            }
-                        },
-                    )
-                    .await?;
-            }
-        }
-
-        result.map(|_| ())
-    }
-
     #[tracing::instrument(skip_all, fields(repo_id = repo.name.as_str()))]
-    async fn run_pipeline(
-        &self,
-        repo: &TrackedRepository,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
+    async fn run_pipeline(&self, repo: &RepoView, scan_run_id: &str) -> Result<u32, AgentError> {
         let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
 
         // Stage 0: Change detection
@@ -129,7 +67,6 @@ impl PipelineOrchestrator {
             return Ok(0);
         }
 
-        let current_sha = GitOps::get_head_sha(&repo_path)?;
         let mut all_findings: Vec<Finding> = Vec::new();
 
         // Stage 1: Semgrep SAST
@@ -395,20 +332,9 @@ impl PipelineOrchestrator {
             tracing::warn!("[{repo_id}] Issue creation failed: {e}");
         }
 
-        // Stage 7: Update repository
-        self.db
-            .repositories()
-            .update_one(
-                doc! { "_id": repo.id },
-                doc! {
-                    "$set": {
-                        "last_scanned_commit": &current_sha,
-                        "updated_at": mongodb::bson::DateTime::now(),
-                    },
-                    "$inc": { "findings_count": new_count as i64 },
-                },
-            )
-            .await?;
+        // The onboarded target's findings_count and the git artifact's
+        // last_scanned_commit watermark are persisted by `finalize_target` after
+        // `run_pipeline` returns.
 
         // Stage 8: DAST (async, optional — only if a DastTarget is configured)
         tracing::info!("[{repo_id}] Stage 8: Checking for DAST targets");
@@ -419,6 +345,320 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
+    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
+    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
+    /// `onboarded_targets` and dispatches by the scan plan.
+    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
+    pub async fn run_target(
+        &self,
+        target_id: &str,
+        trigger: ScanTrigger,
+    ) -> Result<(), AgentError> {
+        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
+            .map_err(|e| AgentError::Other(e.to_string()))?;
+        let target = self
+            .db
+            .onboarded_targets()
+            .find_one(doc! { "_id": oid })
+            .await?
+            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
+
+        let scan_run = ScanRun::new(target_id.to_string(), trigger);
+        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
+        let scan_run_id = insert
+            .inserted_id
+            .as_object_id()
+            .map(|id| id.to_hex())
+            .unwrap_or_default();
+
+        let result = self.run_target_pipeline(&target, &scan_run_id).await;
+        match &result {
+            Ok(count) => {
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "completed",
+                            "current_phase": "completed",
+                            "new_findings_count": *count as i64,
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+                // Refresh the target's cached findings count. The shared pipeline
+                // (Stage 7) increments `repositories`, which the unified path does
+                // not use, so set the accurate total on the target itself.
+                let total = self
+                    .db
+                    .findings()
+                    .count_documents(doc! { "repo_id": target_id })
+                    .await
+                    .unwrap_or(*count as u64);
+                self.db
+                    .onboarded_targets()
+                    .update_one(
+                        doc! { "_id": oid },
+                        doc! { "$set": {
+                            "findings_count": total as i64,
+                            "updated_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+            Err(e) => {
+                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! { "$set": {
+                            "status": "failed",
+                            "error_message": e.to_string(),
+                            "completed_at": mongodb::bson::DateTime::now(),
+                        } },
+                    )
+                    .await?;
+            }
+        }
+        result.map(|_| ())
+    }
+
+    /// Run the applicable scans for a target. For a code target this reuses the
+    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
+    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
+    /// follow-ups (#128/#129/#130). Returns the number of new findings.
+    async fn run_target_pipeline(
+        &self,
+        target: &OnboardedTarget,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
+        let plan = build_scan_plan(target);
+        tracing::info!(
+            target_id = %target_id,
+            target_type = %target.target_type,
+            planned_steps = plan.steps.len(),
+            "Unified pipeline: scan plan built"
+        );
+
+        // Ingest + classify (tramiton for firmware) and store the detected type.
+        self.classify_and_store(target, &target_id, scan_run_id)
+            .await;
+        // Provision a DAST target from a LiveUrl artifact so DAST fires for
+        // wizard-created targets, not just migrated ones.
+        self.ensure_dast_target(target, &plan).await;
+
+        match target.code_artifact() {
+            Some(code) if code.kind == ArtifactKind::GitRepo => {
+                let repo = RepoView::from_target(target, code);
+                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
+                self.finalize_target(target, &repo, new_count).await?;
+                Ok(new_count)
+            }
+            Some(_) => {
+                tracing::warn!(
+                    target_id = %target_id,
+                    "Unified pipeline: source-archive scanning not yet wired; skipping"
+                );
+                Ok(0)
+            }
+            None => {
+                // No code to scan. Firmware/PLC/mobile static scanners land in
+                // #128/#129/#130; DAST for a running URL still works when a
+                // DastTarget row exists (migrated targets).
+                tracing::info!(
+                    target_id = %target_id,
+                    "Unified pipeline: no code artifact; attempting DAST only"
+                );
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+                Ok(0)
+            }
+        }
+    }
+
+    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
+    /// heuristics otherwise), and store the detected classification on the target.
+    /// Best-effort — never fails the scan.
+    async fn classify_and_store(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) {
+        self.update_phase(scan_run_id, "classification").await;
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = match crate::ingest::ingest_all(target, &ctx) {
+            Ok(set) => set,
+            Err(e) => {
+                tracing::warn!(target_id, error = %e, "Unified pipeline: ingest for classification failed");
+                return;
+            }
+        };
+        let working_paths = ingest_set.working_paths();
+        match crate::classify::classify_target(
+            target,
+            &working_paths,
+            &crate::classify::TramitonNative,
+        )
+        .await
+        {
+            Ok(classification) => {
+                tracing::info!(
+                    target_id,
+                    suggested = %classification.suggested,
+                    "Unified pipeline: classified target"
+                );
+                if let (Some(oid), Ok(bson)) = (target.id, mongodb::bson::to_bson(&classification))
+                {
+                    let _ = self
+                        .db
+                        .onboarded_targets()
+                        .update_one(
+                            doc! { "_id": oid },
+                            doc! { "$set": { "classification": bson } },
+                        )
+                        .await;
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
+            }
+        }
+
+        // Analysis-based firmware SBOM: for embedded targets, derive components
+        // (resolved libraries + cross-toolchain) from tramiton's build-plan
+        // analysis over the already-ingested source — no build, no binary
+        // upload. Best-effort; empty when no build plan forms.
+        if crate::pipeline::firmware_sbom::is_firmware_target(target.target_type) {
+            if let Some(code) = target.code_artifact() {
+                if let Some(path) = working_paths.get(&code.id) {
+                    let entries =
+                        crate::pipeline::firmware_sbom::firmware_sbom_entries(path, target_id)
+                            .await;
+                    if !entries.is_empty() {
+                        let _ = self
+                            .db
+                            .sbom_entries()
+                            .delete_many(doc! { "repo_id": target_id })
+                            .await;
+                        for entry in &entries {
+                            let filter = doc! {
+                                "repo_id": &entry.repo_id,
+                                "name": &entry.name,
+                                "version": &entry.version,
+                            };
+                            if let Ok(d) = mongodb::bson::to_document(entry) {
+                                let _ = self
+                                    .db
+                                    .sbom_entries()
+                                    .update_one(filter, doc! { "$set": d })
+                                    .upsert(true)
+                                    .await;
+                            }
+                        }
+                        tracing::info!(
+                            target_id,
+                            count = entries.len(),
+                            "Firmware SBOM: stored components from tramiton analysis"
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
+    /// `DastTarget` (keyed by `repo_id` = target id) so the existing DAST trigger
+    /// fires for wizard-created targets. Idempotent.
+    async fn ensure_dast_target(
+        &self,
+        target: &OnboardedTarget,
+        plan: &crate::pipeline::plan::ScanPlan,
+    ) {
+        if !plan.has(ScanType::Dast) {
+            return;
+        }
+        let (Some(url), Some(oid)) = (target.live_url(), target.id) else {
+            return;
+        };
+        let target_id = oid.to_hex();
+        if self
+            .db
+            .dast_targets()
+            .find_one(doc! { "repo_id": &target_id })
+            .await
+            .ok()
+            .flatten()
+            .is_some()
+        {
+            return; // already provisioned
+        }
+        let kind = url
+            .web
+            .as_ref()
+            .map(|w| w.target_kind.clone())
+            .unwrap_or(DastTargetType::WebApp);
+        let mut dast = DastTarget::new(target.name.clone(), url.source_ref.clone(), kind);
+        dast.repo_id = Some(target_id);
+        if let Some(web) = &url.web {
+            dast.excluded_paths = web.excluded_paths.clone();
+            dast.max_crawl_depth = web.max_crawl_depth;
+            dast.rate_limit = web.rate_limit;
+            dast.allow_destructive = web.allow_destructive;
+        }
+        if let Some(auth) = &url.auth {
+            dast.auth_config = Some(DastAuthConfig {
+                method: auth.method.clone(),
+                login_url: auth.login_url.clone(),
+                username: auth.username.clone(),
+                password: None,
+                token: auth.secret.clone(),
+                headers: auth.headers.clone(),
+            });
+        }
+        if let Err(e) = self.db.dast_targets().insert_one(&dast).await {
+            tracing::warn!(error = %e, "Unified pipeline: failed to provision DAST target");
+        }
+    }
+
+    /// Sync the onboarded-target document after a scan: bump `findings_count`
+    /// and advance the git artifact's `last_scanned_commit` watermark.
+    async fn finalize_target(
+        &self,
+        target: &OnboardedTarget,
+        repo: &RepoView,
+        new_count: u32,
+    ) -> Result<(), AgentError> {
+        let oid = match target.id {
+            Some(id) => id,
+            None => return Ok(()),
+        };
+        self.db
+            .onboarded_targets()
+            .update_one(
+                doc! { "_id": oid },
+                doc! {
+                    "$inc": { "findings_count": new_count as i64 },
+                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
+                },
+            )
+            .await?;
+
+        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
+        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
+            self.db
+                .onboarded_targets()
+                .update_one(
+                    doc! { "_id": oid, "artifacts.id": &code.id },
+                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
+                )
+                .await?;
+        }
+        Ok(())
+    }
+
     pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
             let _ = self
@@ -460,3 +700,50 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
         None
     }
 }
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{
+        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
+    };
+
+    #[test]
+    fn repo_view_preserves_id_git_auth_and_tracker() {
+        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
+        target.id = Some(mongodb::bson::oid::ObjectId::new());
+        target.findings_count = 3;
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: Some(TrackerType::Gitea),
+            owner: Some("acme".to_string()),
+            repo: Some("web".to_string()),
+            token: Some("tt".to_string()),
+        });
+
+        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
+        if let Some(git) = artifact.git.as_mut() {
+            git.last_scanned_commit = Some("abc123".to_string());
+        }
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        target.artifacts.push(artifact);
+
+        let code = target.code_artifact().expect("code artifact");
+        let repo = RepoView::from_target(&target, code);
+
+        assert_eq!(repo.id, target.id); // preserved
+        assert_eq!(repo.git_url, "https://git/acme.git");
+        assert_eq!(repo.default_branch, "develop");
+        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
+        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
+        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
+        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
+        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
+        assert_eq!(repo.findings_count, 3);
+    }
+}

compliance-agent/src/pipeline/plan.rs

@@ -0,0 +1,195 @@
+//! The scan plan.
+//!
+//! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
+//! list of scans to run, each bound to the artifact it consumes. It intersects
+//! the scan-applicability matrix ([`applicable_scans`]) with the target's
+//! `scan_config` overrides: a scan runs when its required artifact is present and
+//! it is either on by default or explicitly enabled, and is not explicitly
+//! disabled. This is the decision engine the unified pipeline (`run_target`)
+//! executes.
+
+use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
+use compliance_core::scan_matrix::applicable_scans;
+
+/// One scan to run, bound to the artifact it operates on.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ScanStep {
+    /// The scan to run.
+    pub scan_type: ScanType,
+    /// The pipeline phase to report while it runs.
+    pub phase: ScanPhase,
+    /// The id of the artifact this scan consumes ([`Artifact::id`]).
+    pub artifact_id: String,
+}
+
+/// The ordered set of scans to run for a target.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct ScanPlan {
+    /// The scans, in matrix order.
+    pub steps: Vec<ScanStep>,
+}
+
+impl ScanPlan {
+    /// Whether the plan contains a step for the given scan type.
+    pub fn has(&self, scan: ScanType) -> bool {
+        self.steps.iter().any(|s| s.scan_type == scan)
+    }
+
+    /// Whether the plan is empty (nothing to run).
+    pub fn is_empty(&self) -> bool {
+        self.steps.is_empty()
+    }
+}
+
+/// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
+/// bound to the artifact it consumes. Scans whose required artifact is absent, or
+/// that are disabled, or off-by-default and not explicitly enabled, are dropped.
+pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
+    let enabled = &target.scan_config.enabled_scans;
+    let disabled = &target.scan_config.disabled_scans;
+
+    let mut steps = Vec::new();
+    for option in applicable_scans(target) {
+        // Required artifact missing → not runnable.
+        if option.blocked_reason.is_some() {
+            continue;
+        }
+        // Explicit opt-out wins.
+        if disabled.contains(&option.scan) {
+            continue;
+        }
+        // Run if on by default, or explicitly enabled.
+        if !option.default_on && !enabled.contains(&option.scan) {
+            continue;
+        }
+        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
+            continue;
+        };
+        steps.push(ScanStep {
+            scan_type: option.scan,
+            phase: phase_for(option.scan),
+            artifact_id: artifact.id.clone(),
+        });
+    }
+    ScanPlan { steps }
+}
+
+/// Resolve the artifact a scan consumes. A "code" requirement (represented by
+/// `GitRepo`) is satisfied by a git repo *or* a source archive.
+fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
+    match required {
+        Some(ArtifactKind::GitRepo) => target.code_artifact(),
+        Some(kind) => target.first_of(kind),
+        None => target.code_artifact().or_else(|| target.artifacts.first()),
+    }
+}
+
+/// The pipeline phase reported while a given scan runs.
+fn phase_for(scan: ScanType) -> ScanPhase {
+    match scan {
+        ScanType::Sast => ScanPhase::Sast,
+        ScanType::Sbom => ScanPhase::SbomGeneration,
+        ScanType::Cve => ScanPhase::CveScanning,
+        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
+        ScanType::SecretDetection => ScanPhase::SecretDetection,
+        ScanType::Lint => ScanPhase::LintScanning,
+        ScanType::CodeReview => ScanPhase::CodeReview,
+        ScanType::Graph => ScanPhase::GraphBuilding,
+        ScanType::Dast => ScanPhase::DastScanning,
+        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
+        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
+        ScanType::MobileStatic => ScanPhase::MobileStatic,
+        ScanType::ContainerScan => ScanPhase::ContainerScan,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{PlcFormat, TargetType};
+
+    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("t".to_string(), target_type);
+        t.artifacts = artifacts;
+        t
+    }
+
+    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
+        plan.steps.iter().find(|s| s.scan_type == scan)
+    }
+
+    #[test]
+    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
+        let code = Artifact::git_repo("https://git/x", "main");
+        let url = Artifact::live_url("https://x");
+        let (code_id, url_id) = (code.id.clone(), url.id.clone());
+        let t = target(TargetType::WebApp, vec![code, url]);
+
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, code_id);
+        assert_eq!(sast.phase, ScanPhase::Sast);
+        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
+        assert_eq!(dast.artifact_id, url_id);
+    }
+
+    #[test]
+    fn webapp_without_url_omits_dast() {
+        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.has(ScanType::Sast));
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn code_scan_binds_to_source_archive_when_no_git_repo() {
+        let arc = Artifact::source_archive("src.zip");
+        let arc_id = arc.id.clone();
+        let t = target(TargetType::BackendService, vec![arc]);
+        let plan = build_scan_plan(&t);
+        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
+        assert_eq!(sast.artifact_id, arc_id);
+    }
+
+    #[test]
+    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
+        let fw = Artifact::firmware_image("fw.bin");
+        let fw_id = fw.id.clone();
+        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
+        let plan = build_scan_plan(&t);
+        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
+        assert_eq!(sbom.artifact_id, fw_id);
+        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
+        assert!(!plan.has(ScanType::Dast));
+    }
+
+    #[test]
+    fn plc_plans_only_control_logic() {
+        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
+        let t = target(TargetType::PlcSps, vec![plc]);
+        let plan = build_scan_plan(&t);
+        assert_eq!(plan.steps.len(), 1);
+        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
+        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
+    }
+
+    #[test]
+    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
+        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        t.scan_config.disabled_scans = vec![ScanType::Lint];
+        // CodeReview is off by default for web; enable it explicitly.
+        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
+        let plan = build_scan_plan(&t);
+        assert!(!plan.has(ScanType::Lint));
+        assert!(plan.has(ScanType::CodeReview));
+        assert!(plan.has(ScanType::Sast));
+    }
+
+    #[test]
+    fn no_code_artifact_yields_empty_plan_for_web() {
+        let t = target(TargetType::WebApp, vec![]);
+        let plan = build_scan_plan(&t);
+        assert!(plan.is_empty());
+    }
+}

compliance-agent/src/pipeline/pr_review.rs

@@ -1,3 +1,4 @@
+use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;
 
 use super::dedup::compute_fingerprint;
@@ -14,7 +15,7 @@ impl PipelineOrchestrator {
     #[tracing::instrument(skip_all, fields(repo_id = %repo_id, pr_number))]
     pub async fn run_pr_review(
         &self,
-        repo: &TrackedRepository,
+        repo: &RepoView,
         repo_id: &str,
         pr_number: u64,
         base_sha: &str,

compliance-agent/src/pipeline/repo_view.rs

@@ -0,0 +1,74 @@
+//! `RepoView` — an internal, non-persisted view of a code target for the scan
+//! pipeline.
+//!
+//! It replaces the old persisted `TrackedRepository` model. The pipeline
+//! (SAST → SBOM → CVE → triage → issues → DAST, and PR review) only ever needs a
+//! flat bundle of git + issue-tracker + auth fields; those are projected from an
+//! [`OnboardedTarget`] and its code [`Artifact`] by [`RepoView::from_target`].
+//! Nothing here is written to Mongo — onboarded targets are the sole persisted
+//! entity.
+
+use compliance_core::models::{Artifact, OnboardedTarget, TrackerType};
+
+/// A flat, pipeline-facing view of a code target. Built from an onboarded
+/// target; never persisted.
+#[derive(Debug, Clone)]
+pub struct RepoView {
+    /// The onboarded target's id (used as `repo_id` across findings/sbom/etc.).
+    pub id: Option<mongodb::bson::oid::ObjectId>,
+    pub name: String,
+    pub git_url: String,
+    pub default_branch: String,
+    pub local_path: Option<String>,
+    pub scan_schedule: Option<String>,
+    pub webhook_enabled: bool,
+    pub webhook_secret: Option<String>,
+    pub tracker_type: Option<TrackerType>,
+    pub tracker_owner: Option<String>,
+    pub tracker_repo: Option<String>,
+    pub tracker_token: Option<String>,
+    pub auth_token: Option<String>,
+    pub auth_username: Option<String>,
+    pub last_scanned_commit: Option<String>,
+    pub findings_count: u32,
+}
+
+impl RepoView {
+    /// Project an onboarded target + its code artifact into a pipeline view.
+    pub fn from_target(target: &OnboardedTarget, code: &Artifact) -> Self {
+        let mut view = Self {
+            id: target.id,
+            name: target.name.clone(),
+            git_url: code.source_ref.clone(),
+            default_branch: "main".to_string(),
+            local_path: None,
+            scan_schedule: target.scan_schedule.clone(),
+            webhook_enabled: target.webhook_enabled,
+            webhook_secret: target.webhook_secret.clone(),
+            tracker_type: None,
+            tracker_owner: None,
+            tracker_repo: None,
+            tracker_token: None,
+            auth_token: None,
+            auth_username: None,
+            last_scanned_commit: None,
+            findings_count: target.findings_count,
+        };
+        if let Some(git) = &code.git {
+            view.default_branch = git.default_branch.clone();
+            view.last_scanned_commit = git.last_scanned_commit.clone();
+            view.local_path = git.local_path.clone();
+        }
+        if let Some(auth) = &code.auth {
+            view.auth_token = auth.secret.clone();
+            view.auth_username = auth.username.clone();
+        }
+        if let Some(it) = &target.scan_config.issue_tracker {
+            view.tracker_type = it.tracker_type.clone();
+            view.tracker_owner = it.owner.clone();
+            view.tracker_repo = it.repo.clone();
+            view.tracker_token = it.token.clone();
+        }
+        view
+    }
+}

compliance-agent/src/scheduler.rs

@@ -288,25 +288,25 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
         None => return,
     };
 
-    let cursor = match db.repositories().find(doc! {}).await {
+    let cursor = match db.onboarded_targets().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list targets for tenant '{tenant_id}': {e}");
             return;
         }
     };
 
-    let repos: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+    let targets: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
 
-    for repo in repos {
-        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+    for target in targets {
+        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
         if let Err(e) = agent
-            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
+            .run_target_scan(tenant_id, &target_id, ScanTrigger::Scheduled)
             .await
         {
             tracing::error!(
                 "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                repo.name
+                target.name
             );
         }
     }
@@ -348,7 +348,7 @@ async fn monitor_cves(agent: &ComplianceAgent, tenant_id: &str) {
         std::collections::HashMap::new();
     for rid in &repo_ids {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(rid) {
-            if let Ok(Some(repo)) = db.repositories().find_one(doc! { "_id": oid }).await {
+            if let Ok(Some(repo)) = db.onboarded_targets().find_one(doc! { "_id": oid }).await {
                 repo_names.insert(rid.clone(), repo.name.clone());
             }
         }

compliance-agent/src/webhooks/gitea.rs

@@ -31,7 +31,7 @@ pub async fn handle_gitea_webhook(
         }
     };
     let repo = match db
-        .repositories()
+        .onboarded_targets()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {

compliance-agent/src/webhooks/github.rs

@@ -31,7 +31,7 @@ pub async fn handle_github_webhook(
         }
     };
     let repo = match db
-        .repositories()
+        .onboarded_targets()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {

compliance-agent/src/webhooks/gitlab.rs

@@ -27,7 +27,7 @@ pub async fn handle_gitlab_webhook(
         }
     };
     let repo = match db
-        .repositories()
+        .onboarded_targets()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {

compliance-agent/tests/common/mod.rs

@@ -25,8 +25,9 @@ impl TestServer {
         let mongodb_uri = std::env::var("TEST_MONGODB_URI")
             .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
 
-        // Unique database name per test run to avoid collisions
-        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
+        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
 
         let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await

compliance-agent/tests/integration/api/cascade_delete.rs

@@ -113,15 +113,16 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
     // Create a repo
     let resp = server
         .post(
-            "/api/v1/repositories",
+            "/api/v1/targets",
             &json!({
                 "name": "cascade-test",
-                "git_url": "https://github.com/example/cascade-test.git",
+                "target_type": "web_app",
+                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/cascade-test.git", "branch": "main" }],
             }),
         )
         .await;
     let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
 
     // Insert DAST target linked to repo
     let target_id = insert_dast_target(&server, &repo_id, "cascade-target").await;
@@ -140,9 +141,7 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
     assert_eq!(count_docs(&server, "dast_findings").await, 1);
 
     // Delete the repo
-    let resp = server
-        .delete(&format!("/api/v1/repositories/{repo_id}"))
-        .await;
+    let resp = server.delete(&format!("/api/v1/targets/{repo_id}")).await;
     assert_eq!(resp.status(), 200);
 
     // All downstream data should be gone
@@ -161,15 +160,16 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
     // Create a repo
     let resp = server
         .post(
-            "/api/v1/repositories",
+            "/api/v1/targets",
             &json!({
                 "name": "sast-cascade",
-                "git_url": "https://github.com/example/sast-cascade.git",
+                "target_type": "web_app",
+                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/sast-cascade.git", "branch": "main" }],
             }),
         )
         .await;
     let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
 
     // Insert SAST finding and SBOM entry
     let mongodb_uri = std::env::var("TEST_MONGODB_URI")
@@ -209,9 +209,7 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
     assert_eq!(count_docs(&server, "sbom_entries").await, 1);
 
     // Delete repo
-    server
-        .delete(&format!("/api/v1/repositories/{repo_id}"))
-        .await;
+    server.delete(&format!("/api/v1/targets/{repo_id}")).await;
 
     // Both should be gone
     assert_eq!(count_docs(&server, "findings").await, 0);

compliance-agent/tests/integration/api/mod.rs

@@ -2,5 +2,5 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
-mod repositories;
+mod onboarding;
 mod stats;

compliance-agent/tests/integration/api/onboarding.rs

@@ -0,0 +1,115 @@
+use crate::common::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn create_list_and_applicable_scans() {
+    let server = TestServer::start().await;
+
+    // Initially empty.
+    let resp = server.get("/api/v1/targets").await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Create a web-app target with a git repo + a live URL.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "acme-web",
+                "target_type": "web_app",
+                "artifacts": [
+                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
+                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
+                ]
+            }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    assert!(!id.is_empty());
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
+
+    // List returns it.
+    let resp = server.get("/api/v1/targets").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 1);
+
+    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
+    let resp = server
+        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let scans = body["data"]["scans"].as_array().unwrap();
+    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
+    assert!(names.contains(&"sast"));
+    assert!(names.contains(&"dast"));
+    assert_eq!(body["data"]["pentest_supported"], true);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn detect_classifies_a_plc_target() {
+    let server = TestServer::start().await;
+
+    // A PLC project artifact is a strong kind-based signal.
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({
+                "name": "line-controller",
+                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
+                "artifacts": [
+                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
+                ]
+            }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    let resp = server
+        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn add_artifact_and_delete_target() {
+    let server = TestServer::start().await;
+
+    let resp = server
+        .post(
+            "/api/v1/targets",
+            &json!({ "name": "svc", "target_type": "backend_service" }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+
+    // Attach a git repo.
+    let resp = server
+        .post(
+            &format!("/api/v1/targets/{id}/artifacts"),
+            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
+
+    // Delete it.
+    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 200);
+    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
+    assert_eq!(resp.status(), 404);
+
+    server.cleanup().await;
+}

compliance-agent/tests/integration/api/repositories.rs

@@ -1,110 +0,0 @@
-use crate::common::TestServer;
-use serde_json::json;
-
-#[tokio::test]
-async fn add_and_list_repository() {
-    let server = TestServer::start().await;
-
-    // Initially empty
-    let resp = server.get("/api/v1/repositories").await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    // Add a repository
-    let resp = server
-        .post(
-            "/api/v1/repositories",
-            &json!({
-                "name": "test-repo",
-                "git_url": "https://github.com/example/test-repo.git",
-            }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
-    assert!(!repo_id.is_empty());
-
-    // List should now return 1
-    let resp = server.get("/api/v1/repositories").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let repos = body["data"].as_array().unwrap();
-    assert_eq!(repos.len(), 1);
-    assert_eq!(repos[0]["name"], "test-repo");
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn add_duplicate_repository_fails() {
-    let server = TestServer::start().await;
-
-    let payload = json!({
-        "name": "dup-repo",
-        "git_url": "https://github.com/example/dup-repo.git",
-    });
-
-    // First add succeeds
-    let resp = server.post("/api/v1/repositories", &payload).await;
-    assert_eq!(resp.status(), 200);
-
-    // Second add with same git_url should fail (unique index)
-    let resp = server.post("/api/v1/repositories", &payload).await;
-    assert_ne!(resp.status(), 200);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn delete_repository() {
-    let server = TestServer::start().await;
-
-    // Add a repo
-    let resp = server
-        .post(
-            "/api/v1/repositories",
-            &json!({
-                "name": "to-delete",
-                "git_url": "https://github.com/example/to-delete.git",
-            }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["id"].as_str().unwrap();
-
-    // Delete it
-    let resp = server
-        .delete(&format!("/api/v1/repositories/{repo_id}"))
-        .await;
-    assert_eq!(resp.status(), 200);
-
-    // List should be empty again
-    let resp = server.get("/api/v1/repositories").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn delete_nonexistent_repository_returns_404() {
-    let server = TestServer::start().await;
-
-    let resp = server
-        .delete("/api/v1/repositories/000000000000000000000000")
-        .await;
-    assert_eq!(resp.status(), 404);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn delete_invalid_id_returns_400() {
-    let server = TestServer::start().await;
-
-    let resp = server.delete("/api/v1/repositories/not-a-valid-id").await;
-    assert_eq!(resp.status(), 400);
-
-    server.cleanup().await;
-}

compliance-agent/tests/integration/api/stats.rs

@@ -5,13 +5,14 @@ use serde_json::json;
 async fn stats_overview_reflects_inserted_data() {
     let server = TestServer::start().await;
 
-    // Add a repo
+    // Add a target
     server
         .post(
-            "/api/v1/repositories",
+            "/api/v1/targets",
             &json!({
                 "name": "stats-repo",
-                "git_url": "https://github.com/example/stats-repo.git",
+                "target_type": "web_app",
+                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/stats-repo.git", "branch": "main" }],
             }),
         )
         .await;

compliance-agent/tests/integration/migration.rs

@@ -1,156 +0,0 @@
-// Integration tests for the onboarding backfill migration.
-//
-// Requires MongoDB (set TEST_MONGODB_URI if not at the default).
-// Not run in CI (which is `--lib` only) — run locally:
-//   cargo test -p compliance-agent --test e2e migration
-
-use compliance_agent::database::{Database, DatabasePool};
-use compliance_agent::migrate::onboarding;
-use compliance_core::models::{
-    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
-};
-use mongodb::bson::{doc, Document};
-
-async fn fresh_db() -> (DatabasePool, String, Database) {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
-    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
-    let pool = DatabasePool::connect(&uri, &prefix)
-        .await
-        .expect("connect mongo");
-    let db = pool.for_tenant_id("t1").await.expect("tenant db");
-    (pool, prefix, db)
-}
-
-async fn cleanup(pool: &DatabasePool, prefix: &str) {
-    if let Ok(names) = pool.client().list_database_names().await {
-        for n in names {
-            if n.starts_with(prefix) {
-                pool.client().database(&n).drop().await.ok();
-            }
-        }
-    }
-}
-
-#[tokio::test]
-async fn backfill_folds_relinks_is_idempotent_and_reversible() {
-    let (pool, prefix, db) = fresh_db().await;
-
-    // Seed a repo.
-    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
-    let repo_id = db
-        .repositories()
-        .insert_one(repo)
-        .await
-        .expect("insert repo")
-        .inserted_id
-        .as_object_id()
-        .expect("repo oid");
-
-    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
-    let mut linked = DastTarget::new(
-        "acme-web".into(),
-        "https://acme.example.com".into(),
-        DastTargetType::WebApp,
-    );
-    linked.repo_id = Some(repo_id.to_hex());
-    let linked_id = db
-        .dast_targets()
-        .insert_one(linked)
-        .await
-        .expect("insert linked dast")
-        .inserted_id
-        .as_object_id()
-        .expect("linked oid");
-
-    // A repo-less DAST target (standalone).
-    let standalone = DastTarget::new(
-        "acme-api".into(),
-        "https://api.acme.com".into(),
-        DastTargetType::RestApi,
-    );
-    let standalone_id = db
-        .dast_targets()
-        .insert_one(standalone)
-        .await
-        .expect("insert standalone dast")
-        .inserted_id
-        .as_object_id()
-        .expect("standalone oid");
-
-    // A DAST scan run pointing at the linked target — should be relinked to the repo.
-    db.collection_named::<Document>("dast_scan_runs")
-        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
-        .await
-        .expect("insert dast run");
-
-    // --- Backfill ---
-    assert!(!onboarding::already_applied(&db).await.unwrap());
-    let report = onboarding::backfill_onboarded_targets(&db, false)
-        .await
-        .expect("backfill");
-    assert_eq!(report.repos_migrated, 1);
-    assert_eq!(report.dast_targets_folded, 1);
-    assert_eq!(report.dast_targets_standalone, 1);
-    assert!(onboarding::already_applied(&db).await.unwrap());
-
-    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
-    let repo_target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": repo_id })
-        .await
-        .unwrap()
-        .expect("repo target");
-    assert!(repo_target.has(ArtifactKind::GitRepo));
-    assert!(repo_target.has(ArtifactKind::LiveUrl));
-    assert_eq!(repo_target.target_type, TargetType::WebApp);
-
-    // Standalone target: preserved _id, live-url, backend service.
-    let standalone_target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": standalone_id })
-        .await
-        .unwrap()
-        .expect("standalone target");
-    assert!(standalone_target.has(ArtifactKind::LiveUrl));
-    assert_eq!(standalone_target.target_type, TargetType::BackendService);
-
-    // The DAST run was relinked from the old dast id to the repo (unified) id.
-    let run = db
-        .collection_named::<Document>("dast_scan_runs")
-        .find_one(doc! {})
-        .await
-        .unwrap()
-        .expect("run");
-    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
-
-    // --- Idempotent: re-run migrates nothing new ---
-    let again = onboarding::backfill_onboarded_targets(&db, false)
-        .await
-        .expect("backfill again");
-    assert_eq!(again.repos_migrated, 0);
-    assert_eq!(again.dast_targets_folded, 0);
-    assert_eq!(again.dast_targets_standalone, 0);
-    assert!(again.skipped_existing >= 2);
-
-    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
-    onboarding::revert(&db).await.expect("revert");
-    assert_eq!(
-        db.onboarded_targets()
-            .count_documents(doc! {})
-            .await
-            .unwrap(),
-        0
-    );
-    let run_after = db
-        .collection_named::<Document>("dast_scan_runs")
-        .find_one(doc! {})
-        .await
-        .unwrap()
-        .expect("run");
-    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
-    assert!(!onboarding::already_applied(&db).await.unwrap());
-
-    cleanup(&pool, &prefix).await;
-}

compliance-agent/tests/integration/mod.rs

@@ -7,4 +7,3 @@
 // Or nightly: (via CI with MongoDB service container)
 
 mod api;
-mod migration;

compliance-agent/tests/tenant_isolation.rs

@@ -11,7 +11,7 @@
 #![allow(clippy::expect_used, clippy::unwrap_used)]
 
 use compliance_agent::database::DatabasePool;
-use compliance_core::models::TrackedRepository;
+use compliance_core::models::{Artifact, OnboardedTarget, TargetType};
 use compliance_core::{OrgRole, TenantContext, TenantStatus};
 use mongodb::bson::doc;
 
@@ -28,27 +28,12 @@ fn ctx(tenant_id: &str, slug: &str) -> TenantContext {
     }
 }
 
-fn fixture_repo(name: &str, git_url: &str) -> TrackedRepository {
-    TrackedRepository {
-        id: None,
-        name: name.to_string(),
-        git_url: git_url.to_string(),
-        default_branch: "main".to_string(),
-        local_path: None,
-        scan_schedule: None,
-        webhook_enabled: false,
-        webhook_secret: None,
-        tracker_type: None,
-        tracker_owner: None,
-        tracker_repo: None,
-        tracker_token: None,
-        auth_token: None,
-        auth_username: None,
-        last_scanned_commit: None,
-        findings_count: 0,
-        created_at: chrono::Utc::now(),
-        updated_at: chrono::Utc::now(),
-    }
+fn fixture_repo(name: &str, git_url: &str) -> OnboardedTarget {
+    let mut target = OnboardedTarget::new(name.to_string(), TargetType::WebApp);
+    target
+        .artifacts
+        .push(Artifact::git_repo(git_url.to_string(), "main".to_string()));
+    target
 }
 
 #[tokio::test]
@@ -71,12 +56,12 @@ async fn pool_isolates_tenants_at_driver_level() {
 
     // Write distinct repos into each tenant's database.
     acme_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
         .await
         .expect("insert acme");
     globex_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo(
             "globex-platform",
             "git@example.com:globex/platform.git",
@@ -173,12 +158,12 @@ async fn admin_helpers_list_and_drop_tenant_dbs() {
     let acme_db = pool.for_tenant(&acme).await.expect("acme db");
     let globex_db = pool.for_tenant(&globex).await.expect("globex db");
     acme_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
         .await
         .expect("insert acme");
     globex_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo("globex-app", "git@example.com:globex/app.git"))
         .await
         .expect("insert globex");
@@ -284,9 +269,9 @@ fn short_id() -> String {
 }
 
 /// Drain a `repositories` find cursor on the given tenant database.
-async fn collect(db: &compliance_agent::database::Database) -> Vec<TrackedRepository> {
+async fn collect(db: &compliance_agent::database::Database) -> Vec<OnboardedTarget> {
     let mut cursor = db
-        .repositories()
+        .onboarded_targets()
         .find(doc! {})
         .await
         .expect("find repositories");

compliance-core/src/models/mod.rs

@@ -44,6 +44,6 @@ pub use pentest::{
     PentestStatus, PentestStrategy, SeverityDistribution, TestUserRecord, TesterInfo,
     ToolCallRecord,
 };
-pub use repository::{ScanTrigger, TrackedRepository};
+pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};

compliance-core/src/models/repository.rs

@@ -1,8 +1,6 @@
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Deserializer, Serialize};
-
-use super::issue::TrackerType;
+use serde::{Deserialize, Serialize};
 
+/// What initiated a scan.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum ScanTrigger {
@@ -10,92 +8,3 @@ pub enum ScanTrigger {
     Webhook,
     Manual,
 }
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TrackedRepository {
-    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
-    pub id: Option<bson::oid::ObjectId>,
-    #[serde(default)]
-    pub name: String,
-    #[serde(default)]
-    pub git_url: String,
-    #[serde(default = "default_branch")]
-    pub default_branch: String,
-    pub local_path: Option<String>,
-    pub scan_schedule: Option<String>,
-    #[serde(default)]
-    pub webhook_enabled: bool,
-    /// Auto-generated HMAC secret for verifying incoming webhooks
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub webhook_secret: Option<String>,
-    pub tracker_type: Option<TrackerType>,
-    pub tracker_owner: Option<String>,
-    pub tracker_repo: Option<String>,
-    /// Optional per-repo PAT for the issue tracker (GitHub/GitLab/Jira)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub tracker_token: Option<String>,
-    /// Optional auth token for HTTPS private repos (PAT or password)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_token: Option<String>,
-    /// Optional username for HTTPS auth (defaults to "x-access-token" for PATs)
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auth_username: Option<String>,
-    pub last_scanned_commit: Option<String>,
-    #[serde(default, deserialize_with = "deserialize_findings_count")]
-    pub findings_count: u32,
-    #[serde(
-        default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
-    )]
-    pub created_at: DateTime<Utc>,
-    #[serde(
-        default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
-    )]
-    pub updated_at: DateTime<Utc>,
-}
-
-fn default_branch() -> String {
-    "main".to_string()
-}
-
-fn deserialize_findings_count<'de, D>(deserializer: D) -> Result<u32, D::Error>
-where
-    D: Deserializer<'de>,
-{
-    let bson = bson::Bson::deserialize(deserializer)?;
-    match &bson {
-        bson::Bson::Int32(n) => Ok(*n as u32),
-        bson::Bson::Int64(n) => Ok(*n as u32),
-        bson::Bson::Double(n) => Ok(*n as u32),
-        _ => Ok(0),
-    }
-}
-
-impl TrackedRepository {
-    pub fn new(name: String, git_url: String) -> Self {
-        let now = Utc::now();
-        // Generate a random webhook secret (hex-encoded UUID v4, no dashes)
-        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
-        Self {
-            id: None,
-            name,
-            git_url,
-            default_branch: "main".to_string(),
-            local_path: None,
-            scan_schedule: None,
-            auth_token: None,
-            auth_username: None,
-            webhook_enabled: false,
-            webhook_secret: Some(webhook_secret),
-            tracker_type: None,
-            tracker_owner: None,
-            tracker_repo: None,
-            tracker_token: None,
-            last_scanned_commit: None,
-            findings_count: 0,
-            created_at: now,
-            updated_at: now,
-        }
-    }
-}

compliance-dashboard/src/app.rs

@@ -10,8 +10,8 @@ pub enum Route {
     #[layout(AppShell)]
         #[route("/")]
         OverviewPage {},
-        #[route("/repositories")]
-        RepositoriesPage {},
+        #[route("/targets")]
+        TargetsPage {},
         #[route("/onboard")]
         OnboardingPage {},
         #[route("/findings")]

compliance-dashboard/src/components/pentest_wizard.rs

@@ -4,8 +4,9 @@ use dioxus_free_icons::Icon;
 
 use crate::app::Route;
 use crate::infrastructure::dast::fetch_dast_targets;
+use crate::infrastructure::onboarding::fetch_targets;
 use crate::infrastructure::pentest::{create_pentest_session_wizard, lookup_repo_by_url};
-use crate::infrastructure::repositories::{fetch_repositories, fetch_ssh_public_key};
+use crate::infrastructure::repositories::fetch_ssh_public_key;
 
 const DISCLAIMER_TEXT: &str = "I confirm that I have authorization to perform security testing \
 against the specified target. I understand that penetration testing may cause disruption to the \
@@ -39,7 +40,7 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
     let mut show_target_dropdown = use_signal(|| false);
     let mut show_repo_dropdown = use_signal(|| false);
     let existing_targets = use_resource(|| async { fetch_dast_targets().await.ok() });
-    let existing_repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let existing_repos = use_resource(|| async { fetch_targets().await.ok() });
 
     // SSH key state for private repos
     let mut ssh_public_key = use_signal(String::new);
@@ -211,7 +212,25 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
             Some(Some(data)) => data
                 .data
                 .iter()
-                .map(|r| (r.git_url.clone(), r.name.clone()))
+                .filter_map(|t| {
+                    let name = t
+                        .get("name")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or_default()
+                        .to_string();
+                    let git_url = t
+                        .get("artifacts")
+                        .and_then(|a| a.as_array())
+                        .and_then(|arr| {
+                            arr.iter().find(|a| {
+                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
+                            })
+                        })
+                        .and_then(|a| a.get("source_ref"))
+                        .and_then(|s| s.as_str())?
+                        .to_string();
+                    Some((git_url, name))
+                })
                 .collect(),
             _ => Vec::new(),
         }

compliance-dashboard/src/components/sidebar.rs

@@ -24,8 +24,8 @@ pub fn Sidebar() -> Element {
             icon: rsx! { Icon { icon: BsSpeedometer2, width: 18, height: 18 } },
         },
         NavItem {
-            label: "Repositories",
-            route: Route::RepositoriesPage {},
+            label: "Targets",
+            route: Route::TargetsPage {},
             icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
         },
         NavItem {

compliance-dashboard/src/infrastructure/database.rs

@@ -19,10 +19,6 @@ impl Database {
         Ok(Self { inner: db })
     }
 
-    pub fn repositories(&self) -> Collection<TrackedRepository> {
-        self.inner.collection("repositories")
-    }
-
     pub fn findings(&self) -> Collection<Finding> {
         self.inner.collection("findings")
     }

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -39,6 +39,59 @@ pub struct ApplicableScansResponse {
     pub data: ApplicableScansData,
 }
 
+/// Validate a target name. The name is used as the clone directory downstream,
+/// so it must be a single safe segment (no slashes) and free of stray spaces.
+pub fn validate_target_name(name: &str) -> Option<String> {
+    let n = name.trim();
+    if n.is_empty() {
+        return Some("Enter a name".to_string());
+    }
+    if name != n {
+        return Some("Remove the leading/trailing spaces".to_string());
+    }
+    if n.contains('/') || n.contains('\\') {
+        return Some("No slashes — the name becomes a folder (e.g. stm32f411-blinky)".to_string());
+    }
+    None
+}
+
+/// Client-side validation of an artifact reference for its kind. Returns an
+/// error message when the value is obviously wrong for its category, so the
+/// wizard / editor can flag it up front instead of the scan discovering it.
+pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
+    let s = source_ref;
+    if s.trim().is_empty() {
+        return Some("Cannot be empty".to_string());
+    }
+    if s != s.trim() {
+        return Some("Remove the leading/trailing spaces".to_string());
+    }
+    let no_space = !s.contains(char::is_whitespace);
+    match kind {
+        "git_repo" => {
+            let looks_git = s.starts_with("https://")
+                || s.starts_with("http://")
+                || s.starts_with("ssh://")
+                || s.starts_with("git://")
+                || (s.contains('@') && s.contains(':'));
+            (!(looks_git && no_space))
+                .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
+        }
+        "live_url" => {
+            let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
+            (!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
+        }
+        "container_image" => {
+            (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
+        }
+        "source_archive" | "firmware_image" | "mobile_package" | "plc_project" => {
+            (!no_space).then(|| "Enter a path or URL (no spaces)".to_string())
+        }
+        // plaintext_description (and anything unknown): accept free-form text.
+        _ => None,
+    }
+}
+
 /// List onboarded targets.
 #[server]
 pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
@@ -77,6 +130,41 @@ pub async fn create_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
+/// Update a target's name / type / artifacts (dashboard editor).
+#[server]
+pub async fn update_target(
+    id: String,
+    name: Option<String>,
+    target_type: Option<String>,
+    artifacts: Option<Vec<ArtifactInputDto>>,
+) -> Result<TargetResponse, ServerFnError> {
+    let mut body = serde_json::Map::new();
+    if let Some(n) = name {
+        body.insert("name".to_string(), serde_json::json!(n));
+    }
+    if let Some(t) = target_type {
+        body.insert("target_type".to_string(), serde_json::json!(t));
+    }
+    if let Some(a) = artifacts {
+        body.insert(
+            "artifacts".to_string(),
+            serde_json::to_value(a).map_err(|e| ServerFnError::new(e.to_string()))?,
+        );
+    }
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::PATCH,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .json(&serde_json::Value::Object(body))
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
 /// Run kind-based classification on a target.
 #[server]
 pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
@@ -105,3 +193,35 @@ pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansRespons
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
+
+/// Delete a target (and cascade its findings / SBOM / scan runs / CVE alerts).
+#[server]
+pub async fn delete_target(id: String) -> Result<serde_json::Value, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::DELETE,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Trigger a scan for a target.
+#[server]
+pub async fn trigger_target_scan(id: String) -> Result<serde_json::Value, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/scan"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}

compliance-dashboard/src/infrastructure/repositories.rs

@@ -1,145 +1,10 @@
+//! The agent's SSH deploy public key — shown so a read-only deploy key can be
+//! added to private git targets. (The legacy repositories CRUD moved to the
+//! unified onboarding/targets API.)
+
 use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::TrackedRepository;
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct RepositoryListResponse {
-    pub data: Vec<TrackedRepository>,
-    pub total: Option<u64>,
-    pub page: Option<u64>,
-}
-
-#[server]
-pub async fn fetch_repositories(page: u64) -> Result<RepositoryListResponse, ServerFnError> {
-    let path = format!("/api/v1/repositories?page={page}&limit=20");
-    let resp = super::agent_client::agent_get(&path)
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: RepositoryListResponse = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    Ok(body)
-}
-
-#[server]
-pub async fn add_repository(
-    name: String,
-    git_url: String,
-    default_branch: String,
-    auth_token: Option<String>,
-    auth_username: Option<String>,
-    tracker_type: Option<String>,
-    tracker_owner: Option<String>,
-    tracker_repo: Option<String>,
-    tracker_token: Option<String>,
-) -> Result<(), ServerFnError> {
-    let mut body = serde_json::json!({
-        "name": name,
-        "git_url": git_url,
-        "default_branch": default_branch,
-    });
-    if let Some(token) = auth_token.filter(|t| !t.is_empty()) {
-        body["auth_token"] = serde_json::Value::String(token);
-    }
-    if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
-        body["auth_username"] = serde_json::Value::String(username);
-    }
-    if let Some(tt) = tracker_type.filter(|t| !t.is_empty()) {
-        body["tracker_type"] = serde_json::Value::String(tt);
-    }
-    if let Some(to) = tracker_owner.filter(|t| !t.is_empty()) {
-        body["tracker_owner"] = serde_json::Value::String(to);
-    }
-    if let Some(tr) = tracker_repo.filter(|t| !t.is_empty()) {
-        body["tracker_repo"] = serde_json::Value::String(tr);
-    }
-    if let Some(tk) = tracker_token.filter(|t| !t.is_empty()) {
-        body["tracker_token"] = serde_json::Value::String(tk);
-    }
-
-    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/repositories")
-        .await?
-        .json(&body)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to add repository: {body}"
-        )));
-    }
-
-    Ok(())
-}
-
-#[server]
-pub async fn update_repository(
-    repo_id: String,
-    name: Option<String>,
-    default_branch: Option<String>,
-    auth_token: Option<String>,
-    auth_username: Option<String>,
-    tracker_type: Option<String>,
-    tracker_owner: Option<String>,
-    tracker_repo: Option<String>,
-    tracker_token: Option<String>,
-    scan_schedule: Option<String>,
-) -> Result<(), ServerFnError> {
-    let mut body = serde_json::Map::new();
-    if let Some(v) = name.filter(|s| !s.is_empty()) {
-        body.insert("name".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = default_branch.filter(|s| !s.is_empty()) {
-        body.insert("default_branch".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = auth_token {
-        body.insert("auth_token".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = auth_username {
-        body.insert("auth_username".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_type {
-        body.insert("tracker_type".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_owner {
-        body.insert("tracker_owner".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_repo {
-        body.insert("tracker_repo".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = tracker_token {
-        body.insert("tracker_token".into(), serde_json::Value::String(v));
-    }
-    if let Some(v) = scan_schedule {
-        body.insert("scan_schedule".into(), serde_json::Value::String(v));
-    }
-
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::PATCH,
-        &format!("/api/v1/repositories/{repo_id}"),
-    )
-    .await?
-    .json(&body)
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        let text = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to update repository: {text}"
-        )));
-    }
-
-    Ok(())
-}
 
+/// Fetch the agent's SSH deploy public key.
 #[server]
 pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
     let resp = super::agent_client::agent_get("/api/v1/settings/ssh-public-key")
@@ -163,86 +28,3 @@ pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
         .unwrap_or("")
         .to_string())
 }
-
-#[server]
-pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::DELETE,
-        &format!("/api/v1/repositories/{repo_id}"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    if !resp.status().is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to delete repository: {body}"
-        )));
-    }
-
-    Ok(())
-}
-
-#[server]
-pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
-    super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/repositories/{repo_id}/scan"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    Ok(())
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct WebhookConfigResponse {
-    pub webhook_secret: Option<String>,
-    pub tracker_type: String,
-}
-
-#[server]
-pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
-    let resp =
-        super::agent_client::agent_get(&format!("/api/v1/repositories/{repo_id}/webhook-config"))
-            .await?
-            .send()
-            .await
-            .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: WebhookConfigResponse = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    Ok(body)
-}
-
-/// Check if a repository has any running scans
-#[server]
-pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {
-    let resp = super::agent_client::agent_get("/api/v1/scan-runs?page=1&limit=1")
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: serde_json::Value = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    // Check if the most recent scan for this repo is still running
-    if let Some(scans) = body.get("data").and_then(|d| d.as_array()) {
-        for scan in scans {
-            let scan_repo = scan.get("repo_id").and_then(|v| v.as_str()).unwrap_or("");
-            let status = scan.get("status").and_then(|v| v.as_str()).unwrap_or("");
-            if scan_repo == repo_id && status == "running" {
-                return Ok(true);
-            }
-        }
-    }
-
-    Ok(false)
-}

compliance-dashboard/src/pages/chat_index.rs

@@ -2,11 +2,11 @@ use dioxus::prelude::*;
 
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::repositories::fetch_repositories;
+use crate::infrastructure::onboarding::fetch_targets;
 
 #[component]
 pub fn ChatIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let repos = use_resource(|| async { fetch_targets().await.ok() });
 
     rsx! {
         PageHeader {
@@ -28,10 +28,32 @@ pub fn ChatIndexPage() -> Element {
                         div { class: "graph-index-grid",
                             for repo in repo_list {
                                 {
-                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
-                                    let url = repo.git_url.clone();
-                                    let branch = repo.default_branch.clone();
+                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let url = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find(|a| {
+                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
+                                            })
+                                        })
+                                        .and_then(|a| a.get("source_ref"))
+                                        .and_then(|s| s.as_str())
+                                        .unwrap_or_default()
+                                        .to_string();
+                                    let branch = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find_map(|a| {
+                                                a.get("git")
+                                                    .and_then(|g| g.get("default_branch"))
+                                                    .and_then(|b| b.as_str())
+                                            })
+                                        })
+                                        .unwrap_or("main")
+                                        .to_string();
                                     rsx! {
                                         Link {
                                             to: Route::ChatPage { repo_id },

compliance-dashboard/src/pages/findings.rs

@@ -20,7 +20,7 @@ pub fn FindingsPage() -> Element {
     let mut selected_ids = use_signal(Vec::<String>::new);
 
     let repos = use_resource(|| async {
-        crate::infrastructure::repositories::fetch_repositories(1)
+        crate::infrastructure::onboarding::fetch_targets()
             .await
             .ok()
     });
@@ -86,14 +86,14 @@ pub fn FindingsPage() -> Element {
             }
             select {
                 onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                option { value: "", "All Repositories" }
+                option { value: "", "All Targets" }
                 {
                     match &*repos.read() {
                         Some(Some(resp)) => rsx! {
-                            for repo in &resp.data {
+                            for t in &resp.data {
                                 {
-                                    let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
+                                    let id = t.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = t.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                     rsx! {
                                         option { value: "{id}", "{name}" }
                                     }

compliance-dashboard/src/pages/graph_index.rs

@@ -2,11 +2,11 @@ use dioxus::prelude::*;
 
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::repositories::fetch_repositories;
+use crate::infrastructure::onboarding::fetch_targets;
 
 #[component]
 pub fn GraphIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let repos = use_resource(|| async { fetch_targets().await.ok() });
 
     rsx! {
         PageHeader {
@@ -28,27 +28,34 @@ pub fn GraphIndexPage() -> Element {
                         div { class: "graph-index-grid",
                             for repo in repo_list {
                                 {
-                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                    let name = repo.name.clone();
-                                    let url = repo.git_url.clone();
-                                    let branch = repo.default_branch.clone();
-                                    let findings = repo.findings_count;
+                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let url = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find(|a| {
+                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
+                                            })
+                                        })
+                                        .and_then(|a| a.get("source_ref"))
+                                        .and_then(|s| s.as_str())
+                                        .unwrap_or_default()
+                                        .to_string();
+                                    let branch = repo
+                                        .get("artifacts")
+                                        .and_then(|a| a.as_array())
+                                        .and_then(|arr| {
+                                            arr.iter().find_map(|a| {
+                                                a.get("git")
+                                                    .and_then(|g| g.get("default_branch"))
+                                                    .and_then(|b| b.as_str())
+                                            })
+                                        })
+                                        .unwrap_or("main")
+                                        .to_string();
+                                    let findings = repo.get("findings_count").and_then(|n| n.as_u64()).unwrap_or(0);
                                     let findings_label = if findings != 1 { format!("{findings} findings") } else { "1 finding".to_string() };
-                                    let updated = {
-                                        let now = chrono::Utc::now();
-                                        let diff = now.signed_duration_since(repo.updated_at);
-                                        if diff.num_minutes() < 1 {
-                                            "just now".to_string()
-                                        } else if diff.num_hours() < 1 {
-                                            format!("{}m ago", diff.num_minutes())
-                                        } else if diff.num_days() < 1 {
-                                            format!("{}h ago", diff.num_hours())
-                                        } else if diff.num_days() < 30 {
-                                            format!("{}d ago", diff.num_days())
-                                        } else {
-                                            repo.updated_at.format("%Y-%m-%d").to_string()
-                                        }
-                                    };
                                     rsx! {
                                         Link {
                                             to: Route::GraphExplorerPage { repo_id },
@@ -67,9 +74,6 @@ pub fn GraphIndexPage() -> Element {
                                                 span { class: "graph-repo-card-tag graph-repo-card-tag-findings",
                                                     "{findings_label}"
                                                 }
-                                                span { class: "graph-repo-card-tag",
-                                                    "Updated {updated}"
-                                                }
                                             }
                                         }
                                     }

compliance-dashboard/src/pages/mod.rs

@@ -16,8 +16,8 @@ pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
-pub mod repositories;
 pub mod sbom;
+pub mod targets;
 
 pub use chat::ChatPage;
 pub use chat_index::ChatIndexPage;
@@ -37,5 +37,5 @@ pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
-pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
+pub use targets::TargetsPage;

compliance-dashboard/src/pages/onboarding.rs

@@ -2,7 +2,8 @@ use dioxus::prelude::*;
 
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::onboarding::{
-    create_target, detect_target, fetch_applicable_scans, ArtifactInputDto,
+    create_target, detect_target, fetch_applicable_scans, trigger_target_scan,
+    validate_artifact_ref, validate_target_name, ArtifactInputDto,
 };
 
 /// (value, label, one-line description) for the 9 target families.
@@ -113,10 +114,19 @@ pub fn OnboardingPage() -> Element {
     let mut error = use_signal(|| Option::<String>::None);
     let mut scans = use_signal(Vec::<serde_json::Value>::new);
     let mut suggested = use_signal(|| Option::<String>::None);
+    let mut created_id = use_signal(|| Option::<String>::None);
+    let mut scan_msg = use_signal(|| Option::<String>::None);
 
     let step_now = step();
-    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
+    let name_error = validate_target_name(&name());
+    let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
     let has_artifacts = !artifacts().is_empty();
+    // Live validation of the artifact reference being typed (empty = no error yet).
+    let new_source_error = if new_source().is_empty() {
+        None
+    } else {
+        validate_artifact_ref(&new_kind(), &new_source())
+    };
 
     rsx! {
         PageHeader {
@@ -155,6 +165,11 @@ pub fn OnboardingPage() -> Element {
                             value: "{name}",
                             oninput: move |e| name.set(e.value()),
                         }
+                        if !name().is_empty() {
+                            if let Some(err) = name_error.clone() {
+                                div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 4px;", "{err}" }
+                            }
+                        }
                     }
                     div {
                         style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
@@ -211,9 +226,12 @@ pub fn OnboardingPage() -> Element {
                         }
                         button {
                             class: "btn btn-secondary",
+                            disabled: new_source().trim().is_empty() || new_source_error.is_some(),
                             onclick: move |_| {
                                 let kind = new_kind();
-                                if !new_source().trim().is_empty() {
+                                if !new_source().trim().is_empty()
+                                    && validate_artifact_ref(&kind, &new_source()).is_none()
+                                {
                                     let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
                                     artifacts.write().push(ArtifactInputDto {
                                         kind,
@@ -227,6 +245,9 @@ pub fn OnboardingPage() -> Element {
                             "+ Add"
                         }
                     }
+                    if let Some(err) = new_source_error.clone() {
+                        div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
+                    }
 
                     div { style: "margin-top: 16px;",
                         if has_artifacts {
@@ -290,7 +311,27 @@ pub fn OnboardingPage() -> Element {
                             ScanRow { scan: s }
                         }
                     }
-                    div { style: "margin-top: 16px;",
+                    if let Some(msg) = scan_msg() {
+                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
+                    }
+                    div { style: "margin-top: 16px; display: flex; gap: 8px;",
+                        button {
+                            class: "btn btn-primary",
+                            onclick: move |_| {
+                                if let Some(id) = created_id() {
+                                    scan_msg.set(Some("Scan triggered...".to_string()));
+                                    spawn(async move {
+                                        match trigger_target_scan(id).await {
+                                            Ok(_) => scan_msg.set(Some(
+                                                "Scan started — findings will appear as it runs.".to_string(),
+                                            )),
+                                            Err(e) => scan_msg.set(Some(format!("Failed to start scan: {e}"))),
+                                        }
+                                    });
+                                }
+                            },
+                            "Run scan"
+                        }
                         button {
                             class: "btn btn-secondary",
                             onclick: move |_| {
@@ -301,6 +342,8 @@ pub fn OnboardingPage() -> Element {
                                 artifacts.write().clear();
                                 scans.write().clear();
                                 suggested.set(None);
+                                created_id.set(None);
+                                scan_msg.set(None);
                                 error.set(None);
                             },
                             "Onboard another"
@@ -348,6 +391,7 @@ pub fn OnboardingPage() -> Element {
                                             .and_then(|s| s.as_str())
                                             .map(String::from);
                                         if let Some(id) = id {
+                                            created_id.set(Some(id.clone()));
                                             if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
                                                 scans.set(sc.data.scans);
                                             }

compliance-dashboard/src/pages/overview.rs

@@ -6,7 +6,7 @@ use crate::app::Route;
 use crate::components::page_header::PageHeader;
 use crate::components::stat_card::StatCard;
 use crate::infrastructure::mcp::fetch_mcp_servers;
-use crate::infrastructure::repositories::fetch_repositories;
+use crate::infrastructure::onboarding::fetch_targets;
 
 #[cfg(feature = "server")]
 use crate::infrastructure::stats::fetch_overview_stats;
@@ -26,7 +26,7 @@ pub fn OverviewPage() -> Element {
         }
     });
 
-    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+    let repos = use_resource(|| async { fetch_targets().await.ok() });
     let mcp_servers = use_resource(|| async { fetch_mcp_servers().await.ok() });
 
     rsx! {
@@ -94,8 +94,8 @@ pub fn OverviewPage() -> Element {
                                         style: "display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; padding: 1rem;",
                                         for repo in repo_list {
                                             {
-                                                let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                 rsx! {
                                                     Link {
                                                         to: Route::ChatPage { repo_id },

compliance-dashboard/src/pages/repositories.rs

@@ -1,657 +0,0 @@
-use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-#[allow(unused_imports)]
-use dioxus_free_icons::icons::bs_icons::{BsGear, BsPencil};
-use dioxus_free_icons::Icon;
-
-use crate::components::page_header::PageHeader;
-use crate::components::pagination::Pagination;
-use crate::components::toast::{ToastType, Toasts};
-use crate::pages::graph_explorer::GraphExplorerInline;
-
-async fn async_sleep_5s() {
-    #[cfg(feature = "web")]
-    {
-        gloo_timers::future::TimeoutFuture::new(5_000).await;
-    }
-    #[cfg(not(feature = "web"))]
-    {
-        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
-    }
-}
-
-#[component]
-pub fn RepositoriesPage() -> Element {
-    let mut page = use_signal(|| 1u64);
-    let mut show_add_form = use_signal(|| false);
-    let mut name = use_signal(String::new);
-    let mut git_url = use_signal(String::new);
-    let mut branch = use_signal(|| "main".to_string());
-    let mut auth_token = use_signal(String::new);
-    let mut auth_username = use_signal(String::new);
-    let mut show_auth = use_signal(|| false);
-    let mut ssh_public_key = use_signal(String::new);
-    let mut show_tracker = use_signal(|| false);
-    let mut tracker_type_val = use_signal(String::new);
-    let mut tracker_owner_val = use_signal(String::new);
-    let mut tracker_repo_val = use_signal(String::new);
-    let mut tracker_token_val = use_signal(String::new);
-    let mut adding = use_signal(|| false);
-    let mut toasts = use_context::<Toasts>();
-    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
-    let mut edit_repo_id = use_signal(|| Option::<String>::None);
-    let mut edit_name = use_signal(String::new);
-    let mut edit_branch = use_signal(String::new);
-    let mut edit_tracker_type = use_signal(String::new);
-    let mut edit_tracker_owner = use_signal(String::new);
-    let mut edit_tracker_repo = use_signal(String::new);
-    let mut edit_tracker_token = use_signal(String::new);
-    let mut edit_saving = use_signal(|| false);
-    let mut edit_webhook_secret = use_signal(|| Option::<String>::None);
-    let mut edit_webhook_tracker = use_signal(String::new);
-    let mut scanning_ids = use_signal(Vec::<String>::new);
-    let mut graph_repo_id = use_signal(|| Option::<String>::None);
-
-    let mut repos = use_resource(move || {
-        let p = page();
-        async move {
-            crate::infrastructure::repositories::fetch_repositories(p)
-                .await
-                .ok()
-        }
-    });
-
-    rsx! {
-        PageHeader {
-            title: "Repositories",
-            description: "Tracked git repositories",
-        }
-
-        div { style: "margin-bottom: 16px;",
-            button {
-                class: "btn btn-primary",
-                onclick: move |_| show_add_form.toggle(),
-                if show_add_form() { "Cancel" } else { "+ Add Repository" }
-            }
-        }
-
-        if show_add_form() {
-            div { class: "card",
-                div { class: "card-header", "Add Repository" }
-                div { class: "form-group",
-                    label { "Name" }
-                    input {
-                        r#type: "text",
-                        placeholder: "my-project",
-                        value: "{name}",
-                        oninput: move |e| name.set(e.value()),
-                    }
-                }
-                div { class: "form-group",
-                    label { "Git URL" }
-                    input {
-                        r#type: "text",
-                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
-                        value: "{git_url}",
-                        oninput: move |e| git_url.set(e.value()),
-                    }
-                }
-                div { class: "form-group",
-                    label { "Default Branch" }
-                    input {
-                        r#type: "text",
-                        placeholder: "main",
-                        value: "{branch}",
-                        oninput: move |e| branch.set(e.value()),
-                    }
-                }
-
-                // Private repo auth section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| {
-                            let opening = !show_auth();
-                            show_auth.toggle();
-                            if opening {
-                                // Fetch SSH key every time the section opens
-                                ssh_public_key.set(String::new());
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
-                                        Ok(key) => ssh_public_key.set(key),
-                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
-                                    }
-                                });
-                            }
-                        },
-                        if show_auth() { "Hide auth options" } else { "Private repository?" }
-                    }
-                }
-
-                if show_auth() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        // SSH deploy key display
-                        div { style: "margin-bottom: 12px;",
-                            label { style: "font-size: 12px; color: var(--text-secondary);",
-                                "For SSH URLs: add this deploy key (read-only) to your repository"
-                            }
-                            div {
-                                class: "copyable",
-                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px;",
-                                code {
-                                    style: "font-size: 11px; word-break: break-all; user-select: all;",
-                                    if ssh_public_key().is_empty() {
-                                        "Loading..."
-                                    } else {
-                                        "{ssh_public_key}"
-                                    }
-                                }
-                                if !ssh_public_key().is_empty() {
-                                    crate::components::copy_button::CopyButton { value: ssh_public_key(), small: true }
-                                }
-                            }
-                        }
-
-                        // HTTPS auth fields
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "For HTTPS URLs: provide an access token (PAT) or username/password"
-                        }
-                        div { class: "form-group",
-                            label { "Auth Token / Password" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx or personal access token",
-                                value: "{auth_token}",
-                                oninput: move |e| auth_token.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Username (optional, defaults to x-access-token)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "x-access-token",
-                                value: "{auth_username}",
-                                oninput: move |e| auth_username.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
-                // Issue tracker config section
-                div { style: "margin-top: 8px;",
-                    button {
-                        class: "btn btn-ghost",
-                        style: "font-size: 12px; padding: 4px 8px;",
-                        onclick: move |_| show_tracker.toggle(),
-                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
-                    }
-                }
-
-                if show_tracker() {
-                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
-                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "Configure an issue tracker to auto-create issues from findings"
-                        }
-                        div { class: "form-group",
-                            label { "Tracker Type" }
-                            select {
-                                value: "{tracker_type_val}",
-                                onchange: move |e| tracker_type_val.set(e.value()),
-                                option { value: "", "None" }
-                                option { value: "github", "GitHub" }
-                                option { value: "gitlab", "GitLab" }
-                                option { value: "gitea", "Gitea" }
-                                option { value: "jira", "Jira" }
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Owner / Namespace" }
-                            input {
-                                r#type: "text",
-                                placeholder: "org-name",
-                                value: "{tracker_owner_val}",
-                                oninput: move |e| tracker_owner_val.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Repository / Project" }
-                            input {
-                                r#type: "text",
-                                placeholder: "repo-name",
-                                value: "{tracker_repo_val}",
-                                oninput: move |e| tracker_repo_val.set(e.value()),
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Tracker Token (PAT)" }
-                            input {
-                                r#type: "password",
-                                placeholder: "ghp_xxxx / glpat-xxxx",
-                                value: "{tracker_token_val}",
-                                oninput: move |e| tracker_token_val.set(e.value()),
-                            }
-                        }
-                    }
-                }
-
-                button {
-                    class: "btn btn-primary",
-                    disabled: adding(),
-                    onclick: move |_| {
-                        let n = name();
-                        let u = git_url();
-                        let b = branch();
-                        let tok = {
-                            let v = auth_token();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let usr = {
-                            let v = auth_username();
-                            if v.is_empty() { None } else { Some(v) }
-                        };
-                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
-                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
-                        adding.set(true);
-                        spawn(async move {
-                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
-                                Ok(_) => {
-                                    toasts.push(ToastType::Success, "Repository added");
-                                    repos.restart();
-                                }
-                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                            }
-                            adding.set(false);
-                        });
-                        show_add_form.set(false);
-                        show_auth.set(false);
-                        show_tracker.set(false);
-                        name.set(String::new());
-                        git_url.set(String::new());
-                        auth_token.set(String::new());
-                        auth_username.set(String::new());
-                        tracker_type_val.set(String::new());
-                        tracker_owner_val.set(String::new());
-                        tracker_repo_val.set(String::new());
-                        tracker_token_val.set(String::new());
-                    },
-                    if adding() { "Validating..." } else { "Add" }
-                }
-            }
-        }
-
-        // ── Delete confirmation dialog ──
-        if let Some((del_id, del_name)) = confirm_delete() {
-            div { class: "modal-overlay",
-                div { class: "modal-dialog",
-                    h3 { "Delete Repository" }
-                    p {
-                        "Are you sure you want to delete "
-                        strong { "{del_name}" }
-                        "?"
-                    }
-                    p { class: "modal-warning",
-                        "This will permanently remove all associated findings, SBOM entries, scan runs, graph data, embeddings, and CVE alerts."
-                    }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| confirm_delete.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-danger",
-                            onclick: move |_| {
-                                let id = del_id.clone();
-                                let name = del_name.clone();
-                                confirm_delete.set(None);
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::delete_repository(id).await {
-                                        Ok(_) => {
-                                            toasts.push(ToastType::Success, format!("{name} deleted"));
-                                            repos.restart();
-                                        }
-                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                    }
-                                });
-                            },
-                            "Delete"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ── Edit repository dialog ──
-        if let Some(eid) = edit_repo_id() {
-            div { class: "modal-overlay",
-                div { class: "modal-dialog",
-                    h3 { "Edit Repository" }
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            value: "{edit_name}",
-                            oninput: move |e| edit_name.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Default Branch" }
-                        input {
-                            r#type: "text",
-                            value: "{edit_branch}",
-                            oninput: move |e| edit_branch.set(e.value()),
-                        }
-                    }
-                    h4 { style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);", "Issue Tracker" }
-                    div { class: "form-group",
-                        label { "Tracker Type" }
-                        select {
-                            value: "{edit_tracker_type}",
-                            onchange: move |e| edit_tracker_type.set(e.value()),
-                            option { value: "", "None" }
-                            option { value: "github", "GitHub" }
-                            option { value: "gitlab", "GitLab" }
-                            option { value: "gitea", "Gitea" }
-                            option { value: "jira", "Jira" }
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Owner / Namespace" }
-                        input {
-                            r#type: "text",
-                            placeholder: "org-name",
-                            value: "{edit_tracker_owner}",
-                            oninput: move |e| edit_tracker_owner.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Repository / Project" }
-                        input {
-                            r#type: "text",
-                            placeholder: "repo-name",
-                            value: "{edit_tracker_repo}",
-                            oninput: move |e| edit_tracker_repo.set(e.value()),
-                        }
-                    }
-                    div { class: "form-group",
-                        label { "Tracker Token (leave empty to keep existing)" }
-                        input {
-                            r#type: "password",
-                            placeholder: "Enter new token to change",
-                            value: "{edit_tracker_token}",
-                            oninput: move |e| edit_tracker_token.set(e.value()),
-                        }
-                    }
-                    // Webhook configuration section
-                    if let Some(secret) = edit_webhook_secret() {
-                        h4 {
-                            style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);",
-                            "Webhook Configuration"
-                        }
-                        p {
-                            style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
-                            "Add this webhook in your repository settings to enable push-triggered scans and PR reviews."
-                        }
-                        div { class: "form-group",
-                            label { "Webhook URL" }
-                            {
-                                #[cfg(feature = "web")]
-                                let origin = web_sys::window()
-                                    .and_then(|w: web_sys::Window| w.location().origin().ok())
-                                    .unwrap_or_default();
-                                #[cfg(not(feature = "web"))]
-                                let origin = String::new();
-                                let webhook_url = format!("{origin}/webhook/{}/{eid}", edit_webhook_tracker());
-                                rsx! {
-                                    div { class: "copyable",
-                                        input {
-                                            r#type: "text",
-                                            readonly: true,
-                                            style: "font-family: monospace; font-size: 12px; flex: 1;",
-                                            value: "{webhook_url}",
-                                        }
-                                        crate::components::copy_button::CopyButton { value: webhook_url.clone() }
-                                    }
-                                }
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Webhook Secret" }
-                            div { class: "copyable",
-                                input {
-                                    r#type: "text",
-                                    readonly: true,
-                                    style: "font-family: monospace; font-size: 12px; flex: 1;",
-                                    value: "{secret}",
-                                }
-                                crate::components::copy_button::CopyButton { value: secret.clone() }
-                            }
-                        }
-                    }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| edit_repo_id.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-primary",
-                            disabled: edit_saving(),
-                            onclick: move |_| {
-                                let id = eid.clone();
-                                let nm = { let v = edit_name(); if v.is_empty() { None } else { Some(v) } };
-                                let br = { let v = edit_branch(); if v.is_empty() { None } else { Some(v) } };
-                                let tt = { let v = edit_tracker_type(); if v.is_empty() { None } else { Some(v) } };
-                                let t_owner = { let v = edit_tracker_owner(); if v.is_empty() { None } else { Some(v) } };
-                                let t_repo = { let v = edit_tracker_repo(); if v.is_empty() { None } else { Some(v) } };
-                                let t_tok = { let v = edit_tracker_token(); if v.is_empty() { None } else { Some(v) } };
-                                edit_saving.set(true);
-                                spawn(async move {
-                                    match crate::infrastructure::repositories::update_repository(
-                                        id, nm, br, None, None, tt, t_owner, t_repo, t_tok, None,
-                                    ).await {
-                                        Ok(_) => {
-                                            toasts.push(ToastType::Success, "Repository updated");
-                                            repos.restart();
-                                        }
-                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                    }
-                                    edit_saving.set(false);
-                                    edit_repo_id.set(None);
-                                });
-                            },
-                            if edit_saving() { "Saving..." } else { "Save" }
-                        }
-                    }
-                }
-            }
-        }
-
-        match &*repos.read() {
-            Some(Some(resp)) => {
-                let total_pages = resp.total.unwrap_or(0).div_ceil(20).max(1);
-                rsx! {
-                    div { class: "card",
-                        div { class: "table-wrapper",
-                            table {
-                                thead {
-                                    tr {
-                                        th { "Name" }
-                                        th { "Git URL" }
-                                        th { "Branch" }
-                                        th { "Findings" }
-                                        th { "Last Scanned" }
-                                        th { "Actions" }
-                                    }
-                                }
-                                tbody {
-                                    for repo in &resp.data {
-                                        {
-                                            let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                            let repo_id_scan = repo_id.clone();
-                                            let repo_id_del = repo_id.clone();
-                                            let repo_id_edit = repo_id.clone();
-                                            let repo_name_del = repo.name.clone();
-                                            let edit_repo_data = repo.clone();
-                                            let is_scanning = scanning_ids().contains(&repo_id);
-                                            rsx! {
-                                                tr {
-                                                    td { "{repo.name}" }
-                                                    td {
-                                                        style: "font-size: 12px; font-family: monospace;",
-                                                        "{repo.git_url}"
-                                                    }
-                                                    td { "{repo.default_branch}" }
-                                                    td { "{repo.findings_count}" }
-                                                    td {
-                                                        {
-                                                            let now = chrono::Utc::now();
-                                                            let diff = now.signed_duration_since(repo.updated_at);
-                                                            let label = if diff.num_minutes() < 1 {
-                                                                "just now".to_string()
-                                                            } else if diff.num_hours() < 1 {
-                                                                format!("{}m ago", diff.num_minutes())
-                                                            } else if diff.num_days() < 1 {
-                                                                format!("{}h ago", diff.num_hours())
-                                                            } else if diff.num_days() < 30 {
-                                                                format!("{}d ago", diff.num_days())
-                                                            } else {
-                                                                repo.updated_at.format("%Y-%m-%d").to_string()
-                                                            };
-                                                            rsx! { span { style: "font-size: 12px;", "{label}" } }
-                                                        }
-                                                    }
-                                                    td { style: "display: flex; gap: 4px;",
-                                                        button {
-                                                            class: if graph_repo_id().as_deref() == Some(repo_id.as_str()) { "btn btn-ghost btn-active" } else { "btn btn-ghost" },
-                                                            title: "View graph",
-                                                            onclick: {
-                                                                let rid = repo_id.clone();
-                                                                move |_| {
-                                                                    if graph_repo_id().as_deref() == Some(rid.as_str()) {
-                                                                        graph_repo_id.set(None);
-                                                                    } else {
-                                                                        graph_repo_id.set(Some(rid.clone()));
-                                                                    }
-                                                                }
-                                                            },
-                                                            Icon { icon: BsDiagram3, width: 16, height: 16 }
-                                                        }
-                                                        button {
-                                                            class: "btn btn-ghost",
-                                                            title: "Edit repository",
-                                                            onclick: move |_| {
-                                                                edit_name.set(edit_repo_data.name.clone());
-                                                                edit_branch.set(edit_repo_data.default_branch.clone());
-                                                                edit_tracker_type.set(
-                                                                    edit_repo_data.tracker_type.as_ref().map(|t| t.to_string()).unwrap_or_default()
-                                                                );
-                                                                edit_tracker_owner.set(edit_repo_data.tracker_owner.clone().unwrap_or_default());
-                                                                edit_tracker_repo.set(edit_repo_data.tracker_repo.clone().unwrap_or_default());
-                                                                edit_tracker_token.set(String::new());
-                                                                edit_webhook_secret.set(None);
-                                                                edit_webhook_tracker.set(String::new());
-                                                                edit_repo_id.set(Some(repo_id_edit.clone()));
-                                                                // Fetch webhook config in background
-                                                                let rid = repo_id_edit.clone();
-                                                                spawn(async move {
-                                                                    if let Ok(cfg) = crate::infrastructure::repositories::fetch_webhook_config(rid).await {
-                                                                        edit_webhook_secret.set(cfg.webhook_secret);
-                                                                        edit_webhook_tracker.set(cfg.tracker_type);
-                                                                    }
-                                                                });
-                                                            },
-                                                            Icon { icon: BsPencil, width: 16, height: 16 }
-                                                        }
-                                                        button {
-                                                            class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
-                                                            title: "Trigger scan",
-                                                            disabled: is_scanning,
-                                                            onclick: move |_| {
-                                                                let id = repo_id_scan.clone();
-                                                                // Add to scanning set
-                                                                let mut ids = scanning_ids();
-                                                                ids.push(id.clone());
-                                                                scanning_ids.set(ids);
-                                                                spawn(async move {
-                                                                    match crate::infrastructure::repositories::trigger_repo_scan(id.clone()).await {
-                                                                        Ok(_) => {
-                                                                            toasts.push(ToastType::Success, "Scan triggered");
-                                                                            // Poll until scan completes
-                                                                            loop {
-                                                                                async_sleep_5s().await;
-                                                                                match crate::infrastructure::repositories::check_repo_scanning(id.clone()).await {
-                                                                                    Ok(false) => break,
-                                                                                    Ok(true) => continue,
-                                                                                    Err(_) => break,
-                                                                                }
-                                                                            }
-                                                                            toasts.push(ToastType::Success, "Scan complete");
-                                                                            repos.restart();
-                                                                        }
-                                                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                                                    }
-                                                                    // Remove from scanning set
-                                                                    let mut ids = scanning_ids();
-                                                                    ids.retain(|i| i != &id);
-                                                                    scanning_ids.set(ids);
-                                                                });
-                                                            },
-                                                            if is_scanning {
-                                                                span { class: "spinner" }
-                                                            } else {
-                                                                Icon { icon: BsPlayCircle, width: 16, height: 16 }
-                                                            }
-                                                        }
-                                                        button {
-                                                            class: "btn btn-ghost btn-ghost-danger",
-                                                            title: "Delete repository",
-                                                            onclick: move |_| {
-                                                                confirm_delete.set(Some((repo_id_del.clone(), repo_name_del.clone())));
-                                                            },
-                                                            Icon { icon: BsTrash, width: 16, height: 16 }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                        Pagination {
-                            current_page: page(),
-                            total_pages: total_pages,
-                            on_page_change: move |p| page.set(p),
-                        }
-                    }
-
-                    // Inline graph explorer
-                    if let Some(rid) = graph_repo_id() {
-                        div { class: "card", style: "margin-top: 16px;",
-                            div { class: "card-header", style: "display: flex; justify-content: space-between; align-items: center;",
-                                span { "Code Graph" }
-                                button {
-                                    class: "btn btn-sm btn-ghost",
-                                    title: "Close graph",
-                                    onclick: move |_| { graph_repo_id.set(None); },
-                                    Icon { icon: BsX, width: 18, height: 18 }
-                                }
-                            }
-                            GraphExplorerInline { repo_id: rid }
-                        }
-                    }
-                }
-            },
-            Some(None) => rsx! {
-                div { class: "card", p { "Failed to load repositories." } }
-            },
-            None => rsx! {
-                div { class: "loading", "Loading repositories..." }
-            },
-        }
-    }
-}

compliance-dashboard/src/pages/sbom.rs

@@ -28,9 +28,9 @@ pub fn SbomPage() -> Element {
     let mut diff_repo_a = use_signal(String::new);
     let mut diff_repo_b = use_signal(String::new);
 
-    // ── Repos for dropdowns ──
+    // ── Targets for dropdowns ──
     let repos = use_resource(|| async {
-        crate::infrastructure::repositories::fetch_repositories(1)
+        crate::infrastructure::onboarding::fetch_targets()
             .await
             .ok()
     });
@@ -114,14 +114,14 @@ pub fn SbomPage() -> Element {
                 select {
                     class: "sbom-filter-select",
                     onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                    option { value: "", "All Repositories" }
+                    option { value: "", "All Targets" }
                     {
                         match &*repos.read() {
                             Some(Some(resp)) => rsx! {
                                 for repo in &resp.data {
                                     {
-                                        let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                        let name = repo.name.clone();
+                                        let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                        let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                         rsx! { option { value: "{id}", "{name}" } }
                                     }
                                 }
@@ -476,8 +476,8 @@ pub fn SbomPage() -> Element {
                                     Some(Some(resp)) => rsx! {
                                         for repo in &resp.data {
                                             {
-                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                 rsx! { option { value: "{id}", "{name}" } }
                                             }
                                         }
@@ -498,8 +498,8 @@ pub fn SbomPage() -> Element {
                                     Some(Some(resp)) => rsx! {
                                         for repo in &resp.data {
                                             {
-                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
-                                                let name = repo.name.clone();
+                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
+                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
                                                 rsx! { option { value: "{id}", "{name}" } }
                                             }
                                         }

compliance-dashboard/src/pages/targets.rs

@@ -0,0 +1,544 @@
+//! Targets page — lists onboarded targets (the unified `OnboardedTarget`
+//! records the wizard creates) and lets the user run a scan, inspect the
+//! classification / applicable scans, or delete a target.
+//!
+//! Creation lives in the Onboard wizard (`/onboard`); this page is the
+//! "where is my target, and what did the scan find" surface.
+
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+use dioxus_free_icons::Icon;
+
+use crate::components::page_header::PageHeader;
+use crate::components::toast::{ToastType, Toasts};
+use crate::infrastructure::onboarding::{
+    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan, update_target,
+    validate_artifact_ref, validate_target_name, ArtifactInputDto,
+};
+
+/// The nine target families (value, label) for the edit form's type selector.
+const TARGET_TYPES: &[(&str, &str)] = &[
+    ("web_app", "Web Application"),
+    ("backend_service", "Backend / API"),
+    ("desktop_app", "Desktop App"),
+    ("android_app", "Android App"),
+    ("ios_app", "iOS App"),
+    ("firmware_bare_metal", "Firmware — bare metal"),
+    ("firmware_rtos", "Firmware — RTOS"),
+    ("embedded_linux_yocto", "Embedded Linux / Yocto"),
+    ("plc_sps", "PLC / SPS"),
+];
+
+/// The artifact kinds (value, label) for the edit form.
+const ARTIFACT_KINDS: &[(&str, &str)] = &[
+    ("git_repo", "Git repository"),
+    ("source_archive", "Source archive (zip)"),
+    ("firmware_image", "Firmware image"),
+    ("mobile_package", "Mobile package (APK/IPA)"),
+    ("container_image", "Container image"),
+    ("live_url", "Live URL"),
+    ("plc_project", "PLC project"),
+    ("plaintext_description", "Description (text)"),
+];
+
+/// Prettify a snake_case target-type value into a human label.
+fn pretty_type(v: &str) -> String {
+    match v {
+        "web_app" => "Web Application".into(),
+        "backend_service" => "Backend / API".into(),
+        "desktop_app" => "Desktop App".into(),
+        "android_app" => "Android App".into(),
+        "ios_app" => "iOS App".into(),
+        "firmware_bare_metal" => "Firmware — bare metal".into(),
+        "firmware_rtos" => "Firmware — RTOS".into(),
+        "embedded_linux_yocto" => "Embedded Linux / Yocto".into(),
+        "plc_sps" => "PLC / SPS".into(),
+        other => other.replace('_', " "),
+    }
+}
+
+fn str_at<'a>(v: &'a serde_json::Value, key: &str) -> &'a str {
+    v.get(key).and_then(|x| x.as_str()).unwrap_or("")
+}
+
+fn target_id(t: &serde_json::Value) -> String {
+    t.get("_id")
+        .and_then(|o| o.get("$oid"))
+        .and_then(|s| s.as_str())
+        .unwrap_or_default()
+        .to_string()
+}
+
+/// The applicable-scans matrix for one target, fetched on expand.
+#[component]
+fn TargetScans(id: String) -> Element {
+    let scan_id = id.clone();
+    let scans = use_resource(move || {
+        let id = scan_id.clone();
+        async move { fetch_applicable_scans(id).await.ok() }
+    });
+
+    let snapshot = scans.read().clone();
+    match &snapshot {
+        Some(Some(resp)) => {
+            let rows = resp.data.scans.clone();
+            let pentest = resp.data.pentest_supported;
+            rsx! {
+                div { style: "margin-top: 8px;",
+                    if rows.is_empty() {
+                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
+                    }
+                    for s in rows {
+                        {
+                            let name = str_at(&s, "scan").to_string();
+                            let rationale = str_at(&s, "rationale").to_string();
+                            let blocked = s.get("blocked_reason").and_then(|b| b.as_str()).map(String::from);
+                            let default_on = s.get("default_on").and_then(|b| b.as_bool()).unwrap_or(false);
+                            let badge = if blocked.is_some() {
+                                "badge badge-info"
+                            } else if default_on {
+                                "badge badge-success"
+                            } else {
+                                "badge"
+                            };
+                            rsx! {
+                                div { style: "display: flex; gap: 8px; align-items: center; padding: 4px 0;",
+                                    span { class: "{badge}", "{name}" }
+                                    span { style: "opacity: 0.8; font-size: 0.9em;", "{rationale}" }
+                                    if let Some(b) = blocked {
+                                        span { style: "opacity: 0.6; font-style: italic; font-size: 0.9em;", "— {b}" }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if pentest {
+                        div { style: "margin-top: 6px; opacity: 0.75; font-size: 0.85em;",
+                            "Active pentest is supported for this target type."
+                        }
+                    }
+                }
+            }
+        }
+        Some(None) => rsx! { div { style: "opacity: 0.6;", "Failed to load applicable scans." } },
+        None => rsx! { div { style: "opacity: 0.6;", "Loading scans..." } },
+    }
+}
+
+#[component]
+pub fn TargetsPage() -> Element {
+    let mut toasts = use_context::<Toasts>();
+    let mut scanning_ids = use_signal(Vec::<String>::new);
+    let mut expanded_ids = use_signal(Vec::<String>::new);
+    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
+
+    // Edit-target modal state.
+    let mut edit_id = use_signal(|| Option::<String>::None);
+    let mut edit_name = use_signal(String::new);
+    let mut edit_type = use_signal(String::new);
+    let mut edit_arts = use_signal(Vec::<ArtifactInputDto>::new);
+    let mut edit_saving = use_signal(|| false);
+    // In-modal "add artifact" mini-form.
+    let mut e_kind = use_signal(|| "git_repo".to_string());
+    let mut e_source = use_signal(String::new);
+    let mut e_branch = use_signal(|| "main".to_string());
+
+    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
+
+    rsx! {
+        PageHeader {
+            title: "Targets",
+            description: "Onboarded targets and what their scans found. Add new targets from Onboard.",
+        }
+
+        div { style: "margin-bottom: 16px; display: flex; gap: 8px;",
+            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
+                "+ Onboard a target"
+            }
+            button {
+                class: "btn btn-secondary",
+                onclick: move |_| targets.restart(),
+                "Refresh"
+            }
+        }
+
+        // ── Delete confirmation ──
+        if let Some((del_id, del_name)) = confirm_delete() {
+            div { class: "modal-overlay",
+                div { class: "modal-dialog",
+                    h3 { "Delete Target" }
+                    p { "Delete " strong { "{del_name}" } "?" }
+                    p { class: "modal-warning",
+                        "This permanently removes the target and its findings, SBOM entries, scan runs, and CVE alerts."
+                    }
+                    div { class: "modal-actions",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| confirm_delete.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-danger",
+                            onclick: move |_| {
+                                let id = del_id.clone();
+                                let name = del_name.clone();
+                                confirm_delete.set(None);
+                                spawn(async move {
+                                    match delete_target(id).await {
+                                        Ok(_) => {
+                                            toasts.push(ToastType::Success, format!("{name} deleted"));
+                                            targets.restart();
+                                        }
+                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                    }
+                                });
+                            },
+                            "Delete"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Edit target ──
+        if let Some(eid) = edit_id() {
+            {
+            let name_err = validate_target_name(&edit_name());
+            let e_source_err = if e_source().is_empty() {
+                None
+            } else {
+                validate_artifact_ref(&e_kind(), &e_source())
+            };
+            rsx! {
+                div { class: "modal-overlay",
+                    div { class: "modal-dialog",
+                        h3 { "Edit target" }
+                        div { class: "form-group",
+                            label { "Name" }
+                            input {
+                                r#type: "text",
+                                value: "{edit_name}",
+                                oninput: move |e| edit_name.set(e.value()),
+                            }
+                            if !edit_name().is_empty() {
+                                if let Some(err) = name_err.clone() {
+                                    div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
+                                }
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Type" }
+                            select {
+                                value: "{edit_type}",
+                                oninput: move |e| edit_type.set(e.value()),
+                                for (v, l) in TARGET_TYPES.iter().copied() {
+                                    option { value: "{v}", "{l}" }
+                                }
+                            }
+                        }
+                        label { style: "font-weight: 600;", "Artifacts" }
+                        for (i, a) in edit_arts().iter().enumerate() {
+                            div { style: "display: flex; justify-content: space-between; align-items: center; padding: 4px 0;",
+                                span { style: "font-size: 0.9em;",
+                                    span { style: "opacity: 0.7;", "{a.kind}: " }
+                                    span { style: "font-family: monospace;", "{a.source_ref}" }
+                                }
+                                button {
+                                    class: "btn btn-ghost btn-ghost-danger btn-sm",
+                                    onclick: move |_| { edit_arts.write().remove(i); },
+                                    "Remove"
+                                }
+                            }
+                        }
+                        div { style: "display: flex; gap: 8px; align-items: flex-end; margin-top: 8px;",
+                            div { class: "form-group", style: "margin: 0;",
+                                label { "Kind" }
+                                select {
+                                    value: "{e_kind}",
+                                    oninput: move |e| e_kind.set(e.value()),
+                                    for (v, l) in ARTIFACT_KINDS.iter().copied() {
+                                        option { value: "{v}", "{l}" }
+                                    }
+                                }
+                            }
+                            div { class: "form-group", style: "margin: 0; flex: 1;",
+                                label { "Reference" }
+                                input {
+                                    r#type: "text",
+                                    value: "{e_source}",
+                                    oninput: move |e| e_source.set(e.value()),
+                                }
+                            }
+                            if e_kind() == "git_repo" {
+                                div { class: "form-group", style: "margin: 0;",
+                                    label { "Branch" }
+                                    input {
+                                        r#type: "text",
+                                        value: "{e_branch}",
+                                        oninput: move |e| e_branch.set(e.value()),
+                                    }
+                                }
+                            }
+                            button {
+                                class: "btn btn-secondary",
+                                disabled: e_source().trim().is_empty() || e_source_err.is_some(),
+                                onclick: move |_| {
+                                    let kind = e_kind();
+                                    if !e_source().trim().is_empty()
+                                        && validate_artifact_ref(&kind, &e_source()).is_none()
+                                    {
+                                        let branch = if kind == "git_repo" { Some(e_branch()) } else { None };
+                                        edit_arts.write().push(ArtifactInputDto {
+                                            kind,
+                                            source_ref: e_source(),
+                                            branch,
+                                            plc_format: None,
+                                        });
+                                        e_source.set(String::new());
+                                    }
+                                },
+                                "+ Add"
+                            }
+                        }
+                        if let Some(err) = e_source_err.clone() {
+                            div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
+                        }
+                        div { class: "modal-actions",
+                            button {
+                                class: "btn btn-secondary",
+                                onclick: move |_| edit_id.set(None),
+                                "Cancel"
+                            }
+                            button {
+                                class: "btn btn-primary",
+                                disabled: edit_saving() || name_err.is_some(),
+                                onclick: move |_| {
+                                    let id = eid.clone();
+                                    let nm = edit_name();
+                                    let tt = edit_type();
+                                    let arts = edit_arts();
+                                    edit_saving.set(true);
+                                    spawn(async move {
+                                        match update_target(id, Some(nm), Some(tt), Some(arts)).await {
+                                            Ok(_) => {
+                                                toasts.push(ToastType::Success, "Target updated");
+                                                targets.restart();
+                                                edit_id.set(None);
+                                            }
+                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                        }
+                                        edit_saving.set(false);
+                                    });
+                                },
+                                if edit_saving() { "Saving..." } else { "Save" }
+                            }
+                        }
+                    }
+                }
+            }
+            }
+        }
+
+        {
+        let targets_snapshot = targets.read().clone();
+        match &targets_snapshot {
+            Some(Some(resp)) => {
+                let rows = resp.data.clone();
+                if rows.is_empty() {
+                    rsx! {
+                        div { class: "card", style: "padding: 24px; text-align: center;",
+                            p { style: "opacity: 0.7;", "No targets yet." }
+                            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
+                                "Onboard your first target"
+                            }
+                        }
+                    }
+                } else {
+                    rsx! {
+                        div { class: "card",
+                            div { class: "table-wrapper",
+                                table {
+                                    thead {
+                                        tr {
+                                            th { "Name" }
+                                            th { "Type" }
+                                            th { "Detected" }
+                                            th { "Artifacts" }
+                                            th { "Findings" }
+                                            th { "Actions" }
+                                        }
+                                    }
+                                    tbody {
+                                        for t in rows {
+                                            {
+                                                let id = target_id(&t);
+                                                let name = str_at(&t, "name").to_string();
+                                                let ttype = pretty_type(str_at(&t, "target_type"));
+                                                let suggested = t
+                                                    .get("classification")
+                                                    .and_then(|c| c.get("suggested"))
+                                                    .and_then(|s| s.as_str())
+                                                    .map(pretty_type);
+                                                let artifacts = t
+                                                    .get("artifacts")
+                                                    .and_then(|a| a.as_array())
+                                                    .cloned()
+                                                    .unwrap_or_default();
+                                                let findings = t
+                                                    .get("findings_count")
+                                                    .and_then(|n| n.as_u64())
+                                                    .unwrap_or(0);
+                                                let facts = t
+                                                    .get("classification")
+                                                    .and_then(|c| c.get("facts"))
+                                                    .and_then(|f| f.as_array())
+                                                    .cloned()
+                                                    .unwrap_or_default();
+                                                let is_scanning = scanning_ids().contains(&id);
+                                                let is_expanded = expanded_ids().contains(&id);
+                                                let id_scan = id.clone();
+                                                let id_exp = id.clone();
+                                                let id_del = id.clone();
+                                                let id_edit = id.clone();
+                                                let name_del = name.clone();
+                                                let name_edit = name.clone();
+                                                let ttype_raw = str_at(&t, "target_type").to_string();
+                                                let artifacts_detail = artifacts.clone();
+                                                let artifacts_edit = artifacts.clone();
+                                                rsx! {
+                                                    tr {
+                                                        td { strong { "{name}" } }
+                                                        td { "{ttype}" }
+                                                        td {
+                                                            if let Some(sug) = suggested.clone() {
+                                                                span { class: "badge badge-success", "{sug}" }
+                                                            } else {
+                                                                span { style: "opacity: 0.5;", "—" }
+                                                            }
+                                                        }
+                                                        td { "{artifacts.len()}" }
+                                                        td { "{findings}" }
+                                                        td { style: "display: flex; gap: 4px;",
+                                                            button {
+                                                                class: "btn btn-ghost",
+                                                                title: "Details",
+                                                                onclick: move |_| {
+                                                                    let mut ids = expanded_ids();
+                                                                    if ids.contains(&id_exp) {
+                                                                        ids.retain(|i| i != &id_exp);
+                                                                    } else {
+                                                                        ids.push(id_exp.clone());
+                                                                    }
+                                                                    expanded_ids.set(ids);
+                                                                },
+                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
+                                                            }
+                                                            button {
+                                                                class: "btn btn-ghost",
+                                                                title: "Edit target",
+                                                                onclick: move |_| {
+                                                                    edit_name.set(name_edit.clone());
+                                                                    edit_type.set(ttype_raw.clone());
+                                                                    let arts: Vec<ArtifactInputDto> = artifacts_edit
+                                                                        .iter()
+                                                                        .map(|a| ArtifactInputDto {
+                                                                            kind: str_at(a, "kind").to_string(),
+                                                                            source_ref: str_at(a, "source_ref").to_string(),
+                                                                            branch: a
+                                                                                .get("git")
+                                                                                .and_then(|g| g.get("default_branch"))
+                                                                                .and_then(|b| b.as_str())
+                                                                                .map(String::from),
+                                                                            plc_format: None,
+                                                                        })
+                                                                        .collect();
+                                                                    edit_arts.set(arts);
+                                                                    e_source.set(String::new());
+                                                                    edit_id.set(Some(id_edit.clone()));
+                                                                },
+                                                                Icon { icon: BsPencil, width: 16, height: 16 }
+                                                            }
+                                                            button {
+                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
+                                                                title: "Run scan",
+                                                                disabled: is_scanning,
+                                                                onclick: move |_| {
+                                                                    let id = id_scan.clone();
+                                                                    let mut ids = scanning_ids();
+                                                                    ids.push(id.clone());
+                                                                    scanning_ids.set(ids);
+                                                                    spawn(async move {
+                                                                        match trigger_target_scan(id.clone()).await {
+                                                                            Ok(_) => toasts.push(ToastType::Success, "Scan triggered — findings appear as it runs. Use Refresh."),
+                                                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                                                        }
+                                                                        let mut ids = scanning_ids();
+                                                                        ids.retain(|i| i != &id);
+                                                                        scanning_ids.set(ids);
+                                                                    });
+                                                                },
+                                                                if is_scanning {
+                                                                    span { class: "spinner" }
+                                                                } else {
+                                                                    Icon { icon: BsPlayCircle, width: 16, height: 16 }
+                                                                }
+                                                            }
+                                                            button {
+                                                                class: "btn btn-ghost btn-ghost-danger",
+                                                                title: "Delete target",
+                                                                onclick: move |_| {
+                                                                    confirm_delete.set(Some((id_del.clone(), name_del.clone())));
+                                                                },
+                                                                Icon { icon: BsTrash, width: 16, height: 16 }
+                                                            }
+                                                        }
+                                                    }
+                                                    if is_expanded {
+                                                        tr {
+                                                            td { colspan: "6",
+                                                                div { style: "padding: 12px 8px;",
+                                                                    h4 { style: "margin: 0 0 6px;", "Artifacts" }
+                                                                    if artifacts_detail.is_empty() {
+                                                                        div { style: "opacity: 0.6;", "No artifacts." }
+                                                                    }
+                                                                    for a in artifacts_detail {
+                                                                        div { style: "font-size: 0.9em; padding: 2px 0;",
+                                                                            span { style: "opacity: 0.7;", "{str_at(&a, \"kind\")}: " }
+                                                                            span { style: "font-family: monospace;", "{str_at(&a, \"source_ref\")}" }
+                                                                        }
+                                                                    }
+                                                                    if !facts.is_empty() {
+                                                                        h4 { style: "margin: 12px 0 6px;", "Detected facts" }
+                                                                        for f in facts {
+                                                                            div { style: "font-size: 0.9em; padding: 2px 0;",
+                                                                                span { style: "font-family: monospace;", "{str_at(&f, \"key\")}={str_at(&f, \"value\")}" }
+                                                                                span { style: "opacity: 0.5;", " ({str_at(&f, \"source\")})" }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                    h4 { style: "margin: 12px 0 6px;", "Applicable scans" }
+                                                                    TargetScans { id: id.clone() }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Some(None) => rsx! {
+                div { class: "card", p { "Failed to load targets." } }
+            },
+            None => rsx! {
+                div { class: "loading", "Loading targets..." }
+            },
+        }
+        }
+    }
+}

docker/agent-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Seed the nix store on first start, then run the agent.
+#
+# The firmware-SBOM pipeline drives a real `nix` build (tramiton NixBackend).
+# The image ships the store as a bootstrap tarball rather than baking /nix, so a
+# persistent /nix volume (mounted empty on first deploy) gets populated once and
+# then survives redeploys. Seeding is best-effort: if it fails, the agent still
+# starts and firmware SBOMs fall back to analysis-only.
+if [ ! -e /nix/store ]; then
+  echo "agent-entrypoint: seeding /nix store from image bootstrap..."
+  mkdir -p /nix
+  if tar -C / -xzf /opt/nix-bootstrap.tar.gz; then
+    echo "agent-entrypoint: /nix store seeded."
+  else
+    echo "agent-entrypoint: WARN nix seed failed; firmware SBOM will use analysis-only fallback."
+  fi
+fi
+
+exec compliance-agent "$@"