feat(werkbank): job/result contract in compliance-core (WB-01)

The shared, dependency-free vocabulary the control plane and the Werkbank
execution runner agree on: Job (declarative — TOML on disk, JSON on the wire),
JobType (plc-provision/qemu-boot/dast/pentest), Executor (shell/docker/k8s),
JobStatus lifecycle, InputRef (blob/url — the artifact resolves on the runner,
never through the control plane), JobRuntime, JobCollect, and JobResult (reusing
Finding/DastFinding/SbomEntry so the runner produces exactly what the control
plane persists).

Lives in a mongodb/axum-feature-free module so the runner can depend on
compliance-core without the server stack (verified: cargo check -p
compliance-core --no-default-features). Tests round-trip through JSON and parse
the exact plc-provision + qemu-boot TOML from the Werkbank design doc.

First story of the Werkbank epic (sharang/werkbank#1); implements
sharang/werkbank#2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -47,11 +47,6 @@ PLC_RUNTIME_MAX_LIFETIME_SECS=180
 PLC_RUNTIME_OPENPLC_USER=openplc
 PLC_RUNTIME_OPENPLC_PASSWORD=openplc
 
-# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
-# When set, mounts the runner-facing queue + artifact endpoints behind this
-# bearer token; runners present the same token. Unset = endpoints not mounted.
-WERKBANK_RUNNER_TOKEN=
-
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001

.gitea/workflows/ci.yml

@@ -107,8 +107,6 @@ jobs:
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
-      - name: Clippy (werkbank-exec)
-        run: cargo clippy -p werkbank-exec -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -117,8 +115,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent + werkbank-exec)
-        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib
+      - name: Tests (core + agent)
+        run: cargo test -p compliance-core -p compliance-agent --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)

Cargo.lock

@@ -699,7 +699,6 @@ dependencies = [
  "urlencoding",
  "uuid",
  "walkdir",
- "werkbank-exec",
  "zip",
 ]
 
@@ -5089,12 +5088,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "sha1_smol"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
-
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -6478,7 +6471,6 @@ dependencies = [
  "getrandom 0.4.1",
  "js-sys",
  "serde_core",
- "sha1_smol",
  "wasm-bindgen",
 ]
 
@@ -6722,25 +6714,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "werkbank-exec"
-version = "0.1.0"
-dependencies = [
- "compliance-core",
- "compliance-dast",
- "futures-util",
- "hex",
- "regex",
- "reqwest",
- "secrecy",
- "sha2",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "uuid",
- "walkdir",
-]
-
 [[package]]
 name = "which"
 version = "6.0.3"

Cargo.toml

@@ -7,7 +7,6 @@ members = [
     "compliance-dast",
     "compliance-mcp",
     "compliance-smoke",
-    "werkbank-exec",
 ]
 resolver = "2"
 
@@ -28,7 +27,7 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "co
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
-uuid = { version = "1", features = ["v4", "v5", "serde"] }
+uuid = { version = "1", features = ["v4", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }

compliance-agent/Cargo.toml

@@ -10,9 +10,6 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
-# Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also
-# used by the Werkbank runner.
-werkbank-exec = { path = "../werkbank-exec" }
 # Native firmware build/target detection for bare-metal & RTOS artifacts.
 # Same-company IP, used directly (not via CLI) so the whole tramiton suite is
 # available to the onboarding classifier. NOTE: CI must be able to fetch this

compliance-agent/src/api/handlers/mod.rs

@@ -10,12 +10,10 @@ pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
-pub mod oscal;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod sbom;
 pub mod scans;
-pub mod werkbank_jobs;
 
 // Re-export all handler functions so routes.rs can use `handlers::function_name`
 pub use dto::*;

compliance-agent/src/api/handlers/oscal.rs

@@ -1,89 +0,0 @@
-//! OSCAL assessment endpoint.
-//!
-//! Assesses a target's findings against the breakpilot-compliance control
-//! catalog and returns a standard OSCAL assessment-results document. Ties
-//! together the ingest provider ([`OscalControlsProvider`]) and the assessment
-//! emitter (`compliance_core::models::oscal_assessment`).
-
-use axum::extract::Extension;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use mongodb::bson::doc;
-use serde::Deserialize;
-
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::models::oscal_assessment::{assess, ControlLinker};
-use compliance_core::models::Finding;
-use compliance_core::tenant_ctx::TenantCtx;
-
-use super::dto::{collect_cursor_async, tenant_db, AgentExt};
-use crate::controls::OscalControlsProvider;
-
-#[derive(Debug, Deserialize)]
-pub struct AssessRequest {
-    /// The target / repo id whose findings are assessed.
-    pub target_id: String,
-    /// Frameworks to assess against; defaults to `[Cra]` when empty.
-    #[serde(default)]
-    pub frameworks: Vec<ComplianceFramework>,
-}
-
-/// `POST /api/v1/oscal/assess` — pull the catalog(s), load the target's findings,
-/// and emit an OSCAL assessment-results document linking findings to controls.
-pub async fn assess_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<AssessRequest>,
-) -> Response {
-    let cfg = &agent.config.breakpilot;
-    let Some(base_url) = cfg.base_url.clone() else {
-        return (
-            StatusCode::SERVICE_UNAVAILABLE,
-            "breakpilot base URL not configured (set BREAKPILOT_BASE_URL)",
-        )
-            .into_response();
-    };
-
-    let frameworks = if req.frameworks.is_empty() {
-        vec![ComplianceFramework::Cra]
-    } else {
-        req.frameworks.clone()
-    };
-
-    let db = match tenant_db(&agent, &tenant).await {
-        Ok(db) => db,
-        Err(code) => return code.into_response(),
-    };
-
-    let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
-            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
-        }
-    };
-
-    let provider = OscalControlsProvider::new(
-        agent.http.clone(),
-        base_url,
-        cfg.token.clone(),
-        &cfg.snapshot_dir,
-    );
-    let mut controls = Vec::new();
-    for framework in &frameworks {
-        match provider.load(*framework).await {
-            Ok(document) => controls.extend(document.to_controls()),
-            Err(e) => tracing::warn!(?framework, error = %e, "OSCAL catalog load failed"),
-        }
-    }
-
-    let assessment = assess(
-        &controls,
-        &findings,
-        &ControlLinker::cra_seed(),
-        chrono::Utc::now(),
-    );
-    Json(assessment).into_response()
-}

compliance-agent/src/api/handlers/werkbank_jobs.rs

@@ -1,289 +0,0 @@
-//! Werkbank runner endpoints (`/api/v1/werkbank/jobs/*`).
-//!
-//! The pull API a Werkbank runner talks to: lease a job, heartbeat while it runs,
-//! and post the result back. Machine auth is a **static bearer token**
-//! (`WERKBANK_RUNNER_TOKEN`) — not a Keycloak JWT, because a runner acts across
-//! tenants (each request names its `tenant`). Routes are only mounted when the
-//! token is configured; with none set they don't exist (404).
-//!
-//! On completion the runner's findings are persisted against the job's target,
-//! so a job run by a remote runner lands the same findings an in-process run
-//! would (WB-05, the control-plane cut-over).
-
-use axum::extract::{Extension, Path, Request};
-use axum::http::{header, StatusCode};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use axum::Json;
-use mongodb::bson::{doc, oid::ObjectId};
-use secrecy::ExposeSecret;
-use serde::{Deserialize, Serialize};
-use std::time::Duration;
-
-use compliance_core::models::werkbank::{
-    CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
-};
-use compliance_core::models::ArtifactKind;
-
-use super::dto::AgentExt;
-use crate::database::Database;
-use crate::werkbank::JobQueue;
-
-/// Gate the runner endpoints behind the static runner bearer token.
-pub async fn require_runner_token(
-    Extension(agent): AgentExt,
-    request: Request,
-    next: Next,
-) -> Response {
-    let Some(expected) = agent.config.werkbank_runner_token.as_ref() else {
-        return (StatusCode::NOT_FOUND, "werkbank runner API disabled").into_response();
-    };
-    let presented = request
-        .headers()
-        .get(header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|s| s.strip_prefix("Bearer "))
-        .map(str::trim)
-        .filter(|s| !s.is_empty());
-    let Some(presented) = presented else {
-        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
-    };
-    if !constant_time_eq(presented, expected.expose_secret()) {
-        return (StatusCode::UNAUTHORIZED, "Invalid runner token").into_response();
-    }
-    next.run(request).await
-}
-
-/// `POST /api/v1/werkbank/jobs/lease` — lease the oldest runnable job, or `204`.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, runner = %req.runner_id))]
-pub async fn lease(
-    Extension(agent): AgentExt,
-    Json(req): Json<LeaseRequest>,
-) -> Result<Response, StatusCode> {
-    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
-    let leased = queue
-        .lease(
-            &req.runner_id,
-            req.executor,
-            &req.labels,
-            Duration::from_secs(req.lease_ttl_secs),
-            chrono::Utc::now(),
-        )
-        .await
-        .map_err(internal)?;
-    Ok(match leased {
-        Some(job) => Json(job).into_response(),
-        None => StatusCode::NO_CONTENT.into_response(),
-    })
-}
-
-/// `POST /api/v1/werkbank/jobs/heartbeat` — extend the lease; `409` if it's lost.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
-pub async fn heartbeat(
-    Extension(agent): AgentExt,
-    Json(req): Json<HeartbeatRequest>,
-) -> Result<Response, StatusCode> {
-    let queue = JobQueue::new(&tenant_db(&agent, &req.tenant).await?);
-    let ack = queue
-        .heartbeat(
-            &req.job_id,
-            &req.lease_token,
-            Duration::from_secs(req.lease_ttl_secs),
-            chrono::Utc::now(),
-        )
-        .await
-        .map_err(internal)?;
-    Ok(match ack {
-        Some(ack) => Json(ack).into_response(),
-        // Lease lost — the runner should abandon the job.
-        None => StatusCode::CONFLICT.into_response(),
-    })
-}
-
-/// `POST /api/v1/werkbank/jobs/complete` — record the result and persist findings.
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, job = %req.job_id))]
-pub async fn complete(
-    Extension(agent): AgentExt,
-    Json(req): Json<CompleteRequest>,
-) -> Result<Json<CompleteResponse>, StatusCode> {
-    let db = tenant_db(&agent, &req.tenant).await?;
-    let queue = JobQueue::new(&db);
-    let now = chrono::Utc::now();
-    let recorded = queue
-        .complete(&req.job_id, &req.lease_token, &req.result, now)
-        .await
-        .map_err(internal)?;
-
-    // Only persist findings for the run that actually recorded the result, so a
-    // duplicate/late completion can't double-insert.
-    if recorded {
-        if let Some(record) = queue.get(&req.job_id).await.map_err(internal)? {
-            persist_findings(&db, &record.job.target_id, &req.result).await;
-        }
-    }
-    Ok(Json(CompleteResponse { recorded }))
-}
-
-/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
-/// program a runner needs to load). The hash is validated against traversal by
-/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
-/// input.
-#[tracing::instrument(skip_all, fields(hash = %hash))]
-pub async fn serve_artifact(
-    Extension(agent): AgentExt,
-    Path(hash): Path<String>,
-) -> Result<Response, StatusCode> {
-    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
-    match crate::ingest::blob::read_blob(base, &hash) {
-        Ok(bytes) => {
-            Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
-        }
-        Err(_) => Err(StatusCode::NOT_FOUND),
-    }
-}
-
-/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
-/// stash it as a content-addressed blob (which the runner fetches via
-/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
-/// half of the loop — a runner then leases it, provisions, and posts results.
-#[derive(Debug, Deserialize)]
-pub struct EnqueueRequest {
-    /// The tenant whose queue to enqueue into.
-    pub tenant: String,
-    /// The onboarded target to test.
-    pub target_id: String,
-}
-
-/// The enqueued job's id.
-#[derive(Debug, Serialize)]
-pub struct EnqueueResponse {
-    /// The new job id.
-    pub job_id: String,
-    /// Whether this call inserted it (false = already queued).
-    pub enqueued: bool,
-}
-
-#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
-pub async fn enqueue(
-    Extension(agent): AgentExt,
-    Json(req): Json<EnqueueRequest>,
-) -> Result<Json<EnqueueResponse>, StatusCode> {
-    let db = tenant_db(&agent, &req.tenant).await?;
-    let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(internal)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // Extract the control-logic program from the target's PLC-source artifacts
-    // (same selection as the in-process PLC scan).
-    let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
-    let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
-    let program = target
-        .artifacts
-        .iter()
-        .filter(|a| {
-            matches!(
-                a.kind,
-                ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-            )
-        })
-        .find_map(|a| {
-            let path = ingest_set
-                .get(&a.id)
-                .and_then(|ia| ia.working_path.clone())?;
-            werkbank_exec::plc::extract_program(&path)
-        })
-        .ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
-
-    // Stash the program source so the runner can fetch it by hash.
-    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
-    let hash =
-        crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
-
-    let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
-    let job = Job::plc_provision(
-        &job_id,
-        &req.tenant,
-        &req.target_id,
-        InputRef::blob(hash),
-        agent.config.plc_runtime.max_lifetime_secs,
-    );
-    let enqueued = JobQueue::new(&db)
-        .enqueue(job, chrono::Utc::now())
-        .await
-        .map_err(internal)?;
-    Ok(Json(EnqueueResponse { job_id, enqueued }))
-}
-
-/// Persist a job result's findings against its target: general findings
-/// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
-/// is logged, not surfaced to the runner (its result is already recorded).
-async fn persist_findings(db: &Database, target_id: &str, result: &JobResult) {
-    for finding in &result.findings {
-        let exists = db
-            .findings()
-            .find_one(doc! { "fingerprint": &finding.fingerprint })
-            .await
-            .ok()
-            .flatten()
-            .is_some();
-        if !exists {
-            if let Err(e) = db.findings().insert_one(finding).await {
-                tracing::warn!(target_id, error = %e, "werkbank: persist finding failed");
-            }
-        }
-    }
-    for finding in &result.dast_findings {
-        if let Err(e) = db.dast_findings().insert_one(finding).await {
-            tracing::warn!(target_id, error = %e, "werkbank: persist DAST finding failed");
-        }
-    }
-    tracing::info!(
-        target_id,
-        findings = result.findings.len(),
-        dast = result.dast_findings.len(),
-        "werkbank: persisted runner results"
-    );
-}
-
-/// Resolve the tenant-scoped database for a request.
-async fn tenant_db(
-    agent: &crate::agent::ComplianceAgent,
-    tenant: &str,
-) -> Result<Database, StatusCode> {
-    agent.db_pool.for_tenant_id(tenant).await.map_err(internal)
-}
-
-/// Map any internal error to a 500.
-fn internal<E: std::fmt::Display>(e: E) -> StatusCode {
-    tracing::error!("werkbank endpoint error: {e}");
-    StatusCode::INTERNAL_SERVER_ERROR
-}
-
-/// Length-checked, constant-time-ish token comparison.
-fn constant_time_eq(a: &str, b: &str) -> bool {
-    if a.len() != b.len() {
-        return false;
-    }
-    let mut diff = 0u8;
-    for (x, y) in a.bytes().zip(b.bytes()) {
-        diff |= x ^ y;
-    }
-    diff == 0
-}
-
-#[cfg(test)]
-mod tests {
-    use super::constant_time_eq;
-
-    #[test]
-    fn token_compare() {
-        assert!(constant_time_eq("secret", "secret"));
-        assert!(!constant_time_eq("secret", "secrex"));
-        assert!(!constant_time_eq("secret", "secretx"));
-        assert!(!constant_time_eq("", "x"));
-    }
-}

compliance-agent/src/api/routes.rs

@@ -6,7 +6,6 @@ use crate::api::handlers;
 pub fn build_router() -> Router {
     Router::new()
         .route("/api/v1/health", get(handlers::health))
-        .route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
         .route("/api/v1/stats/overview", get(handlers::stats_overview))
         .route(
             "/api/v1/settings/ssh-public-key",

compliance-agent/src/api/server.rs

@@ -4,7 +4,7 @@ use axum::extract::{DefaultBodyLimit, Request};
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
-use axum::routing::{delete, get, post};
+use axum::routing::{delete, get};
 use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
@@ -72,43 +72,8 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
         Router::new()
     };
 
-    // Werkbank runner API. Like admin, only mounted when its bearer token is
-    // configured; runners authenticate with WERKBANK_RUNNER_TOKEN (not a JWT).
-    let werkbank_router: Router = if agent.config.werkbank_runner_token.is_some() {
-        tracing::info!(
-            "Werkbank runner API enabled — /api/v1/werkbank/jobs/* behind WERKBANK_RUNNER_TOKEN"
-        );
-        Router::new()
-            .route(
-                "/api/v1/werkbank/jobs/lease",
-                post(handlers::werkbank_jobs::lease),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/heartbeat",
-                post(handlers::werkbank_jobs::heartbeat),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/complete",
-                post(handlers::werkbank_jobs::complete),
-            )
-            .route(
-                "/api/v1/werkbank/jobs/enqueue",
-                post(handlers::werkbank_jobs::enqueue),
-            )
-            .route(
-                "/api/v1/werkbank/artifacts/{hash}",
-                get(handlers::werkbank_jobs::serve_artifact),
-            )
-            .layer(middleware::from_fn(
-                handlers::werkbank_jobs::require_runner_token,
-            ))
-    } else {
-        Router::new()
-    };
-
     let mut app = routes::build_router()
         .merge(admin_router)
-        .merge(werkbank_router)
         // Allow large artifact uploads (PLC .projectarchive, firmware images,
         // mobile packages) — axum's default request-body limit is only 2 MiB.
         .layer(DefaultBodyLimit::max(512 * 1024 * 1024))

compliance-agent/src/config.rs

@@ -1,4 +1,4 @@
-use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
+use compliance_core::config::PlcRuntimeConfig;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -65,8 +65,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
         admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
         tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
         plc_runtime: load_plc_runtime_config(),
-        werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
-        breakpilot: load_breakpilot_config(),
     })
 }
 
@@ -91,14 +89,3 @@ fn load_plc_runtime_config() -> PlcRuntimeConfig {
             .unwrap_or(d.openplc_password),
     }
 }
-
-/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
-/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
-fn load_breakpilot_config() -> BreakpilotConfig {
-    let d = BreakpilotConfig::default();
-    BreakpilotConfig {
-        base_url: env_var_opt("BREAKPILOT_BASE_URL"),
-        token: env_secret_opt("BREAKPILOT_TOKEN"),
-        snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
-    }
-}

compliance-agent/src/controls/mod.rs

@@ -1,10 +0,0 @@
-//! Controls corpus providers.
-//!
-//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
-//! the control corpus the mapping engine assesses findings against. Currently:
-//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
-//! and snapshots it locally.
-
-mod oscal_provider;
-
-pub use oscal_provider::OscalControlsProvider;

compliance-agent/src/controls/oscal_provider.rs

@@ -1,233 +0,0 @@
-//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
-//! catalog export.
-//!
-//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
-//! the exact bytes to disk (so scans are deterministic and keep working offline /
-//! on-prem), and maps the catalog into the corpus controls the mapping engine
-//! consumes. The producer owns the catalog; we own the assessment — this is the
-//! ingest half of the loop.
-
-use std::path::PathBuf;
-
-use secrecy::{ExposeSecret, SecretString};
-
-use compliance_core::error::CoreError;
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::models::oscal::OscalDocument;
-use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
-
-/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
-/// and snapshots it locally for deterministic / offline reuse.
-pub struct OscalControlsProvider {
-    http: reqwest::Client,
-    base_url: String,
-    token: Option<SecretString>,
-    snapshot_dir: PathBuf,
-}
-
-impl OscalControlsProvider {
-    /// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
-    /// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
-    /// snapshots are written so a later scan can reuse them without the network.
-    pub fn new(
-        http: reqwest::Client,
-        base_url: impl Into<String>,
-        token: Option<SecretString>,
-        snapshot_dir: impl Into<PathBuf>,
-    ) -> Self {
-        Self {
-            http,
-            base_url: base_url.into(),
-            token,
-            snapshot_dir: snapshot_dir.into(),
-        }
-    }
-
-    fn catalog_url(&self, framework: ComplianceFramework) -> String {
-        format!(
-            "{}/api/compliance/v1/oscal/catalog?framework={framework}",
-            self.base_url.trim_end_matches('/')
-        )
-    }
-
-    fn snapshot_path(&self, framework: ComplianceFramework) -> PathBuf {
-        self.snapshot_dir
-            .join(format!("oscal-catalog-{framework}.json"))
-    }
-
-    /// Fetch the raw catalog bytes for a framework over HTTP.
-    async fn fetch_raw(&self, framework: ComplianceFramework) -> Result<Vec<u8>, CoreError> {
-        let mut req = self.http.get(self.catalog_url(framework));
-        if let Some(token) = &self.token {
-            req = req.bearer_auth(token.expose_secret());
-        }
-        let resp = req
-            .send()
-            .await
-            .map_err(|e| CoreError::Http(e.to_string()))?;
-        if !resp.status().is_success() {
-            return Err(CoreError::Http(format!(
-                "catalog fetch for {framework} returned HTTP {}",
-                resp.status()
-            )));
-        }
-        resp.bytes()
-            .await
-            .map(|b| b.to_vec())
-            .map_err(|e| CoreError::Http(e.to_string()))
-    }
-
-    /// Write a catalog snapshot atomically (temp file + rename).
-    async fn write_snapshot(
-        &self,
-        framework: ComplianceFramework,
-        raw: &[u8],
-    ) -> Result<(), CoreError> {
-        tokio::fs::create_dir_all(&self.snapshot_dir).await?;
-        let path = self.snapshot_path(framework);
-        let tmp = path.with_extension("json.tmp");
-        tokio::fs::write(&tmp, raw).await?;
-        tokio::fs::rename(&tmp, &path).await?;
-        Ok(())
-    }
-
-    /// Read a previously written snapshot, if one exists.
-    async fn read_snapshot(
-        &self,
-        framework: ComplianceFramework,
-    ) -> Result<Option<OscalDocument>, CoreError> {
-        match tokio::fs::read(self.snapshot_path(framework)).await {
-            Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// Load the catalog for a framework: fetch fresh + snapshot the exact bytes;
-    /// on network failure, fall back to the last snapshot so scans still run.
-    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
-        match self.fetch_raw(framework).await {
-            Ok(raw) => {
-                let doc: OscalDocument = serde_json::from_slice(&raw)?;
-                if let Err(e) = self.write_snapshot(framework, &raw).await {
-                    tracing::warn!(%framework, error = %e, "failed to write OSCAL snapshot");
-                }
-                Ok(doc)
-            }
-            Err(fetch_err) => match self.read_snapshot(framework).await? {
-                Some(doc) => {
-                    tracing::warn!(
-                        %framework, error = %fetch_err,
-                        "OSCAL catalog fetch failed; falling back to snapshot"
-                    );
-                    Ok(doc)
-                }
-                None => Err(fetch_err),
-            },
-        }
-    }
-}
-
-/// Order controls whose title/text mention the query context first (stable), then
-/// truncate to the requested limit. Naive relevance — refined when the assessment
-/// layer lands.
-fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
-    if !context.is_empty() {
-        let needle = context.to_lowercase();
-        controls.sort_by_key(|c| {
-            let hit =
-                c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
-            u8::from(!hit)
-        });
-    }
-    controls.truncate(limit);
-    controls
-}
-
-impl ControlsProvider for OscalControlsProvider {
-    fn name(&self) -> &str {
-        "breakpilot-oscal"
-    }
-
-    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
-        let mut out: Vec<Control> = Vec::new();
-        for &framework in query.frameworks {
-            match self.load(framework).await {
-                Ok(doc) => out.extend(doc.to_controls()),
-                Err(e) => {
-                    tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
-                }
-            }
-        }
-        Ok(rank_and_truncate(out, query.context, query.limit))
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
-      "version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
-      "groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
-      "props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
-
-    fn provider(dir: &std::path::Path) -> OscalControlsProvider {
-        OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
-    }
-
-    #[test]
-    fn builds_catalog_url_and_snapshot_path() {
-        let p = provider(std::path::Path::new("/snap"));
-        assert_eq!(
-            p.catalog_url(ComplianceFramework::Cra),
-            "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
-        );
-        assert_eq!(
-            p.snapshot_path(ComplianceFramework::Cra),
-            std::path::Path::new("/snap/oscal-catalog-cra.json")
-        );
-    }
-
-    #[test]
-    fn ranks_context_hits_first_then_truncates() {
-        let mk = |id: &str, title: &str| Control {
-            id: id.into(),
-            framework: ComplianceFramework::Cra,
-            title: title.into(),
-            text: String::new(),
-            source: None,
-        };
-        let controls = vec![
-            mk("a", "logging policy"),
-            mk("b", "multi-factor auth"),
-            mk("c", "backup"),
-        ];
-        let ranked = rank_and_truncate(controls, "auth", 2);
-        assert_eq!(ranked.len(), 2);
-        assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
-    }
-
-    #[tokio::test]
-    async fn snapshot_round_trip_and_offline_fallback() {
-        let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
-        let p = provider(&dir);
-        assert!(p
-            .read_snapshot(ComplianceFramework::Cra)
-            .await
-            .unwrap()
-            .is_none());
-        p.write_snapshot(ComplianceFramework::Cra, MINI_CATALOG.as_bytes())
-            .await
-            .unwrap();
-        let doc = p
-            .read_snapshot(ComplianceFramework::Cra)
-            .await
-            .unwrap()
-            .unwrap();
-        assert_eq!(doc.to_controls().len(), 1);
-        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-}

compliance-agent/src/database.rs

@@ -465,34 +465,6 @@ impl Database {
             )
             .await?;
 
-        // werkbank_jobs: unique job id (idempotent enqueue by job id)
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "job.id": 1 })
-                    .options(IndexOptions::builder().unique(true).build())
-                    .build(),
-            )
-            .await?;
-
-        // werkbank_jobs: lease query — oldest queued job for an executor
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // werkbank_jobs: visibility-timeout sweep of expired leases
-        self.werkbank_jobs()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "status": 1, "lease_expires_at": 1 })
-                    .build(),
-            )
-            .await?;
-
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -591,12 +563,6 @@ impl Database {
         self.inner.collection("pentest_messages")
     }
 
-    /// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
-    /// control plane enqueues and runners lease.
-    pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
-        self.inner.collection("werkbank_jobs")
-    }
-
     #[allow(dead_code)]
     pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
         self.inner.collection(name)

compliance-agent/src/error.rs

@@ -27,9 +27,6 @@ pub enum AgentError {
     #[error("Configuration error: {0}")]
     Config(String),
 
-    #[error("Dynamic-execution error: {0}")]
-    Exec(#[from] werkbank_exec::ExecError),
-
     #[error("{0}")]
     Other(String),
 }

compliance-agent/src/ingest/blob.rs

@@ -32,30 +32,6 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
     Ok((hex::encode(hasher.finalize()), total))
 }
 
-/// Store raw bytes in the content-addressed blob store under `base`, returning
-/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
-/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
-pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
-    let sha = hex::encode(Sha256::digest(bytes));
-    let dir = base.join("blobs").join(&sha[0..2]);
-    fs::create_dir_all(&dir)?;
-    let dest = dir.join(&sha);
-    if !dest.exists() {
-        fs::write(&dest, bytes)?;
-    }
-    Ok(sha)
-}
-
-/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
-/// so a request can't traverse outside the blob store.
-pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
-    if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
-        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
-    }
-    let path = base.join("blobs").join(&sha[0..2]).join(sha);
-    Ok(fs::read(path)?)
-}
-
 /// Copy `src` into the content-addressed blob store under `base`, returning the
 /// stored path. Idempotent: an already-present blob is not rewritten.
 pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {

compliance-agent/src/ingest/mod.rs

@@ -6,7 +6,7 @@
 //! is also the reconciliation key against sibling products (a firmware sha256
 //! matches tramiton's `Artifact.sha256`).
 
-pub(crate) mod blob;
+mod blob;
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};

compliance-agent/src/lib.rs

@@ -4,7 +4,6 @@ pub mod agent;
 pub mod api;
 pub mod classify;
 pub mod config;
-pub mod controls;
 pub mod database;
 pub mod error;
 pub mod ingest;
@@ -17,4 +16,3 @@ pub mod ssh;
 #[allow(dead_code)]
 pub mod trackers;
 pub mod webhooks;
-pub mod werkbank;

compliance-agent/src/pentest/cleanup.rs

@@ -343,8 +343,6 @@ mod tests {
             admin_api_token: None,
             tenant_registry_url: None,
             plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-            werkbank_runner_token: None,
-            breakpilot: compliance_core::config::BreakpilotConfig::default(),
         }
     }
 

compliance-agent/src/pipeline/ics/mod.rs

@@ -14,7 +14,7 @@ use std::time::Duration;
 
 use compliance_core::models::{Finding, ScanType, Severity};
 
-use crate::fingerprint as dedup;
+use crate::pipeline::dedup;
 
 /// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
 const MODBUS_PORT: u16 = 502;

compliance-agent/src/pipeline/mod.rs

@@ -5,6 +5,7 @@ pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
+pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;

compliance-agent/src/pipeline/orchestrator.rs

@@ -587,7 +587,7 @@ impl PipelineOrchestrator {
                 let path = ingest_set
                     .get(&a.id)
                     .and_then(|ia| ia.working_path.clone())?;
-                werkbank_exec::plc::extract_program(&path)
+                crate::pipeline::plc::runtime::extract_program(&path)
             });
         let Some(program) = program else {
             tracing::info!(
@@ -597,9 +597,10 @@ impl PipelineOrchestrator {
             return Ok(0);
         };
 
-        let http = werkbank_exec::plc::http_client()?;
-        let provisioner = werkbank_exec::plc::DockerSoftPlc::new(self.config.plc_runtime.clone());
-        let outcome = werkbank_exec::plc::provision_and_test(
+        let http = crate::pipeline::plc::runtime::http_client()?;
+        let provisioner =
+            crate::pipeline::plc::runtime::DockerSoftPlc::new(self.config.plc_runtime.clone());
+        let outcome = crate::pipeline::plc::runtime::provision_and_test(
             &provisioner,
             &http,
             &self.config.plc_runtime,
@@ -662,7 +663,7 @@ impl PipelineOrchestrator {
         };
         // Short per-request budget so an unreachable device doesn't stall the scan.
         let budget = std::time::Duration::from_secs(5);
-        let findings = werkbank_exec::ics::probe_target(&endpoint, target_id, budget).await;
+        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
         tracing::info!(
             target_id,
             endpoint = %endpoint,

compliance-agent/src/pipeline/plc/mod.rs

@@ -9,6 +9,7 @@ pub mod lexer;
 pub mod parser;
 pub mod plcopen;
 pub mod rules;
+pub mod runtime;
 pub mod sbom;
 
 use std::path::Path;

compliance-agent/src/pipeline/plc/runtime/mod.rs

@@ -24,7 +24,7 @@ use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTa
 use compliance_core::models::Finding;
 use compliance_core::PlcRuntimeConfig;
 
-use crate::error::ExecError;
+use crate::error::AgentError;
 
 pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
 
@@ -61,12 +61,12 @@ pub struct PlcProgram {
 
 /// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
 /// isolates the OpenPLC session (its Flask login cookie) from every other scan.
-pub fn http_client() -> Result<reqwest::Client, ExecError> {
+pub fn http_client() -> Result<reqwest::Client, AgentError> {
     reqwest::Client::builder()
         .cookie_store(true)
         .timeout(Duration::from_secs(30))
         .build()
-        .map_err(ExecError::Http)
+        .map_err(AgentError::Http)
 }
 
 /// Pick the control-logic program to run from an ingested PLC source tree.
@@ -151,7 +151,7 @@ pub async fn provision_and_test<P: SoftPlc>(
     cfg: &PlcRuntimeConfig,
     program: &PlcProgram,
     target_id: &str,
-) -> Result<ProvisionOutcome, ExecError> {
+) -> Result<ProvisionOutcome, AgentError> {
     let handle = provisioner.provision(target_id).await?;
     tracing::info!(
         target_id,
@@ -193,7 +193,7 @@ async fn run_dynamic_test(
     program: &PlcProgram,
     target_id: &str,
     handle: &ProvisionedRuntime,
-) -> Result<ProvisionOutcome, ExecError> {
+) -> Result<ProvisionOutcome, AgentError> {
     let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
     openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
 
@@ -212,7 +212,8 @@ async fn run_dynamic_test(
     tokio::time::sleep(Duration::from_secs(3)).await;
 
     let probe_budget = Duration::from_secs(5);
-    let findings = crate::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
+    let findings =
+        crate::pipeline::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
     tracing::info!(
         target_id,
         instance = %handle.name,
@@ -347,10 +348,10 @@ mod tests {
     }
 
     impl SoftPlc for FakeSoftPlc {
-        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
+        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, AgentError> {
             self.provisions.fetch_add(1, Ordering::SeqCst);
             if self.fail_provision {
-                return Err(ExecError::Other("provision failed".into()));
+                return Err(AgentError::Other("provision failed".into()));
             }
             // Unreachable address so run_dynamic_test blocks on readiness until the
             // deadline fires — exercising the teardown-on-deadline path.

compliance-agent/src/pipeline/plc/runtime/openplc.rs

@@ -10,7 +10,7 @@
 
 use std::time::Duration;
 
-use crate::error::ExecError;
+use crate::error::AgentError;
 
 use super::PlcProgram;
 
@@ -27,7 +27,7 @@ pub async fn wait_ready(
     http: &reqwest::Client,
     base_url: &str,
     budget: Duration,
-) -> Result<(), ExecError> {
+) -> Result<(), AgentError> {
     let login = format!("{base_url}/login");
     let outcome = tokio::time::timeout(budget, async {
         loop {
@@ -40,7 +40,7 @@ pub async fn wait_ready(
         }
     })
     .await;
-    outcome.map_err(|_| ExecError::Other(format!("OpenPLC at {base_url} did not become ready")))
+    outcome.map_err(|_| AgentError::Other(format!("OpenPLC at {base_url} did not become ready")))
 }
 
 /// Log in, upload the program, compile it, and start the runtime. On success the
@@ -52,7 +52,7 @@ pub async fn load_and_start(
     password: &str,
     program: &PlcProgram,
     compile_budget: Duration,
-) -> Result<(), ExecError> {
+) -> Result<(), AgentError> {
     login(http, base_url, user, password).await?;
     let prog_file = upload_program(http, base_url, program).await?;
     save_program(http, base_url, &prog_file).await?;
@@ -68,14 +68,14 @@ async fn login(
     base_url: &str,
     user: &str,
     password: &str,
-) -> Result<(), ExecError> {
+) -> Result<(), AgentError> {
     let resp = http
         .post(format!("{base_url}/login"))
         .form(&[("username", user), ("password", password)])
         .send()
         .await?;
     if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
+        return Err(AgentError::Other(format!(
             "OpenPLC login failed: HTTP {}",
             resp.status()
         )));
@@ -90,7 +90,7 @@ async fn upload_program(
     http: &reqwest::Client,
     base_url: &str,
     program: &PlcProgram,
-) -> Result<String, ExecError> {
+) -> Result<String, AgentError> {
     let part = reqwest::multipart::Part::text(program.source.clone())
         .file_name(program.file_name.clone())
         .mime_str("application/octet-stream")?;
@@ -102,7 +102,7 @@ async fn upload_program(
         .await?;
     let html = resp.text().await?;
     parse_prog_file(&html).ok_or_else(|| {
-        ExecError::Other("OpenPLC upload did not return a prog_file handle".to_string())
+        AgentError::Other("OpenPLC upload did not return a prog_file handle".to_string())
     })
 }
 
@@ -113,7 +113,7 @@ async fn save_program(
     http: &reqwest::Client,
     base_url: &str,
     prog_file: &str,
-) -> Result<(), ExecError> {
+) -> Result<(), AgentError> {
     let epoch = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_secs())
@@ -130,7 +130,7 @@ async fn save_program(
         .send()
         .await?;
     if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
+        return Err(AgentError::Other(format!(
             "OpenPLC save-program failed: HTTP {}",
             resp.status()
         )));
@@ -146,7 +146,7 @@ async fn compile(
     base_url: &str,
     prog_file: &str,
     budget: Duration,
-) -> Result<(), ExecError> {
+) -> Result<(), AgentError> {
     http.get(format!("{base_url}/compile-program"))
         .query(&[("file", prog_file)])
         .send()
@@ -168,20 +168,20 @@ async fn compile(
     .await;
     match outcome {
         Ok(true) => Ok(()),
-        Ok(false) => Err(ExecError::Other(
+        Ok(false) => Err(AgentError::Other(
             "OpenPLC compilation finished with errors".to_string(),
         )),
-        Err(_) => Err(ExecError::Other(
+        Err(_) => Err(AgentError::Other(
             "OpenPLC compilation did not finish in time".to_string(),
         )),
     }
 }
 
 /// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
-async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), ExecError> {
+async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), AgentError> {
     let resp = http.get(format!("{base_url}/start_plc")).send().await?;
     if resp.status().is_server_error() {
-        return Err(ExecError::Other(format!(
+        return Err(AgentError::Other(format!(
             "OpenPLC start_plc failed: HTTP {}",
             resp.status()
         )));

compliance-agent/src/pipeline/plc/runtime/provision.rs

@@ -15,7 +15,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 use compliance_core::PlcRuntimeConfig;
 
-use crate::error::ExecError;
+use crate::error::AgentError;
 
 /// The Modbus/TCP port an OpenPLC instance opens once a program is running.
 const MODBUS_PORT: u16 = 502;
@@ -45,7 +45,7 @@ pub trait SoftPlc {
     fn provision(
         &self,
         target_id: &str,
-    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, ExecError>> + Send;
+    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, AgentError>> + Send;
 
     /// Tear an instance down. Best-effort and idempotent — never fails the scan.
     fn teardown(&self, handle: &ProvisionedRuntime)
@@ -65,7 +65,7 @@ impl DockerSoftPlc {
 }
 
 impl SoftPlc for DockerSoftPlc {
-    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, ExecError> {
+    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, AgentError> {
         // Best-effort sweep of any container leaked by a crashed earlier run
         // before we add another. Only removes instances past their max lifetime,
         // so it can never disturb a concurrent run.
@@ -75,7 +75,7 @@ impl SoftPlc for DockerSoftPlc {
         let args = run_args(&self.cfg, &name, target_id);
         let out = run_docker(&args).await?;
         if !out.status.success() {
-            return Err(ExecError::Other(format!(
+            return Err(AgentError::Other(format!(
                 "docker run for soft-PLC {name} failed: {}",
                 String::from_utf8_lossy(&out.stderr).trim()
             )));
@@ -215,12 +215,12 @@ async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
 }
 
 /// Run a `docker` subcommand, capturing its output.
-async fn run_docker(args: &[String]) -> Result<std::process::Output, ExecError> {
+async fn run_docker(args: &[String]) -> Result<std::process::Output, AgentError> {
     tokio::process::Command::new("docker")
         .args(args)
         .output()
         .await
-        .map_err(ExecError::Io)
+        .map_err(AgentError::Io)
 }
 
 #[cfg(test)]

compliance-agent/src/werkbank/mod.rs

@@ -1,10 +0,0 @@
-//! Werkbank control-plane: the dynamic-execution job queue.
-//!
-//! The control plane enqueues declarative [`Job`](compliance_core::models::werkbank::Job)s
-//! and Werkbank runners lease, run, and complete them. [`queue::JobQueue`] is the
-//! Mongo-backed queue behind that flow (WB-02); the runner-facing HTTP transport
-//! and the runner itself land in later stories.
-
-pub mod queue;
-
-pub use queue::{JobQueue, SweepOutcome};

compliance-agent/src/werkbank/queue.rs

@@ -1,309 +0,0 @@
-//! The Mongo-backed Werkbank job queue (WB-02).
-//!
-//! A pull queue: the control plane [`enqueue`](JobQueue::enqueue)s jobs; a runner
-//! [`lease`](JobQueue::lease)s the oldest queued job it can run (matched by
-//! executor + labels), [`heartbeat`](JobQueue::heartbeat)s while it works, and
-//! [`complete`](JobQueue::complete)s it. Leases carry a visibility timeout: if a
-//! runner dies mid-job its heartbeats stop, the lease expires, and
-//! [`sweep_expired`](JobQueue::sweep_expired) returns the job to `queued` (or
-//! `expired` once it has been retried too many times).
-//!
-//! All state transitions are single atomic Mongo updates guarded by the lease
-//! token, so two runners can never both own a job. Every operation takes an
-//! explicit `now` so the queue's time-dependent behaviour is deterministically
-//! testable.
-
-use std::time::Duration;
-
-use chrono::{DateTime, Utc};
-use mongodb::bson::{doc, Bson, DateTime as BsonDateTime};
-use mongodb::error::{ErrorKind, WriteFailure};
-use mongodb::options::ReturnDocument;
-use mongodb::Collection;
-
-use compliance_core::models::werkbank::{
-    Executor, HeartbeatAck, Job, JobRecord, JobResult, JobStatus, LeasedJob,
-};
-
-use crate::database::Database;
-use crate::error::AgentError;
-
-/// The non-terminal states a job can be swept or cancelled from.
-const ACTIVE_STATES: [&str; 2] = ["leased", "running"];
-/// Every terminal state (no further transitions).
-const TERMINAL_STATES: [&str; 4] = ["succeeded", "failed", "expired", "cancelled"];
-
-/// What a visibility-timeout sweep did.
-#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
-pub struct SweepOutcome {
-    /// Expired-lease jobs returned to `queued` for another runner.
-    pub requeued: u64,
-    /// Jobs that had exhausted their attempts and were marked `expired`.
-    pub expired: u64,
-}
-
-/// The Mongo-backed job queue.
-pub struct JobQueue {
-    coll: Collection<JobRecord>,
-}
-
-impl JobQueue {
-    /// Build a queue over a tenant database's `werkbank_jobs` collection.
-    pub fn new(db: &Database) -> Self {
-        Self {
-            coll: db.werkbank_jobs(),
-        }
-    }
-
-    /// Enqueue a job. Idempotent by job id: a job that is already present is a
-    /// no-op. Returns `true` if this call inserted it, `false` if it existed.
-    pub async fn enqueue(&self, job: Job, now: DateTime<Utc>) -> Result<bool, AgentError> {
-        let record = JobRecord::queued(job, now);
-        match self.coll.insert_one(&record).await {
-            Ok(_) => Ok(true),
-            Err(e) if is_duplicate_key(&e) => Ok(false),
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// Atomically lease the oldest `queued` job this runner can run — matched by
-    /// executor and by labels (every label the job requires must be one the
-    /// runner advertises). Returns the job plus a lease token, or `None` if
-    /// nothing is runnable.
-    pub async fn lease(
-        &self,
-        runner_id: &str,
-        executor: Executor,
-        runner_labels: &[String],
-        lease_ttl: Duration,
-        now: DateTime<Utc>,
-    ) -> Result<Option<LeasedJob>, AgentError> {
-        let token = uuid::Uuid::new_v4().to_string();
-        let expires = bson_dt(now + ttl(lease_ttl));
-        let executor_bson = mongodb::bson::to_bson(&executor).unwrap_or(Bson::Null);
-
-        let filter = doc! {
-            "status": "queued",
-            "cancel_requested": { "$ne": true },
-            "job.executor": executor_bson,
-            // Every label the job requires must be in the runner's set — i.e. the
-            // job has no label that is not offered by the runner. Absent/empty
-            // job labels match any runner.
-            "job.labels": { "$not": { "$elemMatch": { "$nin": runner_labels.to_vec() } } },
-        };
-        let update = doc! {
-            "$set": {
-                "status": "leased",
-                "lease_token": &token,
-                "leased_by": runner_id,
-                "lease_expires_at": expires,
-                "heartbeat_at": bson_dt(now),
-                "updated_at": bson_dt(now),
-            },
-            "$inc": { "attempts": 1 },
-        };
-
-        let record = self
-            .coll
-            .find_one_and_update(filter, update)
-            .sort(doc! { "created_at": 1 }) // FIFO
-            .return_document(ReturnDocument::After)
-            .await?;
-        Ok(record.map(|r| LeasedJob {
-            job: r.job,
-            lease_token: token,
-        }))
-    }
-
-    /// Extend a lease and report whether the job has been asked to cancel.
-    /// Transitions the job to `running` on the first heartbeat. Returns `None`
-    /// when the lease is no longer valid (token mismatch, or the job is already
-    /// terminal) — the runner should then abandon the work.
-    pub async fn heartbeat(
-        &self,
-        job_id: &str,
-        lease_token: &str,
-        lease_ttl: Duration,
-        now: DateTime<Utc>,
-    ) -> Result<Option<HeartbeatAck>, AgentError> {
-        let filter = doc! {
-            "job.id": job_id,
-            "lease_token": lease_token,
-            "status": { "$in": ACTIVE_STATES.to_vec() },
-        };
-        let update = doc! {
-            "$set": {
-                "status": "running",
-                "lease_expires_at": bson_dt(now + ttl(lease_ttl)),
-                "heartbeat_at": bson_dt(now),
-                "updated_at": bson_dt(now),
-            },
-        };
-        let record = self
-            .coll
-            .find_one_and_update(filter, update)
-            .return_document(ReturnDocument::After)
-            .await?;
-        Ok(record.map(|r| HeartbeatAck {
-            cancelled: r.cancel_requested,
-        }))
-    }
-
-    /// Record a job's terminal result. Guarded by the lease token and only from
-    /// an active (`leased`/`running`) state, so it is idempotent — a duplicate or
-    /// late submission after the job already finished matches nothing. Returns
-    /// `true` if this call recorded the result.
-    pub async fn complete(
-        &self,
-        job_id: &str,
-        lease_token: &str,
-        result: &JobResult,
-        now: DateTime<Utc>,
-    ) -> Result<bool, AgentError> {
-        let status = result.status.unwrap_or(JobStatus::Failed);
-        let status_bson = mongodb::bson::to_bson(&status).unwrap_or(Bson::String("failed".into()));
-        let result_bson =
-            mongodb::bson::to_bson(result).map_err(|e| AgentError::Other(e.to_string()))?;
-
-        let filter = doc! {
-            "job.id": job_id,
-            "lease_token": lease_token,
-            "status": { "$in": ACTIVE_STATES.to_vec() },
-        };
-        let update = doc! {
-            "$set": {
-                "status": status_bson,
-                "result": result_bson,
-                "lease_token": Bson::Null,
-                "lease_expires_at": Bson::Null,
-                "updated_at": bson_dt(now),
-            },
-        };
-        let res = self.coll.update_one(filter, update).await?;
-        Ok(res.modified_count == 1)
-    }
-
-    /// Request cancellation of a job. A still-`queued` job is cancelled outright;
-    /// an in-flight one is flagged so the runner sees it on its next heartbeat and
-    /// tears down. Returns `true` if a non-terminal job matched.
-    pub async fn cancel(&self, job_id: &str, now: DateTime<Utc>) -> Result<bool, AgentError> {
-        let filter = doc! {
-            "job.id": job_id,
-            "status": { "$nin": TERMINAL_STATES.to_vec() },
-        };
-        // Pipeline update: flag cancellation, and if still queued flip straight to
-        // cancelled (nothing is running it).
-        let pipeline = vec![doc! {
-            "$set": {
-                "cancel_requested": true,
-                "status": {
-                    "$cond": [ { "$eq": ["$status", "queued"] }, "cancelled", "$status" ]
-                },
-                "updated_at": bson_dt(now),
-            }
-        }];
-        let res = self.coll.update_one(filter, pipeline).await?;
-        Ok(res.matched_count == 1)
-    }
-
-    /// Sweep leases whose visibility timeout has elapsed: return them to `queued`
-    /// for another runner, or mark them `expired` once they have been leased
-    /// `max_attempts` times. This is what makes a crashed runner's job recover.
-    pub async fn sweep_expired(
-        &self,
-        now: DateTime<Utc>,
-        max_attempts: u32,
-        // (kept explicit rather than a const so callers can tune retry policy)
-    ) -> Result<SweepOutcome, AgentError> {
-        let now_bson = bson_dt(now);
-        let max = i64::from(max_attempts);
-
-        let requeue = self
-            .coll
-            .update_many(
-                doc! {
-                    "status": { "$in": ACTIVE_STATES.to_vec() },
-                    "lease_expires_at": { "$lt": &now_bson },
-                    "attempts": { "$lt": max },
-                },
-                doc! { "$set": {
-                    "status": "queued",
-                    "lease_token": Bson::Null,
-                    "leased_by": Bson::Null,
-                    "lease_expires_at": Bson::Null,
-                    "updated_at": &now_bson,
-                } },
-            )
-            .await?;
-
-        let expire = self
-            .coll
-            .update_many(
-                doc! {
-                    "status": { "$in": ACTIVE_STATES.to_vec() },
-                    "lease_expires_at": { "$lt": &now_bson },
-                    "attempts": { "$gte": max },
-                },
-                doc! { "$set": {
-                    "status": "expired",
-                    "lease_token": Bson::Null,
-                    "lease_expires_at": Bson::Null,
-                    "updated_at": &now_bson,
-                } },
-            )
-            .await?;
-
-        Ok(SweepOutcome {
-            requeued: requeue.modified_count,
-            expired: expire.modified_count,
-        })
-    }
-
-    /// Fetch a job record by job id (inspection / control-plane reads).
-    pub async fn get(&self, job_id: &str) -> Result<Option<JobRecord>, AgentError> {
-        Ok(self.coll.find_one(doc! { "job.id": job_id }).await?)
-    }
-}
-
-/// A `chrono::Duration` for a lease TTL, saturating rather than panicking on an
-/// absurd input (`chrono::Duration::seconds` panics past its internal bound).
-fn ttl(d: Duration) -> chrono::Duration {
-    let secs = i64::try_from(d.as_secs()).unwrap_or(i64::MAX);
-    chrono::Duration::try_seconds(secs).unwrap_or(chrono::Duration::MAX)
-}
-
-/// A chrono instant as a BSON date (so Mongo stores/compares it as a real date).
-fn bson_dt(dt: DateTime<Utc>) -> BsonDateTime {
-    BsonDateTime::from_chrono(dt)
-}
-
-/// Whether a Mongo error is a duplicate-key (E11000) violation — a job with this
-/// id is already enqueued.
-fn is_duplicate_key(e: &mongodb::error::Error) -> bool {
-    match &*e.kind {
-        ErrorKind::Write(WriteFailure::WriteError(we)) => we.code == 11000,
-        _ => false,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ttl_saturates_and_converts() {
-        assert_eq!(ttl(Duration::from_secs(30)), chrono::Duration::seconds(30));
-        // An absurd TTL saturates instead of panicking.
-        assert_eq!(ttl(Duration::from_secs(u64::MAX)), chrono::Duration::MAX);
-    }
-
-    #[test]
-    fn state_constants_are_disjoint() {
-        for s in ACTIVE_STATES {
-            assert!(
-                !TERMINAL_STATES.contains(&s),
-                "{s} cannot be both active and terminal"
-            );
-        }
-    }
-}

compliance-agent/tests/common/mod.rs

@@ -2,10 +2,6 @@
 //
 // Spins up the agent API server on a random port with an isolated test
 // database. Each test gets a fresh database that is dropped on cleanup.
-//
-// Included via `mod common;` in several test binaries; not every binary uses
-// every helper, so allow dead code here.
-#![allow(dead_code)]
 
 use std::sync::Arc;
 
@@ -15,55 +11,6 @@ use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
-/// The runner bearer token wired into the test config.
-pub const TEST_RUNNER_TOKEN: &str = "test-runner-token";
-
-/// A minimal dev [`AgentConfig`] for tests: unauthenticated (no Keycloak), the
-/// Werkbank runner API enabled with [`TEST_RUNNER_TOKEN`].
-pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
-    AgentConfig {
-        mongodb_uri,
-        mongodb_database: db_name,
-        litellm_url: std::env::var("TEST_LITELLM_URL")
-            .unwrap_or_else(|_| "http://localhost:4000".into()),
-        litellm_api_key: SecretString::from(String::new()),
-        litellm_model: "gpt-4o".into(),
-        litellm_embed_model: "text-embedding-3-small".into(),
-        agent_port: 0, // not used — we bind ourselves
-        scan_schedule: String::new(),
-        cve_monitor_schedule: String::new(),
-        git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-        artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
-        ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
-        github_token: None,
-        github_webhook_secret: None,
-        gitlab_url: None,
-        gitlab_token: None,
-        gitlab_webhook_secret: None,
-        jira_url: None,
-        jira_email: None,
-        jira_api_token: None,
-        jira_project_key: None,
-        searxng_url: None,
-        nvd_api_key: None,
-        keycloak_url: None,
-        keycloak_realm: None,
-        keycloak_admin_username: None,
-        keycloak_admin_password: None,
-        pentest_verification_email: None,
-        pentest_imap_host: None,
-        pentest_imap_port: None,
-        pentest_imap_tls: false,
-        pentest_imap_username: None,
-        pentest_imap_password: None,
-        admin_api_token: None,
-        tenant_registry_url: None,
-        plc_runtime: compliance_core::PlcRuntimeConfig::default(),
-        werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
-        breakpilot: compliance_core::config::BreakpilotConfig::default(),
-    }
-}
-
 /// A running test server with a unique database.
 pub struct TestServer {
     pub base_url: String,
@@ -86,7 +33,45 @@ impl TestServer {
             .await
             .expect("Failed to build DatabasePool");
 
-        let config = dev_config(mongodb_uri.clone(), db_name.clone());
+        let config = AgentConfig {
+            mongodb_uri: mongodb_uri.clone(),
+            mongodb_database: db_name.clone(),
+            litellm_url: std::env::var("TEST_LITELLM_URL")
+                .unwrap_or_else(|_| "http://localhost:4000".into()),
+            litellm_api_key: SecretString::from(String::new()),
+            litellm_model: "gpt-4o".into(),
+            litellm_embed_model: "text-embedding-3-small".into(),
+            agent_port: 0, // not used — we bind ourselves
+            scan_schedule: String::new(),
+            cve_monitor_schedule: String::new(),
+            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
+            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
+            github_token: None,
+            github_webhook_secret: None,
+            gitlab_url: None,
+            gitlab_token: None,
+            gitlab_webhook_secret: None,
+            jira_url: None,
+            jira_email: None,
+            jira_api_token: None,
+            jira_project_key: None,
+            searxng_url: None,
+            nvd_api_key: None,
+            keycloak_url: None,
+            keycloak_realm: None,
+            keycloak_admin_username: None,
+            keycloak_admin_password: None,
+            pentest_verification_email: None,
+            pentest_imap_host: None,
+            pentest_imap_port: None,
+            pentest_imap_tls: false,
+            pentest_imap_username: None,
+            pentest_imap_password: None,
+            admin_api_token: None,
+            tenant_registry_url: None,
+            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
+        };
 
         let agent = ComplianceAgent::new(config, db_pool);
 

compliance-agent/tests/werkbank_api.rs

@@ -1,291 +0,0 @@
-//! Integration tests for the Werkbank runner endpoints (WB-05).
-//!
-//! Drives the real HTTP handlers (lease/heartbeat/complete) against a live Mongo:
-//! a runner leases a seeded job, completes it, and the result's findings are
-//! persisted against the job's target. Also checks the bearer-token gate. Skips
-//! cleanly when no Mongo is reachable.
-
-#![allow(clippy::expect_used, clippy::unwrap_used)]
-
-mod common;
-
-use std::sync::Arc;
-
-use axum::routing::{get, post};
-use axum::{middleware, Extension, Router};
-
-use compliance_agent::agent::ComplianceAgent;
-use compliance_agent::api::handlers::werkbank_jobs;
-use compliance_agent::database::DatabasePool;
-use compliance_agent::werkbank::JobQueue;
-use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
-use compliance_core::models::{
-    Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
-};
-
-use common::{dev_config, TEST_RUNNER_TOKEN};
-
-const TENANT: &str = "dev";
-
-/// A running werkbank API on a random port, or `None` if no Mongo.
-struct Harness {
-    base_url: String,
-    client: reqwest::Client,
-    pool: DatabasePool,
-    db_name: String,
-}
-
-async fn start() -> Option<Harness> {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    let db_name = format!("wba_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
-    let pool = match DatabasePool::connect(&uri, &db_name).await {
-        Ok(p) => p,
-        Err(_) => {
-            eprintln!("SKIP werkbank_api: no MongoDB reachable at {uri}");
-            return None;
-        }
-    };
-    // Touch the tenant DB so indexes are ensured before the queue is used.
-    pool.for_tenant_id(TENANT).await.expect("tenant db");
-
-    let agent = ComplianceAgent::new(dev_config(uri, db_name.clone()), pool.clone());
-    let app = Router::new()
-        .route("/api/v1/werkbank/jobs/lease", post(werkbank_jobs::lease))
-        .route(
-            "/api/v1/werkbank/jobs/heartbeat",
-            post(werkbank_jobs::heartbeat),
-        )
-        .route(
-            "/api/v1/werkbank/jobs/complete",
-            post(werkbank_jobs::complete),
-        )
-        .route(
-            "/api/v1/werkbank/jobs/enqueue",
-            post(werkbank_jobs::enqueue),
-        )
-        .route(
-            "/api/v1/werkbank/artifacts/{hash}",
-            get(werkbank_jobs::serve_artifact),
-        )
-        .layer(middleware::from_fn(werkbank_jobs::require_runner_token))
-        .layer(Extension(Arc::new(agent)));
-
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-    let port = listener.local_addr().unwrap().port();
-    tokio::spawn(async move {
-        axum::serve(listener, app).await.ok();
-    });
-
-    Some(Harness {
-        base_url: format!("http://127.0.0.1:{port}"),
-        client: reqwest::Client::new(),
-        pool,
-        db_name,
-    })
-}
-
-impl Harness {
-    fn post(
-        &self,
-        path: &str,
-        token: Option<&str>,
-        body: serde_json::Value,
-    ) -> reqwest::RequestBuilder {
-        let mut r = self
-            .client
-            .post(format!("{}{path}", self.base_url))
-            .json(&body);
-        if let Some(t) = token {
-            r = r.bearer_auth(t);
-        }
-        r
-    }
-    async fn cleanup(&self) {
-        let _ = self
-            .pool
-            .client()
-            .database(&format!("{}_{TENANT}", self.db_name))
-            .drop()
-            .await;
-    }
-}
-
-fn finding_for(target: &str, fp: &str) -> Finding {
-    let mut f = Finding::new(
-        target.to_string(),
-        fp.to_string(),
-        "ics-probe".to_string(),
-        ScanType::IcsProbe,
-        "Modbus exposed".to_string(),
-        "unauthenticated".to_string(),
-        Severity::Critical,
-    );
-    f.rule_id = Some("ics-modbus-exposed".to_string());
-    f
-}
-
-#[tokio::test]
-async fn lease_complete_persists_findings_against_the_target() {
-    let Some(h) = start().await else { return };
-    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
-    let queue = JobQueue::new(&db);
-
-    // Seed a queued job.
-    let job = Job::plc_provision("job-1", TENANT, "target-1", InputRef::blob("sha256:x"), 180);
-    assert!(queue.enqueue(job, chrono::Utc::now()).await.unwrap());
-
-    // Lease it over HTTP.
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/lease",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-                "labels": [], "lease_ttl_secs": 60
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200, "lease should return a job");
-    let leased: LeasedJob = resp.json().await.unwrap();
-    assert_eq!(leased.job.id, "job-1");
-
-    // Complete it with a finding.
-    let mut result = JobResult::succeeded("job-1");
-    result.findings = vec![finding_for("target-1", "fp-abc")];
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/complete",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "job_id": "job-1",
-                "lease_token": leased.lease_token, "result": result
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200);
-    assert!(resp.json::<serde_json::Value>().await.unwrap()["recorded"]
-        .as_bool()
-        .unwrap());
-
-    // The job is now succeeded, and the finding was persisted to the target.
-    assert_eq!(
-        queue.get("job-1").await.unwrap().unwrap().status,
-        JobStatus::Succeeded
-    );
-    let stored = db
-        .findings()
-        .find_one(mongodb::bson::doc! { "fingerprint": "fp-abc" })
-        .await
-        .unwrap();
-    assert!(stored.is_some(), "finding should be persisted");
-
-    h.cleanup().await;
-}
-
-#[tokio::test]
-async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
-    let Some(h) = start().await else { return };
-    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
-
-    // A PlcSps target with a single complete ST program uploaded.
-    let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
-    std::fs::create_dir_all(&dir).unwrap();
-    let st = dir.join("main.st");
-    std::fs::write(
-        &st,
-        "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n  RESOURCE R\nEND_CONFIGURATION\n",
-    )
-    .unwrap();
-    let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
-    let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
-    art.stored_path = Some(st.to_string_lossy().to_string());
-    target.artifacts.push(art);
-    let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
-    let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
-
-    // Enqueue → a plc-provision job whose program is a content-addressed blob.
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/enqueue",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 200, "enqueue should succeed");
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let job_id = body["job_id"].as_str().unwrap().to_string();
-
-    let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
-    let hash = rec
-        .job
-        .inputs
-        .get("program")
-        .and_then(|i| i.blob.clone())
-        .expect("program blob");
-
-    // Serve the blob back and confirm it's the program source (what the runner
-    // would fetch).
-    let served = h
-        .client
-        .get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
-        .bearer_auth(TEST_RUNNER_TOKEN)
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(served.status(), 200);
-    assert!(served.text().await.unwrap().contains("CONFIGURATION"));
-
-    h.cleanup().await;
-    let _ = std::fs::remove_dir_all(&dir);
-}
-
-#[tokio::test]
-async fn empty_queue_leases_nothing() {
-    let Some(h) = start().await else { return };
-    let resp = h
-        .post(
-            "/api/v1/werkbank/jobs/lease",
-            Some(TEST_RUNNER_TOKEN),
-            serde_json::json!({
-                "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-                "labels": [], "lease_ttl_secs": 60
-            }),
-        )
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), 204, "no job → 204");
-    h.cleanup().await;
-}
-
-#[tokio::test]
-async fn runner_endpoints_require_the_bearer_token() {
-    let Some(h) = start().await else { return };
-    let body = serde_json::json!({
-        "tenant": TENANT, "runner_id": "r1", "executor": "docker",
-        "labels": [], "lease_ttl_secs": 60
-    });
-
-    let no_token = h
-        .post("/api/v1/werkbank/jobs/lease", None, body.clone())
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(no_token.status(), 401, "missing token → 401");
-
-    let bad_token = h
-        .post("/api/v1/werkbank/jobs/lease", Some("wrong"), body)
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(bad_token.status(), 401, "wrong token → 401");
-
-    h.cleanup().await;
-}

compliance-agent/tests/werkbank_queue.rs

@@ -1,258 +0,0 @@
-//! Integration tests for the Werkbank job queue (WB-02).
-//!
-//! Exercises the atomic lease/heartbeat/complete/sweep flow against a real
-//! MongoDB — the guarantees (idempotent enqueue, single-owner lease, visibility
-//! timeout) are Mongo-semantics-dependent and can't be unit-tested in isolation.
-//! Skips cleanly when no Mongo is reachable (set `TEST_MONGODB_URI` to point at
-//! one; defaults to the local dev cluster).
-
-#![allow(clippy::expect_used, clippy::unwrap_used)]
-
-use std::time::Duration;
-
-use chrono::{DateTime, TimeZone, Utc};
-
-use compliance_agent::database::Database;
-use compliance_agent::werkbank::JobQueue;
-use compliance_core::models::werkbank::{Executor, InputRef, Job, JobResult};
-
-/// Connect + ensure indexes on a throwaway database, or `None` if no Mongo.
-async fn setup() -> Option<(JobQueue, mongodb::Database)> {
-    let uri = std::env::var("TEST_MONGODB_URI")
-        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
-    let db_name = format!("wbq_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
-    let db = match Database::connect(&uri, &db_name).await {
-        Ok(d) => d,
-        Err(_) => {
-            eprintln!("SKIP werkbank_queue: no MongoDB reachable at {uri}");
-            return None;
-        }
-    };
-    db.ensure_indexes().await.expect("ensure indexes");
-    let queue = JobQueue::new(&db);
-    Some((queue, db.inner().clone()))
-}
-
-fn base_time() -> DateTime<Utc> {
-    Utc.timestamp_opt(1_700_000_000, 0).unwrap()
-}
-
-fn job(id: &str) -> Job {
-    Job::plc_provision(id, "acme", "target-1", InputRef::blob("sha256:abc"), 180)
-}
-
-fn job_with_labels(id: &str, labels: &[&str]) -> Job {
-    let mut j = job(id);
-    j.labels = labels.iter().map(|s| s.to_string()).collect();
-    j
-}
-
-macro_rules! skip_if_no_mongo {
-    () => {
-        match setup().await {
-            Some(v) => v,
-            None => return,
-        }
-    };
-}
-
-#[tokio::test]
-async fn enqueue_is_idempotent() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    assert!(q.enqueue(job("j1"), now).await.expect("enqueue"));
-    // Same id again — no duplicate row, reports "already present".
-    assert!(!q.enqueue(job("j1"), now).await.expect("enqueue2"));
-
-    let rec = q.get("j1").await.expect("get").expect("exists");
-    assert_eq!(
-        rec.status,
-        compliance_core::models::werkbank::JobStatus::Queued
-    );
-    assert_eq!(rec.attempts, 0);
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn lease_matches_executor_and_labels_and_is_fifo() {
-    let (q, db) = skip_if_no_mongo!();
-    let t0 = base_time();
-
-    // Two docker jobs (j_old older than j_new) + one requiring a kvm label.
-    q.enqueue(job("j_old"), t0).await.unwrap();
-    q.enqueue(job("j_new"), t0 + chrono::Duration::seconds(5))
-        .await
-        .unwrap();
-    q.enqueue(job_with_labels("j_kvm", &["kvm=true"]), t0)
-        .await
-        .unwrap();
-
-    // Wrong executor: a shell runner leases nothing.
-    assert!(q
-        .lease("r-shell", Executor::Shell, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .is_none());
-
-    // A docker runner without the kvm label gets the oldest label-free job (FIFO).
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .expect("leased");
-    assert_eq!(leased.job.id, "j_old", "oldest matching job first");
-    assert!(!leased.lease_token.is_empty());
-
-    // The kvm job stays unleased for that runner (missing label)...
-    let none = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
-        .await
-        .unwrap()
-        .expect("next");
-    assert_eq!(none.job.id, "j_new", "label-free job, not the kvm one");
-
-    // ...but a runner advertising kvm can take it.
-    let kvm = q
-        .lease(
-            "r2",
-            Executor::Docker,
-            &["kvm=true".to_string(), "arch=amd64".to_string()],
-            Duration::from_secs(30),
-            t0,
-        )
-        .await
-        .unwrap()
-        .expect("kvm leased");
-    assert_eq!(kvm.job.id, "j_kvm");
-
-    // A leased job increments attempts and is no longer queued.
-    let rec = q.get("j_old").await.unwrap().unwrap();
-    assert_eq!(rec.attempts, 1);
-    assert_eq!(rec.leased_by.as_deref(), Some("r1"));
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn heartbeat_extends_lease_and_surfaces_cancel() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    q.enqueue(job("j1"), now).await.unwrap();
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // A valid heartbeat moves it to running and reports not-cancelled.
-    let ack = q
-        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .expect("valid lease");
-    assert!(!ack.cancelled);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Running
-    );
-
-    // A wrong token is a lost lease.
-    assert!(q
-        .heartbeat("j1", "wrong-token", Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .is_none());
-
-    // Cancelling an in-flight job flags it; the next heartbeat reports cancelled.
-    assert!(q.cancel("j1", now).await.unwrap());
-    let ack = q
-        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .expect("still leased");
-    assert!(ack.cancelled);
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn complete_is_idempotent_and_token_guarded() {
-    let (q, db) = skip_if_no_mongo!();
-    let now = base_time();
-
-    q.enqueue(job("j1"), now).await.unwrap();
-    let leased = q
-        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // Wrong token cannot complete.
-    let mut result = JobResult::succeeded("j1");
-    result.findings = Vec::new();
-    assert!(!q.complete("j1", "nope", &result, now).await.unwrap());
-
-    // The lease holder completes it once...
-    assert!(q
-        .complete("j1", &leased.lease_token, &result, now)
-        .await
-        .unwrap());
-    let rec = q.get("j1").await.unwrap().unwrap();
-    assert_eq!(
-        rec.status,
-        compliance_core::models::werkbank::JobStatus::Succeeded
-    );
-    assert!(rec.result.is_some());
-    assert!(rec.lease_token.is_none(), "lease cleared on completion");
-
-    // ...and a second (duplicate) completion is a no-op.
-    assert!(!q
-        .complete("j1", &leased.lease_token, &result, now)
-        .await
-        .unwrap());
-
-    db.drop().await.ok();
-}
-
-#[tokio::test]
-async fn sweep_requeues_expired_then_expires_after_max_attempts() {
-    let (q, db) = skip_if_no_mongo!();
-    let t0 = base_time();
-
-    q.enqueue(job("j1"), t0).await.unwrap();
-
-    // Lease #1 with a 10s TTL; then time jumps past expiry.
-    q.lease("r1", Executor::Docker, &[], Duration::from_secs(10), t0)
-        .await
-        .unwrap()
-        .unwrap();
-    let past = t0 + chrono::Duration::seconds(60);
-
-    // attempts=1 < max=2 → requeued.
-    let swept = q.sweep_expired(past, 2).await.unwrap();
-    assert_eq!(swept.requeued, 1);
-    assert_eq!(swept.expired, 0);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Queued
-    );
-
-    // Lease #2 (attempts=2), let it expire again → now expired (>= max).
-    q.lease("r2", Executor::Docker, &[], Duration::from_secs(10), past)
-        .await
-        .unwrap()
-        .unwrap();
-    let later = past + chrono::Duration::seconds(60);
-    let swept = q.sweep_expired(later, 2).await.unwrap();
-    assert_eq!(swept.requeued, 0);
-    assert_eq!(swept.expired, 1);
-    assert_eq!(
-        q.get("j1").await.unwrap().unwrap().status,
-        compliance_core::models::werkbank::JobStatus::Expired
-    );
-
-    db.drop().await.ok();
-}

compliance-core/src/auth.rs

@@ -64,11 +64,11 @@ struct Claims {
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 
 /// Path prefixes that bypass JWT validation. The admin sub-router
-/// (`/api/v1/admin/*`) and the Werkbank runner API (`/api/v1/werkbank/*`)
-/// have their own static-bearer middleware and must not be routed through the
-/// customer-JWT path — a Keycloak token always carries a single tenant_id and
-/// would semantically conflict with these cross-tenant / machine operations.
-const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/", "/api/v1/werkbank/"];
+/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
+/// not be routed through the customer-JWT path — a Keycloak token
+/// always carries a single tenant_id and would semantically conflict
+/// with cross-tenant admin operations.
+const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
 
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.

compliance-core/src/config.rs

@@ -53,38 +53,6 @@ pub struct AgentConfig {
     /// default: it needs Docker access in the agent's runtime, which is a
     /// deployment opt-in.
     pub plc_runtime: PlcRuntimeConfig,
-    /// Static bearer for the Werkbank runner endpoints
-    /// (`/api/v1/werkbank/jobs/*`). Machine auth for runners leasing/completing
-    /// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
-    /// `None`, those endpoints are not mounted at all.
-    pub werkbank_runner_token: Option<SecretString>,
-    /// Source for the OSCAL control catalog pulled from breakpilot-compliance
-    /// (drives the [`crate::traits::ControlsProvider`]). Disabled when
-    /// `base_url` is `None`.
-    pub breakpilot: BreakpilotConfig,
-}
-
-/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
-/// to snapshot it for deterministic / offline reuse.
-#[derive(Debug, Clone)]
-pub struct BreakpilotConfig {
-    /// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
-    /// the OSCAL controls provider.
-    pub base_url: Option<String>,
-    /// Optional bearer token for the catalog endpoint.
-    pub token: Option<SecretString>,
-    /// Directory for catalog snapshots.
-    pub snapshot_dir: String,
-}
-
-impl Default for BreakpilotConfig {
-    fn default() -> Self {
-        Self {
-            base_url: None,
-            token: None,
-            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
-        }
-    }
 }
 
 /// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).

compliance-core/src/models/mod.rs

@@ -10,8 +10,6 @@ pub mod mcp;
 pub mod mcp_token;
 pub mod notification;
 pub mod onboarding;
-pub mod oscal;
-pub mod oscal_assessment;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
@@ -41,8 +39,6 @@ pub use onboarding::{
     GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
     TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
-pub use oscal::OscalDocument;
-pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
     PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
@@ -53,7 +49,5 @@ pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
 pub use werkbank::{
-    CompleteRequest, CompleteResponse, DastCollect, Executor, HeartbeatAck, HeartbeatRequest,
-    InputRef, Job, JobCollect, JobRecord, JobResult, JobRuntime, JobStatus, JobType, LeaseRequest,
-    LeasedJob,
+    DastCollect, Executor, InputRef, Job, JobCollect, JobResult, JobRuntime, JobStatus, JobType,
 };

compliance-core/src/models/oscal.rs

@@ -1,250 +0,0 @@
-//! OSCAL 1.1 catalog types + mapping into the controls corpus.
-//!
-//! Deserialises the OSCAL catalog served by breakpilot-compliance
-//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
-//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
-//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
-//! producer can add detail without breaking us.
-//!
-//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
-//! and scanner routing live in our assessment layer, not here — see
-//! [`crate::traits::ControlsProvider`].
-
-use serde::Deserialize;
-
-use crate::models::onboarding::ComplianceFramework;
-use crate::traits::Control as CorpusControl;
-
-/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
-#[derive(Debug, Clone, Deserialize)]
-pub struct OscalDocument {
-    pub catalog: Catalog,
-}
-
-/// An OSCAL catalog: metadata + a tree of control groups.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Catalog {
-    pub uuid: String,
-    pub metadata: Metadata,
-    #[serde(default)]
-    pub groups: Vec<Group>,
-    #[serde(rename = "back-matter", default)]
-    pub back_matter: Option<BackMatter>,
-}
-
-/// Catalog metadata (title/version + provenance props).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Metadata {
-    pub title: String,
-    pub version: String,
-    #[serde(rename = "oscal-version")]
-    pub oscal_version: String,
-    #[serde(default)]
-    pub props: Vec<Prop>,
-}
-
-/// A name/value property, optionally namespaced.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Prop {
-    pub name: String,
-    pub value: String,
-    #[serde(default)]
-    pub ns: Option<String>,
-}
-
-/// A control group (may nest sub-groups and controls).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Group {
-    #[serde(default)]
-    pub id: String,
-    #[serde(default)]
-    pub title: String,
-    #[serde(default)]
-    pub controls: Vec<Control>,
-    #[serde(default)]
-    pub groups: Vec<Group>,
-}
-
-/// An OSCAL control (may nest enhancement controls).
-#[derive(Debug, Clone, Deserialize)]
-pub struct Control {
-    pub id: String,
-    #[serde(default)]
-    pub title: String,
-    #[serde(default)]
-    pub props: Vec<Prop>,
-    #[serde(default)]
-    pub parts: Vec<Part>,
-    #[serde(default)]
-    pub links: Vec<Link>,
-    #[serde(default)]
-    pub controls: Vec<Control>,
-}
-
-/// A control part (e.g. the `statement`), may nest sub-parts.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Part {
-    #[serde(default)]
-    pub name: String,
-    #[serde(default)]
-    pub prose: Option<String>,
-    #[serde(default)]
-    pub parts: Vec<Part>,
-}
-
-/// A link, e.g. a `reference` to a back-matter resource.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Link {
-    pub href: String,
-    #[serde(default)]
-    pub rel: Option<String>,
-}
-
-/// Back-matter holding referenced resources (e.g. the CRA measures).
-#[derive(Debug, Clone, Deserialize)]
-pub struct BackMatter {
-    #[serde(default)]
-    pub resources: Vec<Resource>,
-}
-
-/// A back-matter resource referenced by control links.
-#[derive(Debug, Clone, Deserialize)]
-pub struct Resource {
-    pub uuid: String,
-    #[serde(default)]
-    pub title: Option<String>,
-    #[serde(default)]
-    pub description: Option<String>,
-}
-
-impl Metadata {
-    /// First prop value with the given name.
-    pub fn prop(&self, name: &str) -> Option<&str> {
-        self.props
-            .iter()
-            .find(|p| p.name == name)
-            .map(|p| p.value.as_str())
-    }
-}
-
-impl Control {
-    /// First prop value with the given name.
-    pub fn prop(&self, name: &str) -> Option<&str> {
-        self.props
-            .iter()
-            .find(|p| p.name == name)
-            .map(|p| p.value.as_str())
-    }
-
-    /// The control's `statement` prose, if present.
-    pub fn statement(&self) -> Option<&str> {
-        self.parts
-            .iter()
-            .find(|p| p.name == "statement")
-            .and_then(|p| p.prose.as_deref())
-    }
-}
-
-impl OscalDocument {
-    /// The framework this catalog declares (`metadata.props[name="framework"]`).
-    pub fn framework(&self) -> Option<ComplianceFramework> {
-        framework_from_str(self.catalog.metadata.prop("framework")?)
-    }
-
-    /// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
-    pub fn content_hash(&self) -> Option<&str> {
-        self.catalog.metadata.prop("content-hash")
-    }
-
-    /// Flatten the catalog into the corpus controls the mapping engine consumes.
-    pub fn to_controls(&self) -> Vec<CorpusControl> {
-        let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
-        let source_label = self.catalog.metadata.title.as_str();
-        let mut out = Vec::new();
-        for group in &self.catalog.groups {
-            collect_group(group, framework, source_label, &mut out);
-        }
-        out
-    }
-}
-
-/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
-/// serde snake_case representation.
-fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
-    serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
-}
-
-fn collect_group(
-    group: &Group,
-    framework: ComplianceFramework,
-    source_label: &str,
-    out: &mut Vec<CorpusControl>,
-) {
-    for control in &group.controls {
-        collect_control(control, framework, source_label, out);
-    }
-    for sub in &group.groups {
-        collect_group(sub, framework, source_label, out);
-    }
-}
-
-fn collect_control(
-    control: &Control,
-    framework: ComplianceFramework,
-    source_label: &str,
-    out: &mut Vec<CorpusControl>,
-) {
-    let source = match control.prop("annex-anchor") {
-        Some(anchor) => Some(format!("{source_label} · {anchor}")),
-        None => Some(source_label.to_string()),
-    };
-    out.push(CorpusControl {
-        id: control.id.clone(),
-        framework,
-        title: control.title.clone(),
-        text: control.statement().unwrap_or_default().to_string(),
-        source,
-    });
-    for enhancement in &control.controls {
-        collect_control(enhancement, framework, source_label, out);
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
-
-    fn parse() -> OscalDocument {
-        serde_json::from_str(CATALOG).unwrap()
-    }
-
-    #[test]
-    fn parses_full_catalog() {
-        let doc = parse();
-        assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
-        assert!(!doc.catalog.groups.is_empty());
-        assert!(doc.catalog.back_matter.is_some());
-    }
-
-    #[test]
-    fn maps_all_controls_to_corpus() {
-        let doc = parse();
-        let controls = doc.to_controls();
-        assert_eq!(controls.len(), 40);
-        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
-
-        let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
-        assert_eq!(c8.framework, ComplianceFramework::Cra);
-        assert!(!c8.title.is_empty());
-        assert!(!c8.text.is_empty(), "statement prose should map into text");
-        assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
-    }
-
-    #[test]
-    fn exposes_content_hash_for_snapshotting() {
-        assert_eq!(parse().content_hash().map(str::len), Some(64));
-    }
-}

compliance-core/src/models/oscal_assessment.rs

@@ -1,402 +0,0 @@
-//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
-//!
-//! The catalog (domain content) comes from the producer; the **assessment** is
-//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
-//! standard OSCAL assessment-results document: an observation per linked finding,
-//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
-//! records the full catalog set we considered.
-//!
-//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
-//! timestamp. Pure — no DB, no network.
-
-use std::collections::HashMap;
-
-use chrono::{DateTime, Utc};
-use serde::Serialize;
-use uuid::Uuid;
-
-use crate::models::finding::Finding;
-use crate::traits::Control;
-
-const OSCAL_VERSION: &str = "1.1.2";
-/// Same namespace as the catalog exporter, so ids are stable and correlatable.
-const NAMESPACE: Uuid = Uuid::from_bytes([
-    0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
-]);
-
-fn det_uuid(name: &str) -> String {
-    Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
-}
-
-/// Links findings to the catalog control-ids they provide evidence for.
-pub struct ControlLinker {
-    cwe_to_controls: HashMap<u32, Vec<String>>,
-}
-
-impl ControlLinker {
-    /// Build a linker from an explicit CWE → control-id map.
-    pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
-        Self { cwe_to_controls }
-    }
-
-    /// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
-    /// `_CWE_TO_REQ`; extend as scanner coverage grows).
-    pub fn cra_seed() -> Self {
-        let pairs: &[(u32, &str)] = &[
-            (798, "cra-ai-8"),
-            (259, "cra-ai-8"),
-            (1392, "cra-ai-8"),
-            (327, "cra-ai-13"),
-            (326, "cra-ai-13"),
-            (319, "cra-ai-15"),
-            (311, "cra-ai-15"),
-            (89, "cra-ai-20"),
-            (79, "cra-ai-20"),
-            (78, "cra-ai-20"),
-            (22, "cra-ai-20"),
-        ];
-        let mut map: HashMap<u32, Vec<String>> = HashMap::new();
-        for (cwe, id) in pairs {
-            map.entry(*cwe).or_default().push((*id).to_string());
-        }
-        Self::new(map)
-    }
-
-    /// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
-    fn parse_cwe(raw: &str) -> Option<u32> {
-        raw.trim_start_matches(|c: char| !c.is_ascii_digit())
-            .split(|c: char| !c.is_ascii_digit())
-            .next()
-            .filter(|s| !s.is_empty())
-            .and_then(|s| s.parse().ok())
-    }
-
-    /// The control-ids a finding provides evidence for (via its CWE).
-    pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
-        finding
-            .cwe
-            .as_deref()
-            .and_then(Self::parse_cwe)
-            .and_then(|cwe| self.cwe_to_controls.get(&cwe))
-            .cloned()
-            .unwrap_or_default()
-    }
-}
-
-/// Assess `findings` against `controls`: link findings to control-ids and build a
-/// standard OSCAL assessment-results document. `at` is the assessment timestamp.
-pub fn assess(
-    controls: &[Control],
-    findings: &[Finding],
-    linker: &ControlLinker,
-    at: DateTime<Utc>,
-) -> AssessmentResultsDoc {
-    let ts = at.to_rfc3339();
-
-    let mut observations = Vec::new();
-    let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
-    for finding in findings {
-        let targets = linker.controls_for(finding);
-        if targets.is_empty() {
-            continue;
-        }
-        let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
-        let location = match (&finding.file_path, finding.line_number) {
-            (Some(f), Some(l)) => Some(format!("{f}:{l}")),
-            (Some(f), None) => Some(f.clone()),
-            _ => None,
-        };
-        observations.push(Observation {
-            uuid: obs_uuid.clone(),
-            description: finding.title.clone(),
-            methods: vec!["TEST".to_string()],
-            collected: ts.clone(),
-            relevant_evidence: vec![RelevantEvidence {
-                href: location.map(|l| format!("file://{l}")),
-                description: format!("[{}] {}", finding.scanner, finding.title),
-            }],
-        });
-        for control_id in targets {
-            obs_by_control
-                .entry(control_id)
-                .or_default()
-                .push(obs_uuid.clone());
-        }
-    }
-
-    let titles: HashMap<&str, &str> = controls
-        .iter()
-        .map(|c| (c.id.as_str(), c.title.as_str()))
-        .collect();
-    let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
-    hit_controls.sort();
-    let ar_findings: Vec<ArFinding> = hit_controls
-        .into_iter()
-        .map(|control_id| {
-            let title = titles.get(control_id.as_str()).copied().unwrap_or("");
-            ArFinding {
-                uuid: det_uuid(&format!("finding:{control_id}")),
-                title: format!("Findings affect {control_id}: {title}"),
-                target: FindingTarget {
-                    target_type: "statement-id".to_string(),
-                    target_id: format!("{control_id}_smt"),
-                    status: TargetStatus {
-                        state: "not-satisfied".to_string(),
-                    },
-                },
-                related_observations: obs_by_control[control_id]
-                    .iter()
-                    .map(|u| RelatedObservation {
-                        observation_uuid: u.clone(),
-                    })
-                    .collect(),
-            }
-        })
-        .collect();
-
-    let include_controls = controls
-        .iter()
-        .map(|c| SelectControlById {
-            control_id: c.id.clone(),
-        })
-        .collect();
-
-    let result = ArResult {
-        uuid: det_uuid("result:cra"),
-        title: "Automated code-compliance assessment".to_string(),
-        description: format!(
-            "{} finding-linked observation(s) across {} reviewed control(s)",
-            observations.len(),
-            controls.len()
-        ),
-        start: ts.clone(),
-        reviewed_controls: ReviewedControls {
-            control_selections: vec![ControlSelection { include_controls }],
-        },
-        observations,
-        findings: ar_findings,
-    };
-
-    AssessmentResultsDoc {
-        assessment_results: AssessmentResults {
-            uuid: det_uuid("assessment-results:cra"),
-            metadata: ArMetadata {
-                title: "Compliance scanner — OSCAL assessment results".to_string(),
-                last_modified: ts,
-                version: "1.0.0".to_string(),
-                oscal_version: OSCAL_VERSION.to_string(),
-            },
-            import_ap: ImportAp {
-                href: "#cra-annex-i".to_string(),
-            },
-            results: vec![result],
-        },
-    }
-}
-
-// ── OSCAL assessment-results document (serialise) ────────────────────────────
-
-/// The root OSCAL assessment-results document.
-#[derive(Debug, Clone, Serialize)]
-pub struct AssessmentResultsDoc {
-    #[serde(rename = "assessment-results")]
-    pub assessment_results: AssessmentResults,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct AssessmentResults {
-    pub uuid: String,
-    pub metadata: ArMetadata,
-    #[serde(rename = "import-ap")]
-    pub import_ap: ImportAp,
-    pub results: Vec<ArResult>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArMetadata {
-    pub title: String,
-    #[serde(rename = "last-modified")]
-    pub last_modified: String,
-    pub version: String,
-    #[serde(rename = "oscal-version")]
-    pub oscal_version: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ImportAp {
-    pub href: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArResult {
-    pub uuid: String,
-    pub title: String,
-    pub description: String,
-    pub start: String,
-    #[serde(rename = "reviewed-controls")]
-    pub reviewed_controls: ReviewedControls,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub observations: Vec<Observation>,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub findings: Vec<ArFinding>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ReviewedControls {
-    #[serde(rename = "control-selections")]
-    pub control_selections: Vec<ControlSelection>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ControlSelection {
-    #[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
-    pub include_controls: Vec<SelectControlById>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct SelectControlById {
-    #[serde(rename = "control-id")]
-    pub control_id: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct Observation {
-    pub uuid: String,
-    pub description: String,
-    pub methods: Vec<String>,
-    pub collected: String,
-    #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
-    pub relevant_evidence: Vec<RelevantEvidence>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct RelevantEvidence {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub href: Option<String>,
-    pub description: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct ArFinding {
-    pub uuid: String,
-    pub title: String,
-    pub target: FindingTarget,
-    #[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
-    pub related_observations: Vec<RelatedObservation>,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct FindingTarget {
-    #[serde(rename = "type")]
-    pub target_type: String,
-    #[serde(rename = "target-id")]
-    pub target_id: String,
-    pub status: TargetStatus,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct TargetStatus {
-    pub state: String,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct RelatedObservation {
-    #[serde(rename = "observation-uuid")]
-    pub observation_uuid: String,
-}
-
-#[cfg(test)]
-#[allow(clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use crate::models::finding::Severity;
-    use crate::models::onboarding::ComplianceFramework;
-    use crate::models::scan::ScanType;
-
-    fn control(id: &str, title: &str) -> Control {
-        Control {
-            id: id.into(),
-            framework: ComplianceFramework::Cra,
-            title: title.into(),
-            text: String::new(),
-            source: None,
-        }
-    }
-
-    fn finding(fp: &str, cwe: Option<&str>) -> Finding {
-        let mut f = Finding::new(
-            "repo".into(),
-            fp.into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "hardcoded credential".into(),
-            "desc".into(),
-            Severity::High,
-        );
-        f.cwe = cwe.map(Into::into);
-        f.file_path = Some("src/auth.rs".into());
-        f.line_number = Some(42);
-        f
-    }
-
-    fn at() -> DateTime<Utc> {
-        DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
-            .unwrap()
-            .with_timezone(&Utc)
-    }
-
-    #[test]
-    fn links_cwe_finding_to_control_not_satisfied() {
-        let controls = vec![
-            control("cra-ai-8", "No default passwords"),
-            control("cra-ai-13", "Crypto"),
-        ];
-        let findings = vec![finding("f1", Some("CWE-798"))];
-        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
-        let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1);
-        assert_eq!(r.findings.len(), 1);
-        assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
-        assert_eq!(r.findings[0].target.status.state, "not-satisfied");
-        assert_eq!(r.findings[0].related_observations.len(), 1);
-        assert_eq!(
-            r.reviewed_controls.control_selections[0]
-                .include_controls
-                .len(),
-            2
-        );
-    }
-
-    #[test]
-    fn unlinked_finding_yields_no_control_finding() {
-        let controls = vec![control("cra-ai-8", "x")];
-        let findings = vec![finding("f1", Some("CWE-99999"))];
-        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
-        let r = &doc.assessment_results.results[0];
-        assert!(r.observations.is_empty());
-        assert!(r.findings.is_empty());
-    }
-
-    #[test]
-    fn output_is_deterministic_and_valid_oscal() {
-        let controls = vec![control("cra-ai-8", "x")];
-        let findings = vec![finding("f1", Some("798"))];
-        let a = serde_json::to_string(&assess(
-            &controls,
-            &findings,
-            &ControlLinker::cra_seed(),
-            at(),
-        ))
-        .unwrap();
-        let b = serde_json::to_string(&assess(
-            &controls,
-            &findings,
-            &ControlLinker::cra_seed(),
-            at(),
-        ))
-        .unwrap();
-        assert_eq!(a, b);
-        assert!(a.contains("\"oscal-version\":\"1.1.2\""));
-        assert!(a.contains("\"not-satisfied\""));
-    }
-}

compliance-core/src/models/werkbank.rs

@@ -266,142 +266,6 @@ impl JobResult {
     }
 }
 
-/// A queued job as persisted by the control plane (WB-02): the [`Job`] contract
-/// plus the queue bookkeeping — status, lease ownership, attempt count, and the
-/// eventual result. The runner never sees this record; on lease it receives a
-/// [`LeasedJob`] (the job plus a token it presents to heartbeat/complete).
-///
-/// Timestamps persist as native BSON dates so the queue's range queries (lease
-/// FIFO by `created_at`, visibility-timeout sweep by `lease_expires_at`) compare
-/// correctly.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct JobRecord {
-    /// The job to run.
-    pub job: Job,
-    /// Current queue state.
-    pub status: JobStatus,
-    /// The lease token held by the current runner (proves lease ownership).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub lease_token: Option<String>,
-    /// Id of the runner holding the lease.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub leased_by: Option<String>,
-    /// When the current lease expires — the visibility timeout after which a
-    /// crashed runner's job is swept back to `queued`.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub lease_expires_at: Option<DateTime<Utc>>,
-    /// Last heartbeat from the runner.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub heartbeat_at: Option<DateTime<Utc>>,
-    /// How many times the job has been leased (incremented on each lease).
-    #[serde(default)]
-    pub attempts: u32,
-    /// Set when the control plane requests cancellation; the runner sees it on
-    /// its next heartbeat and aborts.
-    #[serde(default)]
-    pub cancel_requested: bool,
-    /// The result, once the job reaches a terminal state.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub result: Option<JobResult>,
-    /// When the job was enqueued.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub created_at: DateTime<Utc>,
-    /// Last modification.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub updated_at: DateTime<Utc>,
-}
-
-impl JobRecord {
-    /// A freshly-enqueued (`queued`) record for a job.
-    pub fn queued(job: Job, now: DateTime<Utc>) -> Self {
-        Self {
-            job,
-            status: JobStatus::Queued,
-            lease_token: None,
-            leased_by: None,
-            lease_expires_at: None,
-            heartbeat_at: None,
-            attempts: 0,
-            cancel_requested: false,
-            result: None,
-            created_at: now,
-            updated_at: now,
-        }
-    }
-}
-
-/// A job handed to a runner on lease: what to run plus the token the runner must
-/// present to heartbeat and complete it.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct LeasedJob {
-    /// The job to execute.
-    pub job: Job,
-    /// The lease token proving ownership (opaque to the runner).
-    pub lease_token: String,
-}
-
-/// The runner's view of a heartbeat: whether the control plane has asked the job
-/// to stop. `None` from the queue means the lease was lost (token mismatch or the
-/// job already terminal) and the runner should abandon the work.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-pub struct HeartbeatAck {
-    /// The control plane requested cancellation — the runner should tear down.
-    pub cancelled: bool,
-}
-
-// --- Runner ↔ control-plane transport (the pull API wire types) ---------------
-// Shared so the runner (client) and the control plane (server) agree on shapes.
-
-/// Runner → control plane: lease the oldest runnable job for this runner.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct LeaseRequest {
-    /// The tenant queue to lease from.
-    pub tenant: String,
-    /// The runner id (advertised for attribution).
-    pub runner_id: String,
-    /// The executor this runner provides.
-    pub executor: Executor,
-    /// The capability labels this runner advertises.
-    #[serde(default)]
-    pub labels: Vec<String>,
-    /// Requested lease lifetime (the visibility timeout), in seconds.
-    pub lease_ttl_secs: u64,
-}
-
-/// Runner → control plane: prove lease ownership and extend it.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct HeartbeatRequest {
-    /// The tenant queue.
-    pub tenant: String,
-    /// The job being worked.
-    pub job_id: String,
-    /// The lease token from the [`LeasedJob`].
-    pub lease_token: String,
-    /// Lease lifetime to extend to, in seconds.
-    pub lease_ttl_secs: u64,
-}
-
-/// Runner → control plane: record a job's terminal result.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CompleteRequest {
-    /// The tenant queue.
-    pub tenant: String,
-    /// The job being completed.
-    pub job_id: String,
-    /// The lease token proving ownership.
-    pub lease_token: String,
-    /// The result to record.
-    pub result: JobResult,
-}
-
-/// Control plane → runner: whether the completion was recorded (false if the
-/// lease was already lost — token mismatch or the job had become terminal).
-#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
-pub struct CompleteResponse {
-    /// Whether the result was recorded.
-    pub recorded: bool,
-}
-
 #[cfg(test)]
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {

werkbank-exec/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "werkbank-exec"
-version = "0.1.0"
-edition = "2021"
-description = "Shared dynamic-execution logic: soft-PLC provisioning + industrial-protocol probing, used by the compliance agent and the Werkbank runner."
-
-[lints]
-workspace = true
-
-[dependencies]
-compliance-core = { workspace = true }
-compliance-dast = { path = "../compliance-dast" }
-tokio = { workspace = true }
-reqwest = { workspace = true }
-uuid = { workspace = true }
-regex = { workspace = true }
-secrecy = { workspace = true }
-sha2 = { workspace = true }
-hex = { workspace = true }
-tracing = { workspace = true }
-thiserror = { workspace = true }
-walkdir = "2"
-futures-util = "0.3"

werkbank-exec/src/error.rs

@@ -1,16 +0,0 @@
-//! Error type for the dynamic-execution logic.
-
-/// Anything that can go wrong provisioning and testing a soft-PLC. The compliance
-/// agent maps this into its own `AgentError` at the call boundary.
-#[derive(thiserror::Error, Debug)]
-pub enum ExecError {
-    /// An HTTP request (to OpenPLC) failed.
-    #[error("HTTP error: {0}")]
-    Http(#[from] reqwest::Error),
-    /// A local IO / process error (e.g. invoking `docker`).
-    #[error("IO error: {0}")]
-    Io(#[from] std::io::Error),
-    /// Any other failure, with a message.
-    #[error("{0}")]
-    Other(String),
-}

werkbank-exec/src/fingerprint.rs

@@ -1,32 +0,0 @@
-//! Finding fingerprint helper (a SHA-256 over the salient parts), shared by the
-//! probe modules for stable dedup keys. Mirrors the agent's `dedup` helper.
-
-use sha2::{Digest, Sha256};
-
-/// A stable fingerprint over the given parts (order-sensitive, separated so
-/// `["ab","c"]` and `["a","bc"]` differ).
-pub fn compute_fingerprint(parts: &[&str]) -> String {
-    let mut hasher = Sha256::new();
-    for part in parts {
-        hasher.update(part.as_bytes());
-        hasher.update(b"|");
-    }
-    hex::encode(hasher.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn deterministic_and_hex() {
-        let a = compute_fingerprint(&["repo", "rule", "1"]);
-        assert_eq!(a, compute_fingerprint(&["repo", "rule", "1"]));
-        assert_eq!(a.len(), 64);
-        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
-        assert_ne!(
-            compute_fingerprint(&["ab", "c"]),
-            compute_fingerprint(&["a", "bc"])
-        );
-    }
-}

werkbank-exec/src/lib.rs

@@ -1,18 +0,0 @@
-//! Shared dynamic-execution logic for Werkbank.
-//!
-//! The soft-PLC provisioning + industrial-protocol probing that turns a control-
-//! logic artifact into findings: provision an ephemeral OpenPLC, load the program,
-//! start it, probe it over Modbus/OPC-UA/EtherNet-IP, DAST its web endpoint, tear
-//! it down. Extracted from the compliance agent (#183) so both the agent (in
-//! process) and the Werkbank runner (WB-04) run identical logic.
-//!
-//! - [`ics`] — read-only industrial-protocol probing.
-//! - [`plc`] — ephemeral soft-PLC provisioning + the provision-and-test loop.
-
-pub mod error;
-pub mod ics;
-pub mod plc;
-
-mod fingerprint;
-
-pub use error::ExecError;