feat(werkbank): Mongo-backed job queue with lease + visibility timeout (WB-02)

The control-plane pull queue behind the Werkbank runner flow (implements
sharang/werkbank#3). A JobQueue over a `werkbank_jobs` collection:

- enqueue — idempotent by job id (unique index; duplicate is a no-op)
- lease — atomic find-and-modify of the oldest queued job the runner can run,
  matched by executor and by labels (job labels must be a subset of the runner's,
  empty/absent matches any), returns the job + a lease token, bumps attempts
- heartbeat — extends the lease, flips leased→running, surfaces a cancel request;
  None means the lease was lost (token mismatch / already terminal)
- complete — records the terminal result, token-guarded and only from an active
  state, so it's idempotent
- cancel — queued→cancelled outright, in-flight flagged for the next heartbeat
- sweep_expired — the visibility timeout: expired leases go back to queued, or to
  expired once attempts hit max, so a crashed runner's job recovers

All transitions are single atomic Mongo updates guarded by the lease token, so two
runners can never both own a job. Every op takes an explicit `now` for
deterministic tests. Adds JobRecord/LeasedJob/HeartbeatAck to the contract (BSON
datetimes so range queries compare correctly) and the werkbank_jobs indexes.

Tests: 5 integration against a real Mongo (idempotent enqueue, executor+label
matching + FIFO, heartbeat/cancel, token-guarded idempotent complete, sweep
requeue→expire; skip cleanly with no Mongo) + 2 unit. clippy + fmt clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -34,6 +34,19 @@ SCAN_SCHEDULE=0 0 */6 * * *
 CVE_MONITOR_SCHEDULE=0 0 0 * * *
 GIT_CLONE_BASE_PATH=/tmp/compliance-scanner/repos
 
+# Dynamic PLC testing — ephemeral soft-PLC provisioning (#183). Off unless
+# enabled; requires the agent container to have Docker access (socket mount).
+# When on, a PLC/SPS target with control logic but no reachable device gets its
+# logic instantiated on a throwaway OpenPLC, probed, then torn down.
+PLC_RUNTIME_ENABLED=0
+PLC_RUNTIME_IMAGE=registry.meghsakha.com/openplc:latest
+PLC_RUNTIME_NETWORK=certifai
+PLC_RUNTIME_MEMORY=512m
+PLC_RUNTIME_CPUS=0.5
+PLC_RUNTIME_MAX_LIFETIME_SECS=180
+PLC_RUNTIME_OPENPLC_USER=openplc
+PLC_RUNTIME_OPENPLC_PASSWORD=openplc
+
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001

Cargo.lock

@@ -723,6 +723,7 @@ dependencies = [
  "sha2",
  "thiserror 2.0.18",
  "tokio",
+ "toml",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",

Cargo.toml

@@ -23,7 +23,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 chrono = { version = "0.4", features = ["serde"] }
 mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
-reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
+reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"

compliance-agent/Cargo.toml

@@ -34,7 +34,7 @@ hex = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
 regex = { workspace = true }
-axum = "0.8"
+axum = { version = "0.8", features = ["multipart"] }
 tower-http = { version = "0.6", features = ["cors", "trace", "set-header"] }
 git2 = "0.20"
 octocrab = "0.44"
@@ -65,5 +65,5 @@ tokio = { workspace = true }
 mongodb = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
-axum = "0.8"
+axum = { version = "0.8", features = ["multipart"] }
 tower-http = { version = "0.6", features = ["cors"] }

compliance-agent/src/api/handlers/onboarding.rs

@@ -5,7 +5,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-use axum::extract::{Extension, Path, Query};
+use axum::extract::{Extension, Multipart, Path, Query};
 use axum::http::StatusCode;
 use axum::Json;
 use mongodb::bson::{doc, oid::ObjectId, to_bson};
@@ -377,6 +377,116 @@ pub async fn add_artifact(
     get_target(Extension(agent), tenant, Path(id)).await
 }
 
+/// POST /api/v1/targets/{id}/artifacts/upload — attach an artifact by uploading
+/// its file (PLC project, firmware image, source archive, mobile package). The
+/// bytes are written to the artifact blob store and referenced by `stored_path`,
+/// so ingest resolves them locally (no URL fetch).
+///
+/// Multipart fields: `file` (required), `kind` (required, snake_case
+/// `ArtifactKind`), `plc_format` (optional, for PLC projects).
+#[tracing::instrument(skip_all, fields(target_id = %id))]
+pub async fn upload_artifact(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    mut multipart: Multipart,
+) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
+    let oid = parse_oid(&id)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    if db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .is_none()
+    {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    let mut kind: Option<ArtifactKind> = None;
+    let mut plc_format: Option<PlcFormat> = None;
+    let mut filename = String::from("upload.bin");
+    let mut bytes: Option<axum::body::Bytes> = None;
+
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|_| StatusCode::BAD_REQUEST)?
+    {
+        match field.name().unwrap_or("") {
+            "kind" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                kind = parse_enum(&v);
+            }
+            "plc_format" => {
+                let v = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+                plc_format = parse_enum(&v);
+            }
+            "file" => {
+                if let Some(fname) = field.file_name() {
+                    filename = fname.to_string();
+                }
+                bytes = Some(field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?);
+            }
+            _ => {}
+        }
+    }
+
+    let (Some(kind), Some(bytes)) = (kind, bytes) else {
+        return Err(StatusCode::BAD_REQUEST);
+    };
+
+    // Store the uploaded bytes under the artifact blob store.
+    let safe_name: String = filename
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_') {
+                c
+            } else {
+                '_'
+            }
+        })
+        .collect();
+    let dir = std::path::Path::new(&agent.config.artifact_store_base_path)
+        .join("uploads")
+        .join(&id);
+    std::fs::create_dir_all(&dir).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    let dest = dir.join(format!("{}_{safe_name}", uuid::Uuid::new_v4()));
+    std::fs::write(&dest, bytes.as_ref()).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    // Build the artifact for this kind, referencing the stored file.
+    let mut artifact = match kind {
+        ArtifactKind::PlcProject => Artifact::plc_project(
+            filename.clone(),
+            plc_format.unwrap_or(PlcFormat::PlcopenXml),
+        ),
+        ArtifactKind::FirmwareImage => Artifact::firmware_image(filename.clone()),
+        ArtifactKind::SourceArchive => Artifact::source_archive(filename.clone()),
+        ArtifactKind::MobilePackage => Artifact::mobile_package(filename.clone()),
+        // Non-file kinds (git repo, live URL, container ref, text) use the JSON
+        // add-artifact endpoint, not upload.
+        _ => return Err(StatusCode::BAD_REQUEST),
+    };
+    artifact.stored_path = Some(dest.to_string_lossy().to_string());
+    artifact.size_bytes = Some(bytes.len() as u64);
+
+    let artifact_bson = to_bson(&artifact).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    db.onboarded_targets()
+        .update_one(
+            doc! { "_id": oid },
+            doc! { "$push": { "artifacts": artifact_bson }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
+        )
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    get_target(Extension(agent), tenant, Path(id)).await
+}
+
+/// Deserialize a snake_case enum value from a plain string.
+fn parse_enum<T: for<'de> Deserialize<'de>>(s: &str) -> Option<T> {
+    serde_json::from_value(serde_json::Value::String(s.to_string())).ok()
+}
+
 /// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn applicable_scans_for_target(

compliance-agent/src/api/routes.rs

@@ -26,6 +26,10 @@ pub fn build_router() -> Router {
             "/api/v1/targets/{id}/artifacts",
             post(handlers::onboarding::add_artifact),
         )
+        .route(
+            "/api/v1/targets/{id}/artifacts/upload",
+            post(handlers::onboarding::upload_artifact),
+        )
         .route(
             "/api/v1/targets/{id}/applicable-scans",
             get(handlers::onboarding::applicable_scans_for_target),

compliance-agent/src/api/server.rs

@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use axum::extract::Request;
+use axum::extract::{DefaultBodyLimit, Request};
 use axum::http::HeaderValue;
 use axum::middleware::Next;
 use axum::response::Response;
@@ -74,6 +74,9 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
 
     let mut app = routes::build_router()
         .merge(admin_router)
+        // Allow large artifact uploads (PLC .projectarchive, firmware images,
+        // mobile packages) — axum's default request-body limit is only 2 MiB.
+        .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
         .layer(Extension(Arc::new(agent.clone())))
         .layer(CorsLayer::permissive())
         .layer(TraceLayer::new_for_http())

compliance-agent/src/config.rs

@@ -1,3 +1,4 @@
+use compliance_core::config::PlcRuntimeConfig;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -63,5 +64,28 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
         pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
         admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
         tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
+        plc_runtime: load_plc_runtime_config(),
     })
 }
+
+/// Build the ephemeral soft-PLC provisioning config from the environment,
+/// falling back to [`PlcRuntimeConfig::default`] for any unset knob. Disabled
+/// unless `PLC_RUNTIME_ENABLED` is truthy — it requires Docker access.
+fn load_plc_runtime_config() -> PlcRuntimeConfig {
+    let d = PlcRuntimeConfig::default();
+    PlcRuntimeConfig {
+        enabled: env_var_opt("PLC_RUNTIME_ENABLED")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(d.enabled),
+        image: env_var_opt("PLC_RUNTIME_IMAGE").unwrap_or(d.image),
+        network: env_var_opt("PLC_RUNTIME_NETWORK").unwrap_or(d.network),
+        memory: env_var_opt("PLC_RUNTIME_MEMORY").unwrap_or(d.memory),
+        cpus: env_var_opt("PLC_RUNTIME_CPUS").unwrap_or(d.cpus),
+        max_lifetime_secs: env_var_opt("PLC_RUNTIME_MAX_LIFETIME_SECS")
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(d.max_lifetime_secs),
+        openplc_user: env_var_opt("PLC_RUNTIME_OPENPLC_USER").unwrap_or(d.openplc_user),
+        openplc_password: env_secret_opt("PLC_RUNTIME_OPENPLC_PASSWORD")
+            .unwrap_or(d.openplc_password),
+    }
+}

compliance-agent/src/database.rs

@@ -465,6 +465,34 @@ impl Database {
             )
             .await?;
 
+        // werkbank_jobs: unique job id (idempotent enqueue by job id)
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "job.id": 1 })
+                    .options(IndexOptions::builder().unique(true).build())
+                    .build(),
+            )
+            .await?;
+
+        // werkbank_jobs: lease query — oldest queued job for an executor
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "status": 1, "job.executor": 1, "created_at": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // werkbank_jobs: visibility-timeout sweep of expired leases
+        self.werkbank_jobs()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "status": 1, "lease_expires_at": 1 })
+                    .build(),
+            )
+            .await?;
+
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -563,6 +591,12 @@ impl Database {
         self.inner.collection("pentest_messages")
     }
 
+    /// The Werkbank job queue (WB-02): declarative dynamic-execution jobs the
+    /// control plane enqueues and runners lease.
+    pub fn werkbank_jobs(&self) -> Collection<compliance_core::models::werkbank::JobRecord> {
+        self.inner.collection("werkbank_jobs")
+    }
+
     #[allow(dead_code)]
     pub fn raw_collection(&self, name: &str) -> Collection<mongodb::bson::Document> {
         self.inner.collection(name)

compliance-agent/src/ingest/mod.rs

@@ -162,14 +162,27 @@ fn ingest_blob(
         match blob::extract_zip(&stored, &dest) {
             Ok(()) => dest,
             Err(e) => {
-                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
-                // note it so later stages can decide what to do.
+                // Not a zip container — this is a single uploaded file (e.g. a
+                // `.st`/`.xml` PLC project or a `.tar.gz`). The content-addressed
+                // blob has no extension, so materialize it into a working dir
+                // under its original name; extension-based scanners (PLC) can then
+                // discover it and report a readable path.
                 facts.push(DetectedFact::new(
                     "archive_unextracted",
                     e.to_string(),
                     "ingest",
                 ));
-                stored.clone()
+                match materialize_single(&stored, &dest, &blob_file_name(artifact)) {
+                    Ok(dir) => dir,
+                    Err(copy_err) => {
+                        facts.push(DetectedFact::new(
+                            "materialize_failed",
+                            copy_err.to_string(),
+                            "ingest",
+                        ));
+                        stored.clone()
+                    }
+                }
             }
         }
     } else {
@@ -186,6 +199,27 @@ fn ingest_blob(
     })
 }
 
+/// Copy a stored blob into `dest`/`name`, returning `dest`. Used when an
+/// "extractable" artifact turns out to be a single file rather than an archive.
+fn materialize_single(stored: &Path, dest: &Path, name: &str) -> Result<PathBuf, AgentError> {
+    std::fs::create_dir_all(dest)?;
+    std::fs::copy(stored, dest.join(name))?;
+    Ok(dest.to_path_buf())
+}
+
+/// A safe, single-segment file name for an artifact, preserving the original
+/// extension so scanners can identify it. Derives from `source_ref` (the
+/// uploaded/original file name); `file_name` strips any directory components,
+/// so this is traversal-safe. Falls back to the artifact id.
+fn blob_file_name(artifact: &Artifact) -> String {
+    Path::new(&artifact.source_ref)
+        .file_name()
+        .and_then(|n| n.to_str())
+        .map(str::to_string)
+        .filter(|s| !s.is_empty())
+        .unwrap_or_else(|| format!("artifact-{}", artifact.id))
+}
+
 /// An artifact with no on-disk form: record a single fact, no hash/path.
 fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
     IngestedArtifact {
@@ -331,4 +365,52 @@ mod tests {
         assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
         assert!(creds.auth_token.is_none());
     }
+
+    /// A single uploaded PLC file (not an archive) must land in a working dir
+    /// under its original name so the PLC scanner can discover it by extension
+    /// and report a readable path — the demo's upload → scan path.
+    #[test]
+    fn single_uploaded_plc_file_is_materialized_and_scannable() {
+        use compliance_core::models::PlcFormat;
+
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        // Simulate the upload handler: bytes written to an `uploads/` path,
+        // `source_ref` carrying the original (clean) file name.
+        let uploads = scratch.0.join("uploads");
+        std::fs::create_dir_all(&uploads).expect("mkdir uploads");
+        let uploaded = uploads.join("a1b2c3_pump_station.st");
+        std::fs::write(
+            &uploaded,
+            "PROGRAM P\nVAR\n  ApiKey : STRING := 'sk-live-1234';\nEND_VAR\nEND_PROGRAM\n",
+        )
+        .expect("write st");
+
+        let mut artifact = Artifact::plc_project("pump_station.st", PlcFormat::StructuredText);
+        artifact.stored_path = Some(uploaded.to_string_lossy().to_string());
+
+        let ctx = ctx_for(&store, "t-plc");
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+
+        // Working path is a directory (not the extensionless blob) holding the
+        // file under its original name.
+        let wp = out.working_path.expect("working path");
+        assert!(wp.is_dir(), "expected a working dir, got {wp:?}");
+        assert!(wp.join("pump_station.st").is_file());
+
+        // The PLC scanner finds the hardcoded credential and reports a clean path.
+        let findings = crate::pipeline::plc::analyze_tree(&wp, "t-plc");
+        assert!(
+            !findings.is_empty(),
+            "scanner should flag the uploaded file"
+        );
+        assert!(findings
+            .iter()
+            .any(|f| f.rule_id.as_deref() == Some("plc-hardcoded-credential")));
+        assert_eq!(
+            findings[0].file_path.as_deref(),
+            Some("pump_station.st"),
+            "finding should reference the original file name"
+        );
+    }
 }

compliance-agent/src/lib.rs

@@ -16,3 +16,4 @@ pub mod ssh;
 #[allow(dead_code)]
 pub mod trackers;
 pub mod webhooks;
+pub mod werkbank;

compliance-agent/src/pentest/cleanup.rs

@@ -342,6 +342,7 @@ mod tests {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
         }
     }
 

compliance-agent/src/pipeline/cve.rs

@@ -204,6 +204,202 @@ impl CveScanner {
 
         Ok(results)
     }
+
+    /// Match the CODESYS **runtime** component against NVD by CPE.
+    ///
+    /// CODESYS advisories (the CoDe16 cluster and friends) are indexed in NVD by
+    /// CPE (`cpe:2.3:a:codesys:control*`) keyed off the *runtime* version — not by
+    /// the internal `Cmp*`/`Sys*` library names OSV-by-purl would look up. So we
+    /// find the runtime SBOM entry, pull every `cpe:2.3:a:codesys:*` CVE from NVD,
+    /// and keep the ones whose affected-version range covers our runtime version.
+    /// Best-effort: returns empty without an NVD key, on a network error, or when
+    /// no CODESYS runtime component is present.
+    pub async fn scan_codesys(&self, repo_id: &str, entries: &mut [SbomEntry]) -> Vec<CveAlert> {
+        let Some((name, version)) = codesys_runtime(entries) else {
+            return Vec::new();
+        };
+        let url = "https://services.nvd.nist.gov/rest/json/cves/2.0\
+                   ?virtualMatchString=cpe:2.3:a:codesys";
+        let mut req = self.http.get(url);
+        if let Some(key) = &self.nvd_api_key {
+            req = req.header("apiKey", key.as_str());
+        }
+        let body: serde_json::Value = match req.send().await {
+            Ok(r) if r.status().is_success() => match r.json().await {
+                Ok(b) => b,
+                Err(e) => {
+                    tracing::warn!("CODESYS NVD parse failed: {e}");
+                    return Vec::new();
+                }
+            },
+            Ok(r) => {
+                tracing::warn!("CODESYS NVD returned {}", r.status());
+                return Vec::new();
+            }
+            Err(e) => {
+                tracing::warn!("CODESYS NVD request failed: {e}");
+                return Vec::new();
+            }
+        };
+
+        let matched = parse_codesys_nvd(&body, &version);
+        let mut alerts = Vec::new();
+        for cve in matched {
+            if let Some(e) = entries
+                .iter_mut()
+                .find(|e| e.name == name && e.version == version)
+            {
+                e.known_vulnerabilities.push(VulnRef {
+                    id: cve.id.clone(),
+                    source: "nvd".to_string(),
+                    severity: None,
+                    url: Some(format!("https://nvd.nist.gov/vuln/detail/{}", cve.id)),
+                });
+            }
+            let mut alert = CveAlert::new(
+                cve.id,
+                repo_id.to_string(),
+                name.clone(),
+                version.clone(),
+                CveSource::Nvd,
+            );
+            alert.summary = cve.summary;
+            alert.cvss_score = cve.cvss;
+            alerts.push(alert);
+        }
+        tracing::info!(runtime = %name, version = %version, cves = alerts.len(), "CODESYS CVE match");
+        alerts
+    }
+}
+
+/// The CODESYS runtime component (name + version) from an SBOM, if present. The
+/// runtime carries the version CODESYS advisories key off; the internal library
+/// components do not.
+fn codesys_runtime(entries: &[SbomEntry]) -> Option<(String, String)> {
+    entries
+        .iter()
+        .find(|e| e.package_manager == "codesys" && e.name.starts_with("CODESYS Control"))
+        .map(|e| (e.name.clone(), e.version.clone()))
+}
+
+/// A parsed NVD CVE that affects the CODESYS runtime.
+struct CodesysCve {
+    id: String,
+    summary: Option<String>,
+    cvss: Option<f64>,
+}
+
+/// Version constraints from an NVD `cpeMatch` node.
+#[derive(Default)]
+struct CpeRange {
+    exact: Option<String>,
+    start_incl: Option<String>,
+    start_excl: Option<String>,
+    end_incl: Option<String>,
+    end_excl: Option<String>,
+}
+
+/// Parse an NVD CVE-list response and keep the CVEs whose CODESYS CPE match covers
+/// `runtime_version`.
+fn parse_codesys_nvd(body: &serde_json::Value, runtime_version: &str) -> Vec<CodesysCve> {
+    let mut out = Vec::new();
+    let Some(vulns) = body["vulnerabilities"].as_array() else {
+        return out;
+    };
+    for v in vulns {
+        let cve = &v["cve"];
+        let Some(id) = cve["id"].as_str() else {
+            continue;
+        };
+        let covered = cve["configurations"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .flat_map(|c| c["nodes"].as_array().into_iter().flatten())
+            .flat_map(|n| n["cpeMatch"].as_array().into_iter().flatten())
+            .any(|cm| {
+                cm["vulnerable"].as_bool() == Some(true)
+                    && cm["criteria"]
+                        .as_str()
+                        .is_some_and(|c| c.contains(":codesys:"))
+                    && version_matches(runtime_version, &cpe_range(cm))
+            });
+        if covered {
+            let summary = cve["descriptions"]
+                .as_array()
+                .and_then(|d| d.iter().find(|x| x["lang"].as_str() == Some("en")))
+                .and_then(|x| x["value"].as_str())
+                .map(String::from);
+            let cvss = cve["metrics"]["cvssMetricV31"]
+                .as_array()
+                .and_then(|m| m.first())
+                .and_then(|m| m["cvssData"]["baseScore"].as_f64());
+            out.push(CodesysCve {
+                id: id.to_string(),
+                summary,
+                cvss,
+            });
+        }
+    }
+    out
+}
+
+/// Build a [`CpeRange`] from an NVD `cpeMatch` object.
+fn cpe_range(cm: &serde_json::Value) -> CpeRange {
+    let exact = cm["criteria"]
+        .as_str()
+        .and_then(cpe_version)
+        .filter(|v| v != "*" && v != "-" && !v.is_empty());
+    CpeRange {
+        exact,
+        start_incl: cm["versionStartIncluding"].as_str().map(String::from),
+        start_excl: cm["versionStartExcluding"].as_str().map(String::from),
+        end_incl: cm["versionEndIncluding"].as_str().map(String::from),
+        end_excl: cm["versionEndExcluding"].as_str().map(String::from),
+    }
+}
+
+/// The version field (6th component) of a CPE 2.3 string.
+fn cpe_version(criteria: &str) -> Option<String> {
+    criteria.split(':').nth(5).map(String::from)
+}
+
+/// Whether `v` satisfies a CPE version range.
+fn version_matches(v: &str, r: &CpeRange) -> bool {
+    use std::cmp::Ordering::{Equal, Greater, Less};
+    if let Some(exact) = &r.exact {
+        return cmp_dotted(v, exact) == Equal;
+    }
+    let mut ok = true;
+    if let Some(s) = &r.start_incl {
+        ok &= cmp_dotted(v, s) != Less;
+    }
+    if let Some(s) = &r.start_excl {
+        ok &= cmp_dotted(v, s) == Greater;
+    }
+    if let Some(e) = &r.end_incl {
+        ok &= cmp_dotted(v, e) != Greater;
+    }
+    if let Some(e) = &r.end_excl {
+        ok &= cmp_dotted(v, e) == Less;
+    }
+    ok
+}
+
+/// Compare two dotted numeric versions (`4.17.0.0` vs `4.9.0.0`); missing
+/// components count as 0, non-numeric components as 0.
+fn cmp_dotted(a: &str, b: &str) -> std::cmp::Ordering {
+    let pa: Vec<u64> = a.split('.').map(|x| x.parse().unwrap_or(0)).collect();
+    let pb: Vec<u64> = b.split('.').map(|x| x.parse().unwrap_or(0)).collect();
+    for i in 0..pa.len().max(pb.len()) {
+        let x = pa.get(i).copied().unwrap_or(0);
+        let y = pb.get(i).copied().unwrap_or(0);
+        match x.cmp(&y) {
+            std::cmp::Ordering::Equal => continue,
+            other => return other,
+        }
+    }
+    std::cmp::Ordering::Equal
 }
 
 #[derive(serde::Deserialize)]
@@ -228,3 +424,90 @@ struct OsvVuln {
     summary: Option<String>,
     severity: Option<String>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::cmp::Ordering::{Equal, Greater, Less};
+
+    fn entry(name: &str, ver: &str, pm: &str) -> SbomEntry {
+        SbomEntry::new("t".into(), name.into(), ver.into(), pm.into())
+    }
+
+    #[test]
+    fn finds_the_codesys_runtime_component() {
+        let entries = vec![
+            entry("Standard", "3.5.18.0", "codesys"),
+            entry("CODESYS Control for Linux ARM SL", "4.17.0.0", "codesys"),
+        ];
+        assert_eq!(
+            codesys_runtime(&entries),
+            Some(("CODESYS Control for Linux ARM SL".into(), "4.17.0.0".into()))
+        );
+        // Internal library components are not the runtime.
+        assert!(codesys_runtime(&[entry("Util", "3.5.21.0", "codesys")]).is_none());
+    }
+
+    #[test]
+    fn dotted_version_comparison() {
+        assert_eq!(cmp_dotted("4.17.0.0", "4.9.0.0"), Greater);
+        assert_eq!(cmp_dotted("4.9.0.0", "4.17.0.0"), Less);
+        assert_eq!(cmp_dotted("3.5.18.0", "3.5.18.0"), Equal);
+        assert_eq!(cmp_dotted("4.2", "4.2.0.0"), Equal); // missing components = 0
+    }
+
+    #[test]
+    fn version_range_matching() {
+        let end_excl = CpeRange {
+            end_excl: Some("4.9.0.0".into()),
+            ..Default::default()
+        };
+        assert!(!version_matches("4.17.0.0", &end_excl)); // patched
+        assert!(version_matches("4.5.0.0", &end_excl)); // affected
+
+        let exact = CpeRange {
+            exact: Some("3.5.16.0".into()),
+            ..Default::default()
+        };
+        assert!(version_matches("3.5.16.0", &exact));
+        assert!(!version_matches("3.5.17.0", &exact));
+
+        let span = CpeRange {
+            start_incl: Some("3.0.0.0".into()),
+            end_incl: Some("3.5.16.0".into()),
+            ..Default::default()
+        };
+        assert!(version_matches("3.5.16.0", &span));
+        assert!(!version_matches("3.5.17.0", &span));
+    }
+
+    #[test]
+    fn parses_nvd_and_matches_by_runtime_version() {
+        // Two CODESYS CVEs: one affects < 4.9 (our 4.17 is patched), one affects
+        // <= 4.20 (our 4.17 is affected). Only the latter should match.
+        let body = serde_json::json!({
+          "vulnerabilities": [
+            {"cve": {"id":"CVE-2023-0001",
+              "descriptions":[{"lang":"en","value":"old CmpBlkDrvTcp bug"}],
+              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":7.5}}]},
+              "configurations":[{"nodes":[{"cpeMatch":[
+                {"vulnerable":true,
+                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
+                 "versionEndExcluding":"4.9.0.0"}
+              ]}]}]}},
+            {"cve": {"id":"CVE-2024-0002",
+              "descriptions":[{"lang":"en","value":"recent runtime bug"}],
+              "metrics":{"cvssMetricV31":[{"cvssData":{"baseScore":9.8}}]},
+              "configurations":[{"nodes":[{"cpeMatch":[
+                {"vulnerable":true,
+                 "criteria":"cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*",
+                 "versionEndIncluding":"4.20.0.0"}
+              ]}]}]}}
+          ]
+        });
+        let matched = parse_codesys_nvd(&body, "4.17.0.0");
+        let ids: Vec<&str> = matched.iter().map(|c| c.id.as_str()).collect();
+        assert_eq!(ids, vec!["CVE-2024-0002"]);
+        assert_eq!(matched[0].cvss, Some(9.8));
+    }
+}

compliance-agent/src/pipeline/ics/ethernetip.rs

@@ -0,0 +1,95 @@
+//! Minimal EtherNet/IP (CIP) reachability probe.
+//!
+//! Sends an EtherNet/IP encapsulation **ListIdentity** command (0x0063) over TCP
+//! 44818 and checks for a valid encapsulation reply — confirming a CIP device
+//! without opening a session or writing anything.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Outcome of an EtherNet/IP handshake probe.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct EnipProbe {
+    /// A TCP connection to the port was established.
+    pub reachable: bool,
+    /// The endpoint returned a valid EtherNet/IP encapsulation reply.
+    pub is_enip: bool,
+}
+
+/// Probe an EtherNet/IP endpoint with a ListIdentity request. Read-only.
+pub async fn probe(host: &str, port: u16, budget: Duration) -> EnipProbe {
+    let mut out = EnipProbe::default();
+    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
+        return out;
+    };
+    out.reachable = true;
+
+    // Encapsulation header (24 bytes): command(2) length(2) session(4) status(4)
+    // context(8) options(4). ListIdentity = command 0x0063, everything else zero.
+    let mut req = vec![0u8; 24];
+    req[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
+    if timeout(budget, stream.write_all(&req))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+
+    let mut hdr = [0u8; 24];
+    if timeout(budget, stream.read_exact(&mut hdr))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+    let command = u16::from_le_bytes([hdr[0], hdr[1]]);
+    let status = u32::from_le_bytes([hdr[8], hdr[9], hdr[10], hdr[11]]);
+    // Echoed command + success status = a valid EtherNet/IP encapsulation reply.
+    if command == 0x0063 && status == 0 {
+        out.is_enip = true;
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    async fn mock_server() -> std::net::SocketAddr {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        tokio::spawn(async move {
+            let (mut sock, _) = listener.accept().await.expect("accept");
+            let mut req = [0u8; 24];
+            if sock.read_exact(&mut req).await.is_err() {
+                return;
+            }
+            // Reply: echo command 0x0063, status 0, no data.
+            let mut hdr = vec![0u8; 24];
+            hdr[0..2].copy_from_slice(&0x0063u16.to_le_bytes());
+            let _ = sock.write_all(&hdr).await;
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn probe_detects_an_ethernetip_device() {
+        let addr = mock_server().await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.reachable && p.is_enip);
+    }
+
+    #[tokio::test]
+    async fn probe_reports_unreachable_for_a_closed_port() {
+        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
+        assert!(!p.reachable && !p.is_enip);
+    }
+}

compliance-agent/src/pipeline/ics/mod.rs

@@ -0,0 +1,306 @@
+//! Dynamic ICS (industrial control system) probing for PLC/SPS targets.
+//!
+//! Where the control-logic scanner is static (over ST / PLCopen XML), this probes
+//! the *running* device over industrial protocols and reports exposed /
+//! unauthenticated control interfaces. It is read-only: it never writes to a live
+//! process. Modbus/TCP and OPC UA are implemented; EtherNet-IP is a follow-on.
+
+pub mod ethernetip;
+pub mod modbus;
+pub mod opcua;
+pub mod portscan;
+
+use std::time::Duration;
+
+use compliance_core::models::{Finding, ScanType, Severity};
+
+use crate::pipeline::dedup;
+
+/// Well-known deep-probe ports (each independent of any WebVisu HTTP port).
+const MODBUS_PORT: u16 = 502;
+const OPCUA_PORT: u16 = 4840;
+const ENIP_PORT: u16 = 44818;
+
+/// Probe a PLC/SPS device's industrial-protocol surface and return findings.
+/// Read-only. Deep-probes Modbus/TCP, OPC UA and EtherNet/IP, plus a service
+/// discovery scan of the remaining OT / insecure-management ports. `endpoint` is
+/// the target's live-URL / host reference.
+pub async fn probe_target(endpoint: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let (host, modbus_port) = parse_endpoint(endpoint);
+    let mut findings = modbus_findings(&host, modbus_port, repo_id, budget).await;
+    findings.extend(opcua_findings(&host, OPCUA_PORT, repo_id, budget).await);
+    findings.extend(enip_findings(&host, ENIP_PORT, repo_id, budget).await);
+    findings.extend(portscan_findings(&host, repo_id, budget).await);
+    findings
+}
+
+/// Findings from probing the Modbus/TCP surface.
+async fn modbus_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let probe = modbus::probe(host, port, budget).await;
+    let mut findings = Vec::new();
+    if !probe.speaks_modbus {
+        // Not reachable, or the port does not speak Modbus — nothing to report.
+        return findings;
+    }
+    let target = format!("{host}:{port}");
+
+    // Reachable Modbus/TCP = unauthenticated, cleartext control access by design.
+    let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed", &target]);
+    let mut f = Finding::new(
+        repo_id.to_string(),
+        fp,
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "Modbus/TCP control interface exposed without authentication".to_string(),
+        format!(
+            "The device at {target} answers Modbus/TCP requests. Modbus/TCP has no \
+             authentication or encryption in the protocol, so any host that can reach this \
+             port can read and write process variables (coils/registers) and disrupt the \
+             controlled process."
+        ),
+        Severity::Critical,
+    );
+    f.rule_id = Some("ics-modbus-exposed".to_string());
+    f.cwe = Some("CWE-306".to_string());
+    f.remediation = Some(
+        "Restrict the Modbus/TCP port to a trusted control network (segmentation / \
+         firewall / VPN), never expose it to IT or the internet, and prefer an authenticated \
+         transport (e.g. Modbus/TLS) or a secure protocol gateway where available."
+            .to_string(),
+    );
+    findings.push(f);
+
+    if let Some(dev) = &probe.device {
+        let details = [
+            dev.vendor.as_deref(),
+            dev.product.as_deref(),
+            dev.revision.as_deref(),
+        ]
+        .into_iter()
+        .flatten()
+        .collect::<Vec<_>>()
+        .join(" / ");
+        let fp = dedup::compute_fingerprint(&[repo_id, "ics-device-disclosure", &target]);
+        let mut f = Finding::new(
+            repo_id.to_string(),
+            fp,
+            "ics-probe".to_string(),
+            ScanType::IcsProbe,
+            "PLC device identity disclosed over Modbus".to_string(),
+            format!(
+                "The device at {target} discloses its identity via Modbus Read Device \
+                 Identification: {details}. This aids fingerprinting and targeting of \
+                 known-vulnerable firmware/runtime versions."
+            ),
+            Severity::Low,
+        );
+        f.rule_id = Some("ics-device-disclosure".to_string());
+        f.cwe = Some("CWE-200".to_string());
+        f.remediation = Some(
+            "Limit network reach to the device; Modbus device identification cannot be \
+             disabled, so exposure is bounded by network segmentation."
+                .to_string(),
+        );
+        findings.push(f);
+    }
+
+    // Exposed process points: coils / holding registers that a read enumerated
+    // and that, over unauthenticated Modbus/TCP, are also writable. This is the
+    // concrete attack surface behind the exposure — the live variables an
+    // attacker can overwrite. (Read-only to detect: we never write.)
+    let coils = probe.coils_readable.unwrap_or(0);
+    let registers = probe.holding_registers_readable.unwrap_or(0);
+    if coils > 0 || registers > 0 {
+        let fp = dedup::compute_fingerprint(&[repo_id, "ics-modbus-exposed-points", &target]);
+        let mut f = Finding::new(
+            repo_id.to_string(),
+            fp,
+            "ics-probe".to_string(),
+            ScanType::IcsProbe,
+            "Writable process points exposed over unauthenticated Modbus/TCP".to_string(),
+            format!(
+                "Reading the device at {target} enumerated {coils} coil(s) and {registers} \
+                 holding register(s). Coils and holding registers are read/write process points \
+                 in Modbus, so any host that can reach this port can not only read but overwrite \
+                 live process state (force coils, change setpoints) without authentication."
+            ),
+            Severity::High,
+        );
+        f.rule_id = Some("ics-modbus-exposed-points".to_string());
+        f.cwe = Some("CWE-306".to_string());
+        f.remediation = Some(
+            "Segment the Modbus/TCP port to a trusted control network; where the device \
+             supports it use Modbus/TLS or an authenticating protocol gateway; restrict which \
+             function codes and register ranges are reachable from outside the control zone."
+                .to_string(),
+        );
+        findings.push(f);
+    }
+    findings
+}
+
+/// Findings from probing the OPC UA surface (default port 4840). A reachability
+/// probe only: it flags an exposed OPC UA server for review of its security
+/// policy / authentication (deep SecurityPolicy analysis is a follow-on).
+async fn opcua_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let probe = opcua::probe(host, port, budget).await;
+    let mut findings = Vec::new();
+    if !probe.is_opcua {
+        return findings;
+    }
+    let target = format!("{host}:{port}");
+    let fp = dedup::compute_fingerprint(&[repo_id, "ics-opcua-exposed", &target]);
+    let mut f = Finding::new(
+        repo_id.to_string(),
+        fp,
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "OPC UA server exposed on the network".to_string(),
+        format!(
+            "An OPC UA server answers at {target}. Verify it enforces message security \
+             (a SecurityPolicy other than None) and rejects anonymous sessions — the common \
+             default of SecurityPolicy None + an Anonymous user token allows unauthenticated, \
+             unencrypted read/write of the server's address space."
+        ),
+        Severity::Medium,
+    );
+    f.rule_id = Some("ics-opcua-exposed".to_string());
+    f.cwe = Some("CWE-319".to_string());
+    f.remediation = Some(
+        "Restrict OPC UA (4840) to a trusted network; require a signed & encrypted \
+         SecurityPolicy (Basic256Sha256 or better) with certificate / username \
+         authentication, and disable the Anonymous user token."
+            .to_string(),
+    );
+    findings.push(f);
+    findings
+}
+
+/// Findings from probing the EtherNet/IP (CIP) surface (default port 44818).
+async fn enip_findings(host: &str, port: u16, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let probe = ethernetip::probe(host, port, budget).await;
+    if !probe.is_enip {
+        return Vec::new();
+    }
+    let target = format!("{host}:{port}");
+    let fp = dedup::compute_fingerprint(&[repo_id, "ics-ethernetip-exposed", &target]);
+    let mut f = Finding::new(
+        repo_id.to_string(),
+        fp,
+        "ics-probe".to_string(),
+        ScanType::IcsProbe,
+        "EtherNet/IP (CIP) interface exposed on the network".to_string(),
+        format!(
+            "The device at {target} answers EtherNet/IP (CIP) requests. EtherNet/IP has no \
+             authentication in the base protocol, so a host that can reach it can enumerate \
+             and interact with the device's control objects."
+        ),
+        Severity::High,
+    );
+    f.rule_id = Some("ics-ethernetip-exposed".to_string());
+    f.cwe = Some("CWE-306".to_string());
+    f.remediation = Some(
+        "Restrict EtherNet/IP (44818/2222) to a trusted control network; use CIP Security \
+         (encryption + authentication) on devices that support it."
+            .to_string(),
+    );
+    vec![f]
+}
+
+/// Findings from the service-discovery port scan of the remaining OT /
+/// insecure-management surface.
+async fn portscan_findings(host: &str, repo_id: &str, budget: Duration) -> Vec<Finding> {
+    let open = portscan::scan(host, portscan::KNOWN_PORTS, budget).await;
+    open.into_iter()
+        .map(|kp| {
+            let target = format!("{host}:{}", kp.port);
+            let (title, severity, cwe, description) = match kp.kind {
+                portscan::PortKind::Ics => (
+                    format!("ICS service exposed: {}", kp.service),
+                    Severity::High,
+                    "CWE-306",
+                    format!(
+                        "{target} exposes {} ({}). Industrial protocols are typically \
+                         unauthenticated, so network reach implies control access.",
+                        kp.service, kp.note
+                    ),
+                ),
+                portscan::PortKind::InsecureMgmt => (
+                    format!("Cleartext service exposed: {}", kp.service),
+                    Severity::Medium,
+                    "CWE-319",
+                    format!(
+                        "{target} exposes {} ({}), which transmits credentials and data in \
+                         cleartext.",
+                        kp.service, kp.note
+                    ),
+                ),
+            };
+            let fp = dedup::compute_fingerprint(&[repo_id, "ics-service-exposed", &target]);
+            let mut f = Finding::new(
+                repo_id.to_string(),
+                fp,
+                "ics-probe".to_string(),
+                ScanType::IcsProbe,
+                title,
+                description,
+                severity,
+            );
+            f.rule_id = Some("ics-service-exposed".to_string());
+            f.cwe = Some(cwe.to_string());
+            f.remediation = Some(
+                "Restrict the service to a trusted network segment; disable it if unused; \
+                 replace cleartext protocols (Telnet/FTP) with SSH/SFTP."
+                    .to_string(),
+            );
+            f
+        })
+        .collect()
+}
+
+/// Extract `(host, port)` from a target reference. Modbus lives on its own port
+/// (502 by default), independent of any HTTP/WebVisu URL, so unless the reference
+/// explicitly carries `modbus://host:port` or a bare `host:port`, we probe 502.
+fn parse_endpoint(endpoint: &str) -> (String, u16) {
+    let s = endpoint.trim();
+    let (scheme, rest) = match s.split_once("://") {
+        Some((sch, r)) => (Some(sch.to_ascii_lowercase()), r),
+        None => (None, s),
+    };
+    let hostport = rest.split(['/', '?']).next().unwrap_or(rest);
+    let (host, port) = match hostport.rsplit_once(':') {
+        Some((h, p)) => (h.to_string(), p.parse::<u16>().ok()),
+        None => (hostport.to_string(), None),
+    };
+    let port = match (scheme.as_deref(), port) {
+        // Explicit Modbus port, or a bare host:port the user chose.
+        (Some("modbus"), Some(p)) | (None, Some(p)) => p,
+        // An http(s)/WebVisu URL (or no port): Modbus is on its own port.
+        _ => MODBUS_PORT,
+    };
+    (host, port)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::parse_endpoint;
+
+    #[test]
+    fn endpoint_parsing_picks_the_modbus_port() {
+        assert_eq!(parse_endpoint("10.0.0.5"), ("10.0.0.5".into(), 502));
+        assert_eq!(parse_endpoint("10.0.0.5:1502"), ("10.0.0.5".into(), 1502));
+        assert_eq!(
+            parse_endpoint("modbus://plc.local:5020"),
+            ("plc.local".into(), 5020)
+        );
+        // A WebVisu URL: the http port is ignored; Modbus is on 502.
+        assert_eq!(
+            parse_endpoint("http://plc.local:8080/webvisu"),
+            ("plc.local".into(), 502)
+        );
+        assert_eq!(
+            parse_endpoint("https://plc.local/"),
+            ("plc.local".into(), 502)
+        );
+    }
+}

compliance-agent/src/pipeline/ics/modbus.rs

@@ -0,0 +1,262 @@
+//! Minimal Modbus/TCP client for dynamic ICS probing.
+//!
+//! Modbus/TCP (port 502) has no authentication or encryption in the protocol, so
+//! an endpoint that answers requests is, by design, open to any host that can
+//! reach it. The probe only *reads* — a Read Holding Registers request and a Read
+//! Device Identification request — and never writes to the live process.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Outcome of probing a Modbus/TCP endpoint.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct ModbusProbe {
+    /// A TCP connection to the port was established.
+    pub reachable: bool,
+    /// The endpoint answered a Modbus request (a normal reply or a Modbus
+    /// exception) — i.e. it speaks Modbus, unauthenticated.
+    pub speaks_modbus: bool,
+    /// Device identity, if disclosed via Read Device Identification (FC 43 / 14).
+    pub device: Option<DeviceId>,
+    /// Coils returned by a Read Coils of the first block, if that address range
+    /// exists. Coils are read/write process bits, so an exposed block is an
+    /// unauthenticated write surface on the live process.
+    pub coils_readable: Option<u16>,
+    /// Holding registers returned by a Read Holding Registers of the first block,
+    /// if that range exists. Holding registers are read/write process words.
+    pub holding_registers_readable: Option<u16>,
+}
+
+/// Vendor / product / revision from Read Device Identification.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct DeviceId {
+    pub vendor: Option<String>,
+    pub product: Option<String>,
+    pub revision: Option<String>,
+}
+
+/// How many coils / holding registers to request when enumerating the exposed
+/// process surface. Read-only: a normal reply means the block exists and is,
+/// over unauthenticated Modbus/TCP, also writable.
+const ENUM_QTY: u16 = 16;
+
+/// Probe a Modbus/TCP endpoint. Read-only: issues Read Holding Registers, Read
+/// Coils, and Read Device Identification requests; never writes to the device.
+pub async fn probe(host: &str, port: u16, budget: Duration) -> ModbusProbe {
+    let mut out = ModbusProbe::default();
+    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
+        return out; // unreachable
+    };
+    out.reachable = true;
+
+    // Read Holding Registers (FC 0x03), unit 1, addr 0 — a benign read that also
+    // enumerates the exposed register block.
+    let rhr = [0x03u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
+    if let Some(resp) = txn(&mut stream, 1, &rhr, budget).await {
+        // A normal reply (0x03) or an exception (0x83) both prove it speaks Modbus.
+        if matches!(resp.first(), Some(0x03) | Some(0x83)) {
+            out.speaks_modbus = true;
+        }
+        if resp.first() == Some(&0x03) {
+            out.holding_registers_readable = Some(register_count_from_reply(&resp));
+        }
+    }
+
+    // Read Coils (FC 0x01), addr 0 — enumerates the exposed coil (bit) block.
+    let rc = [0x01u8, 0x00, 0x00, (ENUM_QTY >> 8) as u8, ENUM_QTY as u8];
+    if let Some(resp) = txn(&mut stream, 1, &rc, budget).await {
+        if matches!(resp.first(), Some(0x01) | Some(0x81)) {
+            out.speaks_modbus = true;
+        }
+        if resp.first() == Some(&0x01) {
+            out.coils_readable = Some(coil_count_from_reply(&resp));
+        }
+    }
+
+    // Read Device Identification (FC 0x2B / MEI 0x0E), basic (0x01), object 0.
+    let rdi = [0x2Bu8, 0x0E, 0x01, 0x00];
+    if let Some(resp) = txn(&mut stream, 1, &rdi, budget).await {
+        if resp.first() == Some(&0x2B) {
+            out.speaks_modbus = true;
+            out.device = parse_device_id(&resp);
+        }
+    }
+    out
+}
+
+/// Coils reported by a Read Coils reply `[0x01, byte_count, data…]` (8 per byte).
+fn coil_count_from_reply(pdu: &[u8]) -> u16 {
+    pdu.get(1).map(|&b| u16::from(b) * 8).unwrap_or(0)
+}
+
+/// Registers reported by a Read Holding Registers reply `[0x03, byte_count,
+/// data…]` (2 bytes per register).
+fn register_count_from_reply(pdu: &[u8]) -> u16 {
+    pdu.get(1).map(|&b| u16::from(b) / 2).unwrap_or(0)
+}
+
+/// Send one Modbus PDU and return the response PDU (function code + data), or
+/// `None` on timeout / malformed reply.
+async fn txn(stream: &mut TcpStream, unit: u8, pdu: &[u8], budget: Duration) -> Option<Vec<u8>> {
+    // MBAP header: transaction id (2) + protocol id (2) = 0 + length (2) + unit (1),
+    // then the PDU. `length` counts the unit byte plus the PDU.
+    let len = (pdu.len() + 1) as u16;
+    let mut frame = Vec::with_capacity(7 + pdu.len());
+    frame.extend_from_slice(&[0x00, 0x01]); // transaction id
+    frame.extend_from_slice(&[0x00, 0x00]); // protocol id
+    frame.extend_from_slice(&len.to_be_bytes());
+    frame.push(unit);
+    frame.extend_from_slice(pdu);
+    timeout(budget, stream.write_all(&frame)).await.ok()?.ok()?;
+
+    let mut hdr = [0u8; 7];
+    timeout(budget, stream.read_exact(&mut hdr))
+        .await
+        .ok()?
+        .ok()?;
+    // Reject non-Modbus replies (protocol id must be 0).
+    if hdr[2] != 0 || hdr[3] != 0 {
+        return None;
+    }
+    let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
+    if !(2..=260).contains(&plen) {
+        return None;
+    }
+    let mut body = vec![0u8; plen - 1]; // minus the unit id already in hdr[6]
+    timeout(budget, stream.read_exact(&mut body))
+        .await
+        .ok()?
+        .ok()?;
+    Some(body)
+}
+
+/// Parse vendor / product / revision from a Read Device Identification PDU:
+/// `[0x2B, 0x0E, readDevIdCode, conformity, moreFollows, nextObjId, numObjects,
+/// (objId, len, bytes…)…]`.
+fn parse_device_id(pdu: &[u8]) -> Option<DeviceId> {
+    if pdu.len() < 7 {
+        return None;
+    }
+    let num = pdu[6] as usize;
+    let mut i = 7;
+    let mut dev = DeviceId::default();
+    for _ in 0..num {
+        if i + 2 > pdu.len() {
+            break;
+        }
+        let id = pdu[i];
+        let l = pdu[i + 1] as usize;
+        i += 2;
+        if i + l > pdu.len() {
+            break;
+        }
+        let val = String::from_utf8_lossy(&pdu[i..i + l]).trim().to_string();
+        i += l;
+        match id {
+            0x00 => dev.vendor = Some(val),
+            0x01 => dev.product = Some(val),
+            0x02 => dev.revision = Some(val),
+            _ => {}
+        }
+    }
+    if dev == DeviceId::default() {
+        None
+    } else {
+        Some(dev)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    /// A one-shot mock Modbus/TCP server that answers a Read Holding Registers
+    /// request and a Read Device Identification request on one connection.
+    async fn mock_server(with_device: bool) -> std::net::SocketAddr {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        tokio::spawn(async move {
+            let (mut sock, _) = listener.accept().await.expect("accept");
+            loop {
+                let mut hdr = [0u8; 7];
+                if sock.read_exact(&mut hdr).await.is_err() {
+                    break;
+                }
+                let plen = u16::from_be_bytes([hdr[4], hdr[5]]) as usize;
+                let mut pdu = vec![0u8; plen - 1];
+                if sock.read_exact(&mut pdu).await.is_err() {
+                    break;
+                }
+                let reply_pdu: Vec<u8> = match pdu.first() {
+                    Some(0x03) => vec![0x03, 0x02, 0x00, 0x00], // 1 register (byte_count 2)
+                    Some(0x01) => vec![0x01, 0x02, 0xFF, 0xFF], // 16 coils (byte_count 2)
+                    Some(0x2B) if with_device => vec![
+                        0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x02, // 2 objects
+                        0x00, 0x04, b'A', b'C', b'M', b'E', // vendor
+                        0x01, 0x03, b'P', b'L', b'C', // product
+                    ],
+                    _ => vec![pdu[0] | 0x80, 0x01], // exception
+                };
+                let len = (reply_pdu.len() + 1) as u16;
+                let mut frame = vec![hdr[0], hdr[1], 0x00, 0x00];
+                frame.extend_from_slice(&len.to_be_bytes());
+                frame.push(hdr[6]);
+                frame.extend_from_slice(&reply_pdu);
+                if sock.write_all(&frame).await.is_err() {
+                    break;
+                }
+            }
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn probe_detects_a_modbus_endpoint_and_reads_device_id() {
+        let addr = mock_server(true).await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.reachable && p.speaks_modbus);
+        let dev = p.device.expect("device id");
+        assert_eq!(dev.vendor.as_deref(), Some("ACME"));
+        assert_eq!(dev.product.as_deref(), Some("PLC"));
+    }
+
+    #[tokio::test]
+    async fn probe_enumerates_exposed_process_points() {
+        let addr = mock_server(false).await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.speaks_modbus);
+        // The mock returns a 2-byte holding-register block (1 register) and a
+        // 2-byte coil block (16 coils).
+        assert_eq!(p.holding_registers_readable, Some(1));
+        assert_eq!(p.coils_readable, Some(16));
+    }
+
+    #[test]
+    fn reply_counts_decode_byte_counts() {
+        assert_eq!(register_count_from_reply(&[0x03, 0x08]), 4); // 8 bytes → 4 regs
+        assert_eq!(coil_count_from_reply(&[0x01, 0x03]), 24); // 3 bytes → 24 coils
+        assert_eq!(register_count_from_reply(&[0x03]), 0); // malformed → 0
+    }
+
+    #[tokio::test]
+    async fn probe_reports_unreachable_for_a_closed_port() {
+        // 127.0.0.1:1 is (almost certainly) closed.
+        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
+        assert!(!p.reachable && !p.speaks_modbus);
+    }
+
+    #[test]
+    fn parses_device_identification_objects() {
+        let pdu = [
+            0x2B, 0x0E, 0x01, 0x81, 0x00, 0x00, 0x01, // 1 object
+            0x02, 0x05, b'v', b'1', b'.', b'2', b'3', // revision
+        ];
+        let dev = parse_device_id(&pdu).expect("device");
+        assert_eq!(dev.revision.as_deref(), Some("v1.23"));
+        assert!(dev.vendor.is_none());
+    }
+}

compliance-agent/src/pipeline/ics/opcua.rs

@@ -0,0 +1,131 @@
+//! Minimal OPC UA reachability probe.
+//!
+//! Speaks just the OPC UA Connection Protocol (UACP) handshake — a `HEL` (Hello)
+//! message, expecting an `ACK` (or `ERR`) reply — to confirm an OPC UA server is
+//! listening (default port 4840). It does **not** open a secure channel or make
+//! service calls; deep analysis of the server's SecurityPolicy / user-token
+//! policies (the common `None` + `Anonymous` misconfiguration) is a follow-on best
+//! done with a full OPC UA stack.
+
+use std::time::Duration;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Outcome of an OPC UA handshake probe.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct OpcUaProbe {
+    /// A TCP connection to the port was established.
+    pub reachable: bool,
+    /// The endpoint replied to the UACP Hello (`ACK`) or rejected it (`ERR`) —
+    /// either way it speaks OPC UA.
+    pub is_opcua: bool,
+}
+
+/// Probe an OPC UA endpoint with a UACP Hello. Read-only handshake only.
+pub async fn probe(host: &str, port: u16, budget: Duration) -> OpcUaProbe {
+    let mut out = OpcUaProbe::default();
+    let Ok(Ok(mut stream)) = timeout(budget, TcpStream::connect((host, port))).await else {
+        return out;
+    };
+    out.reachable = true;
+
+    let hello = hello_message(&format!("opc.tcp://{host}:{port}"));
+    if timeout(budget, stream.write_all(&hello))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+
+    // Read the 3-byte message type of the reply: ACK (accepted) or ERR (rejected
+    // our hello) both prove the peer speaks the OPC UA connection protocol.
+    let mut mt = [0u8; 3];
+    if timeout(budget, stream.read_exact(&mut mt))
+        .await
+        .ok()
+        .and_then(Result::ok)
+        .is_none()
+    {
+        return out;
+    }
+    if &mt == b"ACK" || &mt == b"ERR" {
+        out.is_opcua = true;
+    }
+    out
+}
+
+/// Build a UACP `HEL` (Hello) message advertising our buffer sizes + endpoint URL.
+fn hello_message(endpoint_url: &str) -> Vec<u8> {
+    let url = endpoint_url.as_bytes();
+    let mut m = Vec::with_capacity(32 + url.len());
+    m.extend_from_slice(b"HELF");
+    m.extend_from_slice(&0u32.to_le_bytes()); // message size — patched below
+    m.extend_from_slice(&0u32.to_le_bytes()); // ProtocolVersion
+    m.extend_from_slice(&65536u32.to_le_bytes()); // ReceiveBufferSize
+    m.extend_from_slice(&65536u32.to_le_bytes()); // SendBufferSize
+    m.extend_from_slice(&0u32.to_le_bytes()); // MaxMessageSize (0 = no limit)
+    m.extend_from_slice(&0u32.to_le_bytes()); // MaxChunkCount
+    m.extend_from_slice(&(url.len() as i32).to_le_bytes()); // EndpointUrl length
+    m.extend_from_slice(url);
+    let size = m.len() as u32;
+    m[4..8].copy_from_slice(&size.to_le_bytes());
+    m
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    /// A mock OPC UA server that reads the Hello and replies with an `ACK` frame.
+    async fn mock_server() -> std::net::SocketAddr {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("addr");
+        tokio::spawn(async move {
+            let (mut sock, _) = listener.accept().await.expect("accept");
+            // Read the Hello header (8 bytes) to learn the size, then drain it.
+            let mut hdr = [0u8; 8];
+            if sock.read_exact(&mut hdr).await.is_err() {
+                return;
+            }
+            let size = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
+            let mut rest = vec![0u8; size.saturating_sub(8)];
+            let _ = sock.read_exact(&mut rest).await;
+            // Reply: ACK + size + 5 u32 fields.
+            let mut ack = Vec::new();
+            ack.extend_from_slice(b"ACKF");
+            ack.extend_from_slice(&28u32.to_le_bytes());
+            for _ in 0..5 {
+                ack.extend_from_slice(&0u32.to_le_bytes());
+            }
+            let _ = sock.write_all(&ack).await;
+        });
+        addr
+    }
+
+    #[tokio::test]
+    async fn probe_detects_an_opcua_server() {
+        let addr = mock_server().await;
+        let p = probe(&addr.ip().to_string(), addr.port(), Duration::from_secs(2)).await;
+        assert!(p.reachable && p.is_opcua);
+    }
+
+    #[tokio::test]
+    async fn probe_reports_unreachable_for_a_closed_port() {
+        let p = probe("127.0.0.1", 1, Duration::from_millis(500)).await;
+        assert!(!p.reachable && !p.is_opcua);
+    }
+
+    #[test]
+    fn hello_message_is_well_formed() {
+        let m = hello_message("opc.tcp://h:4840");
+        assert_eq!(&m[0..4], b"HELF");
+        // The embedded size equals the actual length.
+        let size = u32::from_le_bytes([m[4], m[5], m[6], m[7]]) as usize;
+        assert_eq!(size, m.len());
+    }
+}

compliance-agent/src/pipeline/ics/portscan.rs

@@ -0,0 +1,137 @@
+//! TCP service discovery for a device.
+//!
+//! Connect-scans a curated set of OT/ICS and insecure-management ports and reports
+//! the ones that are open. The deep protocol probes own Modbus (502), OPC UA
+//! (4840) and EtherNet/IP (44818); this surfaces the *rest* of the industrial and
+//! cleartext-management surface (Siemens S7, DNP3, CODESYS programming, Telnet, …).
+
+use std::time::Duration;
+
+use futures_util::future::join_all;
+use tokio::net::TcpStream;
+use tokio::time::timeout;
+
+/// Whether an open port is an industrial protocol or an insecure management service.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PortKind {
+    /// An industrial control protocol (typically unauthenticated).
+    Ics,
+    /// A cleartext management service (credentials/data in the clear).
+    InsecureMgmt,
+}
+
+/// A well-known port worth flagging when open.
+#[derive(Debug, Clone, Copy)]
+pub struct KnownPort {
+    pub port: u16,
+    pub service: &'static str,
+    pub kind: PortKind,
+    pub note: &'static str,
+}
+
+/// The curated scan list. Excludes 502 / 4840 / 44818 — those have dedicated deep
+/// probes (Modbus, OPC UA, EtherNet/IP) that report richer findings.
+pub const KNOWN_PORTS: &[KnownPort] = &[
+    KnownPort {
+        port: 102,
+        service: "S7comm / ISO-TSAP",
+        kind: PortKind::Ics,
+        note: "Siemens S7 PLC communication",
+    },
+    KnownPort {
+        port: 20000,
+        service: "DNP3",
+        kind: PortKind::Ics,
+        note: "SCADA / DNP3",
+    },
+    KnownPort {
+        port: 1911,
+        service: "Niagara Fox",
+        kind: PortKind::Ics,
+        note: "Tridium Niagara building automation",
+    },
+    KnownPort {
+        port: 11740,
+        service: "CODESYS",
+        kind: PortKind::Ics,
+        note: "CODESYS programming protocol",
+    },
+    KnownPort {
+        port: 1962,
+        service: "PCWorx",
+        kind: PortKind::Ics,
+        note: "Phoenix Contact PCWorx",
+    },
+    KnownPort {
+        port: 9600,
+        service: "OMRON FINS",
+        kind: PortKind::Ics,
+        note: "Omron FINS",
+    },
+    KnownPort {
+        port: 789,
+        service: "Red Lion Crimson",
+        kind: PortKind::Ics,
+        note: "Red Lion controllers",
+    },
+    KnownPort {
+        port: 23,
+        service: "Telnet",
+        kind: PortKind::InsecureMgmt,
+        note: "cleartext remote shell",
+    },
+    KnownPort {
+        port: 21,
+        service: "FTP",
+        kind: PortKind::InsecureMgmt,
+        note: "cleartext file transfer",
+    },
+];
+
+/// Connect-scan `ports` on `host` (concurrently) and return those that accept a
+/// TCP connection.
+pub async fn scan<'a>(host: &str, ports: &'a [KnownPort], budget: Duration) -> Vec<&'a KnownPort> {
+    let checks = ports.iter().map(|kp| async move {
+        let open = timeout(budget, TcpStream::connect((host, kp.port)))
+            .await
+            .map(|r| r.is_ok())
+            .unwrap_or(false);
+        (kp, open)
+    });
+    join_all(checks)
+        .await
+        .into_iter()
+        .filter_map(|(kp, open)| open.then_some(kp))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::net::TcpListener;
+
+    #[tokio::test]
+    async fn scan_reports_only_open_ports() {
+        // Bind one port (open) and pick another that is closed.
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let open_port = listener.local_addr().expect("addr").port();
+
+        let ports = [
+            KnownPort {
+                port: open_port,
+                service: "test-open",
+                kind: PortKind::Ics,
+                note: "",
+            },
+            KnownPort {
+                port: 1,
+                service: "test-closed",
+                kind: PortKind::InsecureMgmt,
+                note: "",
+            },
+        ];
+        let found = scan("127.0.0.1", &ports, Duration::from_millis(500)).await;
+        let services: Vec<&str> = found.iter().map(|p| p.service).collect();
+        assert_eq!(services, vec!["test-open"]);
+    }
+}

compliance-agent/src/pipeline/mod.rs

@@ -5,6 +5,7 @@ pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
+pub mod ics;
 mod issue_creation;
 pub mod lint;
 pub mod orchestrator;

compliance-agent/src/pipeline/orchestrator.rs

@@ -259,67 +259,12 @@ impl PipelineOrchestrator {
                 .await?;
         }
 
-        // Persist CVE alerts and create notifications
-        {
-            use compliance_core::models::notification::{parse_severity, CveNotification};
-
-            let repo_name = repo.name.clone();
-            let mut new_notif_count = 0u32;
-
-            for alert in &cve_alerts {
-                // Upsert the alert
-                let filter = doc! {
-                    "cve_id": &alert.cve_id,
-                    "repo_id": &alert.repo_id,
-                };
-                let update = mongodb::bson::to_document(alert)
-                    .map(|d| doc! { "$set": d })
-                    .unwrap_or_else(|_| doc! {});
-                self.db
-                    .cve_alerts()
-                    .update_one(filter, update)
-                    .upsert(true)
-                    .await?;
-
-                // Create notification (dedup by cve_id + repo + package + version)
-                let notif_filter = doc! {
-                    "cve_id": &alert.cve_id,
-                    "repo_id": &alert.repo_id,
-                    "package_name": &alert.affected_package,
-                    "package_version": &alert.affected_version,
-                };
-                let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
-                let mut notification = CveNotification::new(
-                    alert.cve_id.clone(),
-                    repo_id.clone(),
-                    repo_name.clone(),
-                    alert.affected_package.clone(),
-                    alert.affected_version.clone(),
-                    severity,
-                );
-                notification.cvss_score = alert.cvss_score;
-                notification.summary = alert.summary.clone();
-                notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
-
-                let notif_update = doc! {
-                    "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
-                };
-                if let Ok(result) = self
-                    .db
-                    .cve_notifications()
-                    .update_one(notif_filter, notif_update)
-                    .upsert(true)
-                    .await
-                {
-                    if result.upserted_id.is_some() {
-                        new_notif_count += 1;
-                    }
-                }
-            }
-
-            if new_notif_count > 0 {
-                tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
-            }
+        // Persist CVE alerts and create notifications (shared with the PLC path).
+        let new_notif_count = self
+            .persist_cve_alerts(&repo_id, &repo.name, &cve_alerts)
+            .await?;
+        if new_notif_count > 0 {
+            tracing::info!("[{repo_id}] Created {new_notif_count} CVE notification(s)");
         }
 
         // Stage 6: Issue Creation
@@ -449,38 +394,77 @@ impl PipelineOrchestrator {
         // wizard-created targets, not just migrated ones.
         self.ensure_dast_target(target, &plan).await;
 
-        // PLC control-logic analysis for PLC/SPS targets (a PlcProject artifact).
-        if plan.has(ScanType::PlcControlLogic) {
-            return self.run_plc_scan(target, &target_id, scan_run_id).await;
+        // PLC/SPS targets: the control-logic scan consumes the PLC source (an
+        // uploaded PlcProject *or* a git repo / source archive of PLCopen XML / ST
+        // exports), so it takes over the code artifact — we don't also run the
+        // SAST pipeline over it. A PLC device is reachable, so DAST still runs
+        // against a WebVisu / exposed endpoint when one is provisioned.
+        let mut new_count = 0u32;
+        let plc = plan.has(ScanType::PlcControlLogic);
+        let ics = plan.has(ScanType::IcsProbe);
+        if plc {
+            new_count += self.run_plc_scan(target, &target_id, scan_run_id).await?;
+            // Provision-and-test (#183): with the control logic but no reachable
+            // device, instantiate it on an ephemeral soft-PLC and probe that
+            // instead of the customer's OT network. Opt-in (needs Docker) and only
+            // when there is no live URL to probe directly. Never fails the scan.
+            if self.config.plc_runtime.enabled && target.live_url().is_none() {
+                match self
+                    .run_provisioned_plc_test(target, &target_id, scan_run_id)
+                    .await
+                {
+                    Ok(n) => new_count += n,
+                    Err(e) => {
+                        tracing::warn!(target_id = %target_id, error = %e, "provision-and-test failed")
+                    }
+                }
+            }
+        }
+        if ics {
+            new_count += self.run_ics_probe(target, &target_id, scan_run_id).await?;
+        }
+        if plc || ics {
+            // PLC/SPS device: also DAST against a WebVisu / exposed endpoint, but
+            // only when DAST is actually planned — a device reachable only over an
+            // industrial protocol (e.g. modbus://) has no web surface to crawl, and
+            // running DAST there just fails at reconnaissance. Gating here (not only
+            // at provisioning) also stops a DAST target left over from an earlier
+            // run from re-triggering. The control-logic scan already consumed the
+            // code artifact, so the SAST pipeline is not re-run.
+            if plan.has(ScanType::Dast) {
+                self.update_phase(scan_run_id, "dast_scanning").await;
+                self.maybe_trigger_dast(&target_id, scan_run_id).await;
+            }
+            return Ok(new_count);
         }
 
         match target.code_artifact() {
             Some(code) if code.kind == ArtifactKind::GitRepo => {
                 let repo = RepoView::from_target(target, code);
-                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
-                self.finalize_target(target, &repo, new_count).await?;
-                Ok(new_count)
+                let n = self.run_pipeline(&repo, scan_run_id).await?;
+                self.finalize_target(target, &repo, n).await?;
+                new_count += n;
             }
             Some(_) => {
                 tracing::warn!(
                     target_id = %target_id,
                     "Unified pipeline: source-archive scanning not yet wired; skipping"
                 );
-                Ok(0)
             }
             None => {
-                // No code to scan. Firmware/PLC/mobile static scanners land in
-                // #128/#129/#130; DAST for a running URL still works when a
-                // DastTarget row exists (migrated targets).
+                // No code to scan (a migrated DAST target). Firmware/mobile static
+                // scanners land in #128/#129; DAST for a running URL works when a
+                // DastTarget row exists (provisioned above from a LiveUrl, or from
+                // a migrated target).
                 tracing::info!(
                     target_id = %target_id,
-                    "Unified pipeline: no code artifact; attempting DAST only"
+                    "Unified pipeline: no code artifact; attempting DAST"
                 );
                 self.update_phase(scan_run_id, "dast_scanning").await;
                 self.maybe_trigger_dast(&target_id, scan_run_id).await;
-                Ok(0)
             }
         }
+        Ok(new_count)
     }
 
     /// Analyze a PLC/SPS project (Structured Text / PLCopen XML) for
@@ -496,22 +480,196 @@ impl PipelineOrchestrator {
 
         let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
         let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
-        let path = target
-            .first_of(ArtifactKind::PlcProject)
-            .and_then(|a| ingest_set.get(&a.id))
-            .and_then(|ia| ia.working_path.clone());
-        let Some(path) = path else {
-            tracing::warn!(target_id, "PLC scan: no ingested PLC project path");
+        // Every PLC-source artifact on the target: dedicated PLC projects plus any
+        // code artifacts (git repo / source archive) holding PLCopen XML / ST
+        // exports. A target can carry several (e.g. one POU export per file).
+        let sources: Vec<&Artifact> = target
+            .artifacts
+            .iter()
+            .filter(|a| {
+                matches!(
+                    a.kind,
+                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+                )
+            })
+            .collect();
+        if sources.is_empty() {
+            tracing::warn!(target_id, "PLC scan: no PLC source artifact");
             return Ok(0);
-        };
+        }
 
-        let findings = crate::pipeline::plc::analyze_tree(&path, target_id);
+        let mut all_findings = Vec::new();
+        let mut all_sbom: Vec<SbomEntry> = Vec::new();
+        let mut sbom_seen = std::collections::BTreeSet::new();
+        for a in &sources {
+            let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
+                continue;
+            };
+            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
+            // Control-application SBOM: CODESYS libraries + runtime from a
+            // `.projectarchive` (uploaded, or committed in the working tree).
+            let archive = a
+                .stored_path
+                .clone()
+                .unwrap_or_else(|| a.source_ref.clone());
+            for e in crate::pipeline::plc::sbom::collect_sbom(
+                std::path::Path::new(&archive),
+                &path,
+                target_id,
+            ) {
+                if sbom_seen.insert((e.name.clone(), e.version.clone())) {
+                    all_sbom.push(e);
+                }
+            }
+        }
         tracing::info!(
             target_id,
-            found = findings.len(),
+            artifacts = sources.len(),
+            found = all_findings.len(),
             "PLC control-logic analysis complete"
         );
 
+        let mut new_count = 0u32;
+        for mut finding in all_findings {
+            finding.scan_run_id = Some(scan_run_id.to_string());
+            if self
+                .db
+                .findings()
+                .find_one(doc! { "fingerprint": &finding.fingerprint })
+                .await?
+                .is_none()
+            {
+                self.db.findings().insert_one(&finding).await?;
+                new_count += 1;
+            }
+        }
+
+        if !all_sbom.is_empty() {
+            if let Err(e) = self
+                .persist_control_app_sbom(target_id, &target.name, all_sbom)
+                .await
+            {
+                tracing::warn!(target_id, error = %e, "control-app SBOM persist failed");
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Provision-and-test (#183): instantiate the target's control logic on an
+    /// ephemeral soft-PLC (OpenPLC), start it, probe the provisioned Modbus
+    /// endpoint, and tear the instance down. Used when a PLC/SPS target has the
+    /// control logic but no reachable live device to probe directly. Guarded by
+    /// `plc_runtime.enabled` (needs Docker); persists the same [`ScanType::IcsProbe`]
+    /// findings as a live probe.
+    async fn run_provisioned_plc_test(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        self.update_phase(scan_run_id, "plc_provision").await;
+
+        // Locate a loadable control-logic program among the PLC-source artifacts
+        // (same selection as the static PLC scan: dedicated PLC projects plus code
+        // artifacts holding PLCopen XML / ST exports).
+        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
+        let ingest_set = crate::ingest::ingest_all(target, &ctx)?;
+        let program = target
+            .artifacts
+            .iter()
+            .filter(|a| {
+                matches!(
+                    a.kind,
+                    ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+                )
+            })
+            .find_map(|a| {
+                let path = ingest_set
+                    .get(&a.id)
+                    .and_then(|ia| ia.working_path.clone())?;
+                crate::pipeline::plc::runtime::extract_program(&path)
+            });
+        let Some(program) = program else {
+            tracing::info!(
+                target_id,
+                "provision-and-test: no loadable control-logic program"
+            );
+            return Ok(0);
+        };
+
+        let http = crate::pipeline::plc::runtime::http_client()?;
+        let provisioner =
+            crate::pipeline::plc::runtime::DockerSoftPlc::new(self.config.plc_runtime.clone());
+        let outcome = crate::pipeline::plc::runtime::provision_and_test(
+            &provisioner,
+            &http,
+            &self.config.plc_runtime,
+            &program,
+            target_id,
+        )
+        .await?;
+        tracing::info!(
+            target_id,
+            found = outcome.findings.len(),
+            dast = outcome.dast.is_some(),
+            "provision-and-test complete"
+        );
+
+        let mut new_count = 0u32;
+        for mut finding in outcome.findings {
+            finding.scan_run_id = Some(scan_run_id.to_string());
+            if self
+                .db
+                .findings()
+                .find_one(doc! { "fingerprint": &finding.fingerprint })
+                .await?
+                .is_none()
+            {
+                self.db.findings().insert_one(&finding).await?;
+                new_count += 1;
+            }
+        }
+
+        // Persist the DAST scan of the provisioned web endpoint, linked to this
+        // scan run (mirrors `maybe_trigger_dast`).
+        if let Some(dast) = outcome.dast {
+            let mut scan_run = dast.scan_run;
+            scan_run.sast_scan_run_id = Some(scan_run_id.to_string());
+            if let Err(e) = self.db.dast_scan_runs().insert_one(&scan_run).await {
+                tracing::warn!(target_id, error = %e, "failed to store provisioned DAST scan run");
+            }
+            for finding in &dast.findings {
+                if let Err(e) = self.db.dast_findings().insert_one(finding).await {
+                    tracing::warn!(target_id, error = %e, "failed to store provisioned DAST finding");
+                }
+            }
+        }
+        Ok(new_count)
+    }
+
+    /// Probe a running PLC/SPS device over industrial protocols (Modbus/TCP, …)
+    /// and persist findings for exposed / unauthenticated control access. The
+    /// probe is read-only; it targets the Modbus port of the target's live URL.
+    async fn run_ics_probe(
+        &self,
+        target: &OnboardedTarget,
+        target_id: &str,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
+        self.update_phase(scan_run_id, "ics_probe").await;
+        let Some(endpoint) = target.live_url().map(|a| a.source_ref.clone()) else {
+            tracing::warn!(target_id, "ICS probe: no live URL");
+            return Ok(0);
+        };
+        // Short per-request budget so an unreachable device doesn't stall the scan.
+        let budget = std::time::Duration::from_secs(5);
+        let findings = crate::pipeline::ics::probe_target(&endpoint, target_id, budget).await;
+        tracing::info!(
+            target_id,
+            endpoint = %endpoint,
+            found = findings.len(),
+            "ICS probe complete"
+        );
         let mut new_count = 0u32;
         for mut finding in findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
@@ -529,6 +687,150 @@ impl PipelineOrchestrator {
         Ok(new_count)
     }
 
+    /// Store a control-application SBOM (CODESYS libraries + runtime) for a target
+    /// and match it against known CVEs. Scoped to `package_manager = "codesys"` so
+    /// it refreshes on re-scan and coexists with any firmware/source SBOM. The
+    /// runtime `Cmp*` / `3SLicense` components carry real CODESYS advisories, so
+    /// this is where PLC-device CVE coverage comes from.
+    async fn persist_control_app_sbom(
+        &self,
+        target_id: &str,
+        target_name: &str,
+        mut entries: Vec<SbomEntry>,
+    ) -> Result<(), AgentError> {
+        if entries.is_empty() {
+            return Ok(());
+        }
+        self.db
+            .sbom_entries()
+            .delete_many(doc! { "repo_id": target_id, "package_manager": "codesys" })
+            .await?;
+
+        let cve_scanner = CveScanner::new(
+            self.http.clone(),
+            self.config.searxng_url.clone(),
+            self.config.nvd_api_key.as_ref().map(|k| {
+                use secrecy::ExposeSecret;
+                k.expose_secret().to_string()
+            }),
+        );
+        let mut alerts = match tokio::time::timeout(
+            std::time::Duration::from_secs(600),
+            cve_scanner.scan_dependencies(target_id, &mut entries),
+        )
+        .await
+        {
+            Ok(Ok(a)) => a,
+            Ok(Err(e)) => {
+                tracing::warn!(target_id, error = %e, "control-app CVE scan failed");
+                Vec::new()
+            }
+            Err(_) => {
+                tracing::warn!(target_id, "control-app CVE scan timed out");
+                Vec::new()
+            }
+        };
+        // OSV can't match `pkg:codesys/*` (no such ecosystem); CODESYS advisories
+        // live in NVD keyed by CPE + runtime version. Add those (best-effort).
+        if let Ok(codesys) = tokio::time::timeout(
+            std::time::Duration::from_secs(120),
+            cve_scanner.scan_codesys(target_id, &mut entries),
+        )
+        .await
+        {
+            alerts.extend(codesys);
+        } else {
+            tracing::warn!(target_id, "CODESYS CVE match timed out");
+        }
+
+        for entry in &entries {
+            let filter = doc! {
+                "repo_id": &entry.repo_id,
+                "name": &entry.name,
+                "version": &entry.version,
+            };
+            if let Ok(d) = mongodb::bson::to_document(entry) {
+                self.db
+                    .sbom_entries()
+                    .update_one(filter, doc! { "$set": d })
+                    .upsert(true)
+                    .await?;
+            }
+        }
+        let new_notifs = self
+            .persist_cve_alerts(target_id, target_name, &alerts)
+            .await?;
+        tracing::info!(
+            target_id,
+            components = entries.len(),
+            alerts = alerts.len(),
+            notifications = new_notifs,
+            "control-app SBOM stored"
+        );
+        Ok(())
+    }
+
+    /// Upsert CVE alerts for a target and create dedup'd CVE notifications;
+    /// returns the number of newly-created notifications. Shared by the SAST
+    /// pipeline and the PLC control-app SBOM path, so every SBOM source (source,
+    /// firmware, CODESYS libraries/runtime) raises the same notifications.
+    async fn persist_cve_alerts(
+        &self,
+        repo_id: &str,
+        repo_name: &str,
+        alerts: &[CveAlert],
+    ) -> Result<u32, AgentError> {
+        use compliance_core::models::notification::{parse_severity, CveNotification};
+
+        let mut new_notif = 0u32;
+        for alert in alerts {
+            let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
+            let update = mongodb::bson::to_document(alert)
+                .map(|d| doc! { "$set": d })
+                .unwrap_or_else(|_| doc! {});
+            self.db
+                .cve_alerts()
+                .update_one(filter, update)
+                .upsert(true)
+                .await?;
+
+            // Dedup notifications by cve + repo + package + version.
+            let notif_filter = doc! {
+                "cve_id": &alert.cve_id,
+                "repo_id": &alert.repo_id,
+                "package_name": &alert.affected_package,
+                "package_version": &alert.affected_version,
+            };
+            let severity = parse_severity(alert.severity.as_deref(), alert.cvss_score);
+            let mut notification = CveNotification::new(
+                alert.cve_id.clone(),
+                repo_id.to_string(),
+                repo_name.to_string(),
+                alert.affected_package.clone(),
+                alert.affected_version.clone(),
+                severity,
+            );
+            notification.cvss_score = alert.cvss_score;
+            notification.summary = alert.summary.clone();
+            notification.url = Some(format!("https://osv.dev/vulnerability/{}", alert.cve_id));
+            let notif_update = doc! {
+                "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
+            };
+            if let Ok(result) = self
+                .db
+                .cve_notifications()
+                .update_one(notif_filter, notif_update)
+                .upsert(true)
+                .await
+            {
+                if result.upserted_id.is_some() {
+                    new_notif += 1;
+                }
+            }
+        }
+        Ok(new_notif)
+    }
+
     /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
     /// heuristics otherwise), and store the detected classification on the target.
     /// Best-effort — never fails the scan.

compliance-agent/src/pipeline/plan.rs

@@ -75,10 +75,16 @@ pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
 }
 
 /// Resolve the artifact a scan consumes. A "code" requirement (represented by
-/// `GitRepo`) is satisfied by a git repo *or* a source archive.
+/// `GitRepo`) is satisfied by a git repo *or* a source archive. The PLC
+/// control-logic requirement (represented by `PlcProject`) prefers an uploaded
+/// PLC project but also accepts a code artifact — a git repo / source archive
+/// holding PLCopen XML / ST exports.
 fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
     match required {
         Some(ArtifactKind::GitRepo) => target.code_artifact(),
+        Some(ArtifactKind::PlcProject) => target
+            .first_of(ArtifactKind::PlcProject)
+            .or_else(|| target.code_artifact()),
         Some(kind) => target.first_of(kind),
         None => target.code_artifact().or_else(|| target.artifacts.first()),
     }
@@ -100,6 +106,7 @@ fn phase_for(scan: ScanType) -> ScanPhase {
         ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
         ScanType::MobileStatic => ScanPhase::MobileStatic,
         ScanType::ContainerScan => ScanPhase::ContainerScan,
+        ScanType::IcsProbe => ScanPhase::IcsProbe,
     }
 }
 
@@ -174,6 +181,18 @@ mod tests {
         assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
     }
 
+    #[test]
+    fn plc_control_logic_binds_to_a_git_repo() {
+        // A CODESYS project in git (PLCopen XML / ST exports) with no uploaded
+        // PlcProject: control-logic still plans, bound to the git artifact.
+        let git = Artifact::git_repo("https://git/plc", "main");
+        let git_id = git.id.clone();
+        let t = target(TargetType::PlcSps, vec![git]);
+        let plan = build_scan_plan(&t);
+        let step = step_for(&plan, ScanType::PlcControlLogic).expect("control-logic planned");
+        assert_eq!(step.artifact_id, git_id, "PLC scan binds to the git repo");
+    }
+
     #[test]
     fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
         let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);

compliance-agent/src/pipeline/plc/mod.rs

@@ -9,6 +9,8 @@ pub mod lexer;
 pub mod parser;
 pub mod plcopen;
 pub mod rules;
+pub mod runtime;
+pub mod sbom;
 
 use std::path::Path;
 
@@ -197,4 +199,37 @@ mod tests {
             "the CASE state machine uses no JMP"
         );
     }
+
+    /// Graphical logic must be analysed too: an FBD POU (blocks + in/out
+    /// variables) is translated to synthetic ST, so the same rules fire on the
+    /// cleartext Modbus block, the hardcoded HMI password and the safety write.
+    #[test]
+    fn fbd_graphical_body_is_analysed() {
+        let all = analyze_tree(&demo_dir(), "demo-target");
+        let fbd: Vec<_> = all
+            .iter()
+            .filter(|f| {
+                f.file_path
+                    .as_deref()
+                    .is_some_and(|p| p.ends_with("pump_fbd.xml"))
+            })
+            .collect();
+        assert!(
+            !fbd.is_empty(),
+            "pump_fbd.xml (FBD) should produce findings"
+        );
+
+        let rules: HashSet<&str> = fbd.iter().filter_map(|f| f.rule_id.as_deref()).collect();
+        for r in [
+            "plc-insecure-comm",          // Modbus_TCP_Master(AUTH := FALSE)
+            "plc-insecure-protocol-port", // PORT := 502
+            "plc-hardcoded-credential",   // HmiPassword := 'admin123'
+            "plc-safety-bypass",          // Safety_Enable := FALSE
+        ] {
+            assert!(
+                rules.contains(r),
+                "expected rule {r} from FBD; got {rules:?}"
+            );
+        }
+    }
 }

compliance-agent/src/pipeline/plc/plcopen.rs

@@ -1,17 +1,30 @@
 //! PLCopen XML → Structured Text POUs.
 //!
 //! A PLCopen project stores each POU as `<pou name=".." pouType="..">` with an
-//! `<interface>` (typed variable sections) and a `<body>`. We handle the
-//! Structured-Text body form (`<ST>…</ST>`); FBD/LD/SFC bodies are skipped.
+//! `<interface>` (typed variable sections) and a `<body>` in one of the IEC
+//! 61131-3 languages. We reconstruct an equivalent Structured-Text source for
+//! each POU (a `VAR` block from the interface + statements from the body) and run
+//! it through the ST parser, so raw `.st` files and PLCopen projects — textual or
+//! graphical — flow through one analysis path.
 //!
-//! For each ST POU we reconstruct an equivalent ST source (a `VAR` block built
-//! from the interface + the ST body) and run it through the ST parser, so both
-//! raw `.st` files and PLCopen projects flow through one analysis path.
+//! Body languages:
+//! - **ST** — taken verbatim.
+//! - **FBD / LD** — the graphical network is translated to synthetic ST: blocks
+//!   become calls (`TypeName(pin := arg, …)`), out-variables / coils become
+//!   assignments, with input pins resolved by tracing connections. This lets the
+//!   semantic rules see comm calls, hardcoded arguments and safety writes that
+//!   live in graphical logic, not just in text.
+//! - **SFC** — the step/transition graph itself is skipped; the ST/FBD/LD bodies
+//!   embedded in its actions and transitions are still translated.
+
+use std::collections::HashMap;
+
+use roxmltree::Node;
 
 use super::ast::Pou;
 use super::parser;
 
-/// Parse every Structured-Text POU out of a PLCopen XML document.
+/// Parse every POU out of a PLCopen XML document (ST, FBD or LD bodies).
 pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
     let doc = match roxmltree::Document::parse(xml) {
         Ok(d) => d,
@@ -22,14 +35,9 @@ pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
         let name = pou.attribute("name").unwrap_or("pou").to_string();
         let pou_type = pou.attribute("pouType").unwrap_or("program");
 
-        // ST body text (skip non-ST bodies).
-        let Some(st_node) = pou
-            .descendants()
-            .find(|n| n.has_tag_name("ST") && n.ancestors().any(|a| a.has_tag_name("body")))
-        else {
+        let Some(body) = reconstruct_body(pou) else {
             continue;
         };
-        let body = collect_text(st_node);
         if body.trim().is_empty() {
             continue;
         }
@@ -46,17 +54,195 @@ pub fn parse_plcopen(xml: &str) -> Vec<Pou> {
     pous
 }
 
-/// Concatenate all descendant text of a node (ST bodies are often wrapped in
-/// `<xhtml>` and may contain multiple text runs).
-fn collect_text(node: roxmltree::Node) -> String {
+/// Case-insensitive tag match (PLCopen uses `FBD`/`LD`/`ST`, CODESYS may vary).
+fn tag_is(n: &Node, name: &str) -> bool {
+    n.tag_name().name().eq_ignore_ascii_case(name)
+}
+
+/// Reconstruct a POU's body as Structured Text, whatever language it is written
+/// in. Concatenates every language body found under `<body>` (SFC actions and
+/// transitions carry their own ST/FBD/LD sub-bodies).
+fn reconstruct_body(pou: Node) -> Option<String> {
+    let mut out = String::new();
+    for body in pou.descendants().filter(|n| tag_is(n, "body")) {
+        for lang in body.children().filter(|n| n.is_element()) {
+            let piece = match lang.tag_name().name().to_ascii_uppercase().as_str() {
+                "ST" | "IL" => collect_text(lang),
+                "FBD" | "LD" => translate_network(lang),
+                _ => continue,
+            };
+            if !piece.trim().is_empty() {
+                out.push_str(&piece);
+                if !piece.ends_with('\n') {
+                    out.push('\n');
+                }
+            }
+        }
+    }
+    if out.trim().is_empty() {
+        None
+    } else {
+        Some(out)
+    }
+}
+
+// ── graphical (FBD / LD) → synthetic ST ────────────────────────────────
+
+/// Translate one FBD/LD network into ST statements: blocks → calls,
+/// out-variables and coils → assignments.
+fn translate_network(net: Node) -> String {
+    let by_id = index_local_ids(net);
+    let mut out = String::new();
+    for el in net.children().filter(|n| n.is_element()) {
+        let stmt = match el.tag_name().name().to_ascii_lowercase().as_str() {
+            "block" => block_call(el, &by_id).map(|c| format!("{c};")),
+            "outvariable" => out_assignment(el, &by_id),
+            "coil" => coil_assignment(el, &by_id),
+            _ => None,
+        };
+        if let Some(s) = stmt {
+            out.push_str(&s);
+            out.push('\n');
+        }
+    }
+    out
+}
+
+/// Index every element in a network by its `localId` so connections resolve.
+fn index_local_ids<'a, 'input>(net: Node<'a, 'input>) -> HashMap<String, Node<'a, 'input>> {
+    net.descendants()
+        .filter(|n| n.is_element())
+        .filter_map(|n| n.attribute("localId").map(|id| (id.to_string(), n)))
+        .collect()
+}
+
+/// Build a call expression for a block: `TypeName(pin := arg, …)`.
+fn block_call(block: Node, by_id: &HashMap<String, Node>) -> Option<String> {
+    let ty = block.attribute("typeName")?;
+    let mut args = Vec::new();
+    if let Some(inputs) = block.children().find(|n| tag_is(n, "inputVariables")) {
+        for v in inputs.children().filter(|n| tag_is(n, "variable")) {
+            let Some(expr) = input_expr(v, by_id, 0) else {
+                continue;
+            };
+            match v.attribute("formalParameter") {
+                Some(pin) if !pin.is_empty() => args.push(format!("{pin} := {expr}")),
+                _ => args.push(expr),
+            }
+        }
+    }
+    Some(format!("{ty}({})", args.join(", ")))
+}
+
+/// `target := <traced expression>;` for an FBD out-variable.
+fn out_assignment(outvar: Node, by_id: &HashMap<String, Node>) -> Option<String> {
+    let target = expression_text(outvar)?;
+    let value = input_expr(outvar, by_id, 0).unwrap_or_else(|| "0".to_string());
+    Some(format!("{target} := {value};"))
+}
+
+/// `coil := <traced rung expression>;` for an LD coil (negated → `NOT (…)`).
+fn coil_assignment(coil: Node, by_id: &HashMap<String, Node>) -> Option<String> {
+    let target = child_text(coil, "variable")?;
+    let rung = input_expr(coil, by_id, 0).unwrap_or_else(|| "TRUE".to_string());
+    let negated = matches!(coil.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
+    let rhs = if negated {
+        format!("NOT ({rung})")
+    } else {
+        rung
+    };
+    Some(format!("{target} := {rhs};"))
+}
+
+/// Resolve the expression feeding `node`'s single input connection.
+fn input_expr(node: Node, by_id: &HashMap<String, Node>, depth: u8) -> Option<String> {
+    let refid = ref_local_id(node)?;
+    Some(expr_for(&refid, by_id, depth))
+}
+
+/// Build the ST expression produced by the element with this `localId`.
+fn expr_for(local_id: &str, by_id: &HashMap<String, Node>, depth: u8) -> String {
+    if depth > 24 {
+        return "0".to_string();
+    }
+    let Some(node) = by_id.get(local_id) else {
+        return format!("__net{local_id}");
+    };
+    match node.tag_name().name().to_ascii_lowercase().as_str() {
+        "invariable" | "inoutvariable" => {
+            expression_text(*node).unwrap_or_else(|| format!("__net{local_id}"))
+        }
+        // A block feeding another element: reference it by a synthetic result
+        // name; the block is emitted as its own call statement, so we neither
+        // duplicate the call nor lose it.
+        "block" => format!("__blk{local_id}"),
+        "contact" => {
+            let var = child_text(*node, "variable").unwrap_or_else(|| "TRUE".to_string());
+            let negated =
+                matches!(node.attribute("negated"), Some(v) if v.eq_ignore_ascii_case("true"));
+            let term = if negated { format!("NOT {var}") } else { var };
+            match ref_local_id(*node) {
+                Some(up) => {
+                    let upstream = expr_for(&up, by_id, depth + 1);
+                    if upstream == "TRUE" {
+                        term
+                    } else {
+                        format!("({upstream} AND {term})")
+                    }
+                }
+                None => term,
+            }
+        }
+        "leftpowerrail" => "TRUE".to_string(),
+        _ => format!("__net{local_id}"),
+    }
+}
+
+/// The `refLocalId` of `node`'s first input connection, if any.
+fn ref_local_id(node: Node) -> Option<String> {
     node.descendants()
+        .find(|n| tag_is(n, "connectionPointIn"))
+        .and_then(|cpi| cpi.descendants().find(|n| tag_is(n, "connection")))
+        .and_then(|c| c.attribute("refLocalId"))
+        .map(|s| s.to_string())
+}
+
+/// Text of a node's `<expression>` child (variable name or literal).
+fn expression_text(node: Node) -> Option<String> {
+    let e = node.children().find(|n| tag_is(n, "expression"))?;
+    let t = collect_text(e).trim().to_string();
+    if t.is_empty() {
+        None
+    } else {
+        Some(t)
+    }
+}
+
+/// Text of a named child element (e.g. `<variable>` of a contact/coil).
+fn child_text(node: Node, name: &str) -> Option<String> {
+    let c = node.children().find(|n| tag_is(n, name))?;
+    let t = collect_text(c).trim().to_string();
+    if t.is_empty() {
+        None
+    } else {
+        Some(t)
+    }
+}
+
+/// Concatenate the text of a node's descendant text nodes (bodies are often
+/// wrapped in `<xhtml>` and may contain multiple text runs). Only text nodes are
+/// gathered: an element's `.text()` would re-yield its first child's text, which
+/// (with the text node itself) would duplicate every value.
+fn collect_text(node: Node) -> String {
+    node.descendants()
+        .filter(|n| n.is_text())
         .filter_map(|n| n.text())
         .collect::<String>()
 }
 
 /// Build an ST `VAR … END_VAR` block from a POU's `<interface>` variable
 /// sections, so declarations (types, initial values) reach the rules.
-fn build_var_block(pou: roxmltree::Node) -> String {
+fn build_var_block(pou: Node) -> String {
     let Some(interface) = pou.children().find(|n| n.has_tag_name("interface")) else {
         return String::new();
     };
@@ -96,7 +282,7 @@ fn build_var_block(pou: roxmltree::Node) -> String {
 }
 
 /// Render a PLCopen `<type>` element as an ST type string.
-fn type_name(type_node: roxmltree::Node) -> String {
+fn type_name(type_node: Node) -> String {
     let Some(inner) = type_node.children().find(|n| n.is_element()) else {
         return "BOOL".to_string();
     };
@@ -127,7 +313,7 @@ fn type_name(type_node: roxmltree::Node) -> String {
 }
 
 /// Extract an initial value as an ST literal (quoting strings).
-fn initial_value(iv: roxmltree::Node) -> Option<String> {
+fn initial_value(iv: Node) -> Option<String> {
     let simple = iv.descendants().find(|n| n.has_tag_name("simpleValue"))?;
     let raw = simple.attribute("value")?.trim().to_string();
     if raw.is_empty() {
@@ -147,3 +333,86 @@ fn initial_value(iv: roxmltree::Node) -> Option<String> {
         Some(format!("'{}'", raw.replace('\'', "''")))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::parse_plcopen;
+    use crate::pipeline::plc::rules;
+    use std::collections::HashSet;
+
+    fn rule_ids(xml: &str) -> HashSet<&'static str> {
+        parse_plcopen(xml)
+            .iter()
+            .flat_map(rules::analyze)
+            .map(|h| h.rule_id)
+            .collect()
+    }
+
+    /// A Ladder Diagram network: a rung (power rail → contact → coil) plus an
+    /// insecure comm block. Coils/contacts translate to assignments; the block
+    /// translates to a call so the port rule fires.
+    #[test]
+    fn ld_coil_and_block_translate_and_are_analysed() {
+        let xml = r#"<?xml version="1.0"?>
+<project xmlns="http://www.plcopen.org/xml/tc6_0201">
+ <types><pous>
+  <pou name="Rung" pouType="program">
+   <interface><localVars>
+     <variable name="Motor"><type><BOOL/></type></variable>
+   </localVars></interface>
+   <body><LD>
+     <leftPowerRail localId="0"/>
+     <contact localId="1"><variable>Start</variable>
+       <connectionPointIn><connection refLocalId="0"/></connectionPointIn></contact>
+     <coil localId="2"><variable>Motor</variable>
+       <connectionPointIn><connection refLocalId="1"/></connectionPointIn></coil>
+     <inVariable localId="3"><expression>21</expression></inVariable>
+     <inVariable localId="4"><expression>FALSE</expression></inVariable>
+     <block localId="10" typeName="Ftp_Send">
+       <inputVariables>
+         <variable formalParameter="PORT">
+           <connectionPointIn><connection refLocalId="3"/></connectionPointIn></variable>
+         <variable formalParameter="ENCRYPT">
+           <connectionPointIn><connection refLocalId="4"/></connectionPointIn></variable>
+       </inputVariables>
+     </block>
+   </LD></body>
+  </pou>
+ </pous></types>
+</project>"#;
+        let ids = rule_ids(xml);
+        // Ftp_Send(PORT := 21, ENCRYPT := FALSE) — port 21 is an insecure protocol.
+        assert!(
+            ids.contains("plc-insecure-protocol-port"),
+            "LD block should flag port 21; got {ids:?}"
+        );
+    }
+
+    /// Doubled-text regression: a graphical expression must be extracted once,
+    /// so literals like `502` and `FALSE` stay intact (not `502502`/`FALSEFALSE`).
+    #[test]
+    fn graphical_expression_text_is_not_duplicated() {
+        let xml = r#"<?xml version="1.0"?>
+<project xmlns="http://www.plcopen.org/xml/tc6_0201">
+ <types><pous>
+  <pou name="Comm" pouType="program">
+   <body><FBD>
+     <inVariable localId="1"><expression>502</expression></inVariable>
+     <inVariable localId="2"><expression>FALSE</expression></inVariable>
+     <block localId="10" typeName="Modbus_TCP_Master">
+       <inputVariables>
+         <variable formalParameter="PORT">
+           <connectionPointIn><connection refLocalId="1"/></connectionPointIn></variable>
+         <variable formalParameter="AUTH">
+           <connectionPointIn><connection refLocalId="2"/></connectionPointIn></variable>
+       </inputVariables>
+     </block>
+   </FBD></body>
+  </pou>
+ </pous></types>
+</project>"#;
+        let ids = rule_ids(xml);
+        assert!(ids.contains("plc-insecure-protocol-port")); // PORT := 502 (not 502502)
+        assert!(ids.contains("plc-insecure-comm")); // AUTH := FALSE (not FALSEFALSE)
+    }
+}

compliance-agent/src/pipeline/plc/runtime/mod.rs

@@ -0,0 +1,423 @@
+//! Dynamic PLC testing via an ephemeral soft-PLC (#183).
+//!
+//! When a PLC/SPS target ships control logic but no reachable live device, the
+//! agent instantiates that logic itself instead of trying to reach the customer's
+//! OT network: it provisions a throwaway soft-PLC (OpenPLC) container in-cluster,
+//! loads the program, starts the runtime, probes it over industrial protocols,
+//! then tears the instance down. No customer network access, sandboxed, and
+//! reproducible — destructive tests become safe because the target is ours.
+//!
+//! - [`provision`] owns the container lifecycle (sub-task 1 + 5).
+//! - [`openplc`] loads the program into the running instance (sub-task 2).
+//! - [`provision_and_test`] composes them with a hard deadline and guaranteed
+//!   teardown, and runs the ICS probe against the provisioned endpoint.
+
+pub mod openplc;
+pub mod provision;
+
+use std::path::Path;
+use std::time::Duration;
+
+use secrecy::ExposeSecret;
+
+use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
+use compliance_core::models::Finding;
+use compliance_core::PlcRuntimeConfig;
+
+use crate::error::AgentError;
+
+pub use provision::{DockerSoftPlc, ProvisionedRuntime, SoftPlc};
+
+/// The result of a DAST scan against a provisioned web endpoint.
+#[derive(Debug)]
+pub struct DastRunResult {
+    /// The scan-run record (linked to the onboarded target).
+    pub scan_run: DastScanRun,
+    /// The DAST findings.
+    pub findings: Vec<DastFinding>,
+}
+
+/// Everything a provision-and-test run produced: the ICS-probe findings plus, if
+/// it ran, the DAST scan of the provisioned web endpoint. The caller persists
+/// both — keeping this a plain data return means the whole run is portable to a
+/// remote execution backend that just hands the results back.
+#[derive(Debug, Default)]
+pub struct ProvisionOutcome {
+    /// ICS-probe findings from the provisioned Modbus endpoint.
+    pub findings: Vec<Finding>,
+    /// DAST scan of the provisioned web endpoint, if it ran.
+    pub dast: Option<DastRunResult>,
+}
+
+/// A control-logic program ready to load into a soft-PLC: the source text plus a
+/// cosmetic file name (OpenPLC re-stores it under its own name).
+#[derive(Debug, Clone)]
+pub struct PlcProgram {
+    /// The original file name (for the upload form; OpenPLC renames on storage).
+    pub file_name: String,
+    /// The program source — Structured Text or PLCopen XML.
+    pub source: String,
+}
+
+/// A cookie-aware HTTP client for the OpenPLC web UI. A fresh client per scan
+/// isolates the OpenPLC session (its Flask login cookie) from every other scan.
+pub fn http_client() -> Result<reqwest::Client, AgentError> {
+    reqwest::Client::builder()
+        .cookie_store(true)
+        .timeout(Duration::from_secs(30))
+        .build()
+        .map_err(AgentError::Http)
+}
+
+/// Pick the control-logic program to run from an ingested PLC source tree.
+///
+/// OpenPLC runs one program, so we choose the best single candidate: a complete
+/// Structured Text program (one carrying a `CONFIGURATION` block) is ideal;
+/// failing that the largest ST file; failing that a PLCopen XML export. Returns
+/// `None` when the tree holds no loadable control logic.
+pub fn extract_program(root: &Path) -> Option<PlcProgram> {
+    let mut st: Vec<(String, String)> = Vec::new();
+    let mut xml: Vec<(String, String)> = Vec::new();
+    for entry in walkdir::WalkDir::new(root)
+        .into_iter()
+        .filter_map(Result::ok)
+    {
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        let path = entry.path();
+        let ext = path
+            .extension()
+            .and_then(|e| e.to_str())
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        let is_st = matches!(ext.as_str(), "st" | "iecst" | "scl" | "exp" | "il");
+        let is_xml = matches!(ext.as_str(), "xml" | "plcopen" | "project");
+        if !is_st && !is_xml {
+            continue;
+        }
+        let Ok(content) = std::fs::read_to_string(path) else {
+            continue;
+        };
+        let name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("program")
+            .to_string();
+        if is_st {
+            st.push((name, content));
+        } else if looks_like_plcopen(&content) {
+            xml.push((name, content));
+        }
+    }
+
+    if let Some((name, source)) = st.iter().find(|(_, c)| has_configuration(c)) {
+        return Some(PlcProgram {
+            file_name: name.clone(),
+            source: source.clone(),
+        });
+    }
+    if let Some((name, source)) = st.iter().max_by_key(|(_, c)| c.len()) {
+        return Some(PlcProgram {
+            file_name: name.clone(),
+            source: source.clone(),
+        });
+    }
+    xml.into_iter()
+        .max_by_key(|(_, c)| c.len())
+        .map(|(file_name, source)| PlcProgram { file_name, source })
+}
+
+/// Whether an ST source is a complete, runnable program (has a `CONFIGURATION`).
+fn has_configuration(source: &str) -> bool {
+    source.to_ascii_uppercase().contains("CONFIGURATION")
+}
+
+/// Whether an XML file looks like a PLCopen project export.
+fn looks_like_plcopen(source: &str) -> bool {
+    let lower = source.to_ascii_lowercase();
+    lower.contains("<project") || lower.contains("plcopen")
+}
+
+/// Provision an ephemeral soft-PLC, load `program`, start it, probe it over
+/// industrial protocols, and tear it down. Returns the ICS-probe findings.
+///
+/// Teardown is guaranteed: the load/probe work runs under a hard deadline
+/// (`max_lifetime_secs`) and the instance is removed afterwards on every path —
+/// success, error, or deadline expiry.
+pub async fn provision_and_test<P: SoftPlc>(
+    provisioner: &P,
+    http: &reqwest::Client,
+    cfg: &PlcRuntimeConfig,
+    program: &PlcProgram,
+    target_id: &str,
+) -> Result<ProvisionOutcome, AgentError> {
+    let handle = provisioner.provision(target_id).await?;
+    tracing::info!(
+        target_id,
+        instance = %handle.name,
+        modbus = %handle.modbus_endpoint,
+        "provisioned ephemeral soft-PLC"
+    );
+
+    let deadline = Duration::from_secs(cfg.max_lifetime_secs);
+    let result = tokio::time::timeout(
+        deadline,
+        run_dynamic_test(http, cfg, program, target_id, &handle),
+    )
+    .await;
+
+    // Guaranteed teardown — runs on success, error, and deadline expiry. The
+    // inner future is panic-free (the workspace lint bans unwrap/expect), so no
+    // unwind can skip this; a container leaked by an agent *crash* is swept by
+    // the next run's stale reaper.
+    provisioner.teardown(&handle).await;
+
+    match result {
+        Ok(inner) => inner,
+        Err(_) => {
+            tracing::warn!(
+                target_id,
+                instance = %handle.name,
+                "provision-and-test hit the lifetime deadline; torn down"
+            );
+            Ok(ProvisionOutcome::default())
+        }
+    }
+}
+
+/// The load → start → probe → DAST body, run under the caller's deadline.
+async fn run_dynamic_test(
+    http: &reqwest::Client,
+    cfg: &PlcRuntimeConfig,
+    program: &PlcProgram,
+    target_id: &str,
+    handle: &ProvisionedRuntime,
+) -> Result<ProvisionOutcome, AgentError> {
+    let ready_budget = Duration::from_secs((cfg.max_lifetime_secs / 3).clamp(10, 60));
+    openplc::wait_ready(http, &handle.webvisu_url, ready_budget).await?;
+
+    let compile_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
+    openplc::load_and_start(
+        http,
+        &handle.webvisu_url,
+        &cfg.openplc_user,
+        cfg.openplc_password.expose_secret(),
+        program,
+        compile_budget,
+    )
+    .await?;
+
+    // Give the runtime a moment to open the Modbus/TCP server before probing.
+    tokio::time::sleep(Duration::from_secs(3)).await;
+
+    let probe_budget = Duration::from_secs(5);
+    let findings =
+        crate::pipeline::ics::probe_target(&handle.modbus_endpoint, target_id, probe_budget).await;
+    tracing::info!(
+        target_id,
+        instance = %handle.name,
+        found = findings.len(),
+        "provision-and-test probe complete"
+    );
+
+    // DAST the provisioned web endpoint (independently bounded so it can't eat
+    // the whole lifetime). On the OpenPLC substrate this is OpenPLC's own web UI,
+    // not a customer HMI — the CODESYS-runtime follow-up raises the fidelity —
+    // but it proves the deploy→run→probe→DAST loop end to end.
+    let dast_budget = Duration::from_secs((cfg.max_lifetime_secs / 2).clamp(20, 120));
+    let dast = match tokio::time::timeout(dast_budget, run_webvisu_dast(handle, target_id)).await {
+        Ok(d) => d,
+        Err(_) => {
+            tracing::warn!(target_id, instance = %handle.name, "provision-and-test DAST timed out");
+            None
+        }
+    };
+
+    Ok(ProvisionOutcome { findings, dast })
+}
+
+/// Run a bounded DAST scan against the provisioned web endpoint and tag the
+/// results with our target id. Best-effort — a DAST failure never fails the run.
+async fn run_webvisu_dast(handle: &ProvisionedRuntime, target_id: &str) -> Option<DastRunResult> {
+    let mut dt = DastTarget::new(
+        "provisioned-webvisu".to_string(),
+        handle.webvisu_url.clone(),
+        DastTargetType::WebApp,
+    );
+    dt.repo_id = Some(target_id.to_string());
+    dt.max_crawl_depth = 2; // shallow — the instance is ephemeral
+
+    let orchestrator = compliance_dast::DastOrchestrator::new(100);
+    match orchestrator.run_scan(&dt, Vec::new()).await {
+        Ok((mut scan_run, mut findings)) => {
+            scan_run.target_id = target_id.to_string();
+            for f in &mut findings {
+                f.target_id = target_id.to_string();
+            }
+            tracing::info!(
+                target_id,
+                instance = %handle.name,
+                dast_findings = findings.len(),
+                "provision-and-test DAST complete"
+            );
+            Some(DastRunResult { scan_run, findings })
+        }
+        Err(e) => {
+            tracing::warn!(target_id, instance = %handle.name, error = %e, "provision-and-test DAST failed");
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
+
+    /// A scratch dir removed on drop.
+    struct Scratch(std::path::PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-plc-rt-{}", uuid::Uuid::new_v4()));
+            std::fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn extract_prefers_a_complete_st_program() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("fragment.st"), "PROGRAM P\nEND_PROGRAM\n").expect("w");
+        std::fs::write(
+            s.0.join("full.st"),
+            "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION Config0\n  RESOURCE R\nEND_CONFIGURATION\n",
+        )
+        .expect("w");
+        let prog = extract_program(&s.0).expect("program");
+        assert_eq!(prog.file_name, "full.st");
+        assert!(prog.source.contains("CONFIGURATION"));
+    }
+
+    #[test]
+    fn extract_falls_back_to_largest_st_then_plcopen() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("small.st"), "PROGRAM A\nEND_PROGRAM\n").expect("w");
+        std::fs::write(
+            s.0.join("big.st"),
+            "PROGRAM B\nVAR x : INT; y : INT; z : INT; END_VAR\nEND_PROGRAM\n",
+        )
+        .expect("w");
+        let prog = extract_program(&s.0).expect("program");
+        assert_eq!(
+            prog.file_name, "big.st",
+            "largest ST wins when none complete"
+        );
+
+        // Only a PLCopen XML present.
+        let s2 = Scratch::new();
+        std::fs::write(
+            s2.0.join("proj.xml"),
+            "<?xml version='1.0'?><project xmlns='http://www.plcopen.org/xml/tc6_0201'><pou/></project>",
+        )
+        .expect("w");
+        let prog2 = extract_program(&s2.0).expect("program");
+        assert_eq!(prog2.file_name, "proj.xml");
+    }
+
+    #[test]
+    fn extract_returns_none_without_control_logic() {
+        let s = Scratch::new();
+        std::fs::write(s.0.join("readme.md"), "# not a plc program").expect("w");
+        std::fs::write(s.0.join("data.xml"), "<config><db/></config>").expect("w");
+        assert!(extract_program(&s.0).is_none());
+    }
+
+    /// A fake provisioner recording provision/teardown calls, for lifecycle tests.
+    struct FakeSoftPlc {
+        provisions: Arc<AtomicUsize>,
+        teardowns: Arc<AtomicUsize>,
+        fail_provision: bool,
+    }
+
+    impl SoftPlc for FakeSoftPlc {
+        async fn provision(&self, _target_id: &str) -> Result<ProvisionedRuntime, AgentError> {
+            self.provisions.fetch_add(1, Ordering::SeqCst);
+            if self.fail_provision {
+                return Err(AgentError::Other("provision failed".into()));
+            }
+            // Unreachable address so run_dynamic_test blocks on readiness until the
+            // deadline fires — exercising the teardown-on-deadline path.
+            Ok(ProvisionedRuntime {
+                name: "fake-plc".into(),
+                modbus_endpoint: "fake-plc:502".into(),
+                webvisu_url: "http://fake-plc.invalid:8080".into(),
+            })
+        }
+        async fn teardown(&self, _handle: &ProvisionedRuntime) {
+            self.teardowns.fetch_add(1, Ordering::SeqCst);
+        }
+    }
+
+    fn short_cfg() -> PlcRuntimeConfig {
+        PlcRuntimeConfig {
+            enabled: true,
+            max_lifetime_secs: 1, // keep the deadline path fast
+            ..PlcRuntimeConfig::default()
+        }
+    }
+
+    #[tokio::test]
+    async fn teardown_runs_even_when_the_test_never_completes() {
+        let provisions = Arc::new(AtomicUsize::new(0));
+        let teardowns = Arc::new(AtomicUsize::new(0));
+        let fake = FakeSoftPlc {
+            provisions: provisions.clone(),
+            teardowns: teardowns.clone(),
+            fail_provision: false,
+        };
+        let http = http_client().expect("client");
+        let prog = PlcProgram {
+            file_name: "p.st".into(),
+            source: "PROGRAM P\nEND_PROGRAM\n".into(),
+        };
+        let out = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1")
+            .await
+            .expect("ok on deadline");
+        assert!(out.findings.is_empty(), "deadline path yields no findings");
+        assert!(out.dast.is_none(), "deadline path runs no DAST");
+        assert_eq!(provisions.load(Ordering::SeqCst), 1);
+        assert_eq!(teardowns.load(Ordering::SeqCst), 1, "teardown must run");
+    }
+
+    #[tokio::test]
+    async fn provision_failure_propagates_and_skips_teardown() {
+        let provisions = Arc::new(AtomicUsize::new(0));
+        let teardowns = Arc::new(AtomicUsize::new(0));
+        let fake = FakeSoftPlc {
+            provisions: provisions.clone(),
+            teardowns: teardowns.clone(),
+            fail_provision: true,
+        };
+        let http = http_client().expect("client");
+        let prog = PlcProgram {
+            file_name: "p.st".into(),
+            source: String::new(),
+        };
+        let err = provision_and_test(&fake, &http, &short_cfg(), &prog, "t1").await;
+        assert!(err.is_err(), "provision failure propagates");
+        assert_eq!(provisions.load(Ordering::SeqCst), 1);
+        assert_eq!(
+            teardowns.load(Ordering::SeqCst),
+            0,
+            "nothing to tear down when provisioning failed"
+        );
+    }
+}

compliance-agent/src/pipeline/plc/runtime/openplc.rs

@@ -0,0 +1,254 @@
+//! Loading a control-logic program into a provisioned OpenPLC (#183, sub-task 2).
+//!
+//! Drives the OpenPLC v3 web UI over HTTP to turn a static control-logic artifact
+//! into a *running* PLC: log in, upload the program, save it, compile it (MatIEC),
+//! and start the runtime — at which point OpenPLC opens its Modbus/TCP server on
+//! 502 and the ICS probe has something to talk to. The endpoint sequence mirrors
+//! the OpenPLC web UI: `POST /login` → `POST /upload-program` (which hands back a
+//! server-assigned `prog_file`) → `POST /upload-program-action` →
+//! `GET /compile-program?file=<prog_file>` → `GET /start_plc`.
+
+use std::time::Duration;
+
+use crate::error::AgentError;
+
+use super::PlcProgram;
+
+/// Default OpenPLC program name/description recorded in its UI.
+const PROG_NAME: &str = "certifai-provisioned";
+const PROG_DESCR: &str = "Uploaded by the Certifai provision-and-test scan";
+
+/// Poll interval while waiting for readiness / compilation.
+const POLL_INTERVAL: Duration = Duration::from_secs(2);
+
+/// Wait until the OpenPLC web UI answers (any non-5xx reply to `/login`), or the
+/// budget elapses. A freshly-started container needs a few seconds to boot.
+pub async fn wait_ready(
+    http: &reqwest::Client,
+    base_url: &str,
+    budget: Duration,
+) -> Result<(), AgentError> {
+    let login = format!("{base_url}/login");
+    let outcome = tokio::time::timeout(budget, async {
+        loop {
+            if let Ok(resp) = http.get(&login).send().await {
+                if !resp.status().is_server_error() {
+                    return;
+                }
+            }
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    })
+    .await;
+    outcome.map_err(|_| AgentError::Other(format!("OpenPLC at {base_url} did not become ready")))
+}
+
+/// Log in, upload the program, compile it, and start the runtime. On success the
+/// OpenPLC Modbus/TCP server is listening on 502.
+pub async fn load_and_start(
+    http: &reqwest::Client,
+    base_url: &str,
+    user: &str,
+    password: &str,
+    program: &PlcProgram,
+    compile_budget: Duration,
+) -> Result<(), AgentError> {
+    login(http, base_url, user, password).await?;
+    let prog_file = upload_program(http, base_url, program).await?;
+    save_program(http, base_url, &prog_file).await?;
+    compile(http, base_url, &prog_file, compile_budget).await?;
+    start(http, base_url).await?;
+    Ok(())
+}
+
+/// `POST /login` — establishes the session cookie (the client must have a cookie
+/// store; see the provision-and-test entry point).
+async fn login(
+    http: &reqwest::Client,
+    base_url: &str,
+    user: &str,
+    password: &str,
+) -> Result<(), AgentError> {
+    let resp = http
+        .post(format!("{base_url}/login"))
+        .form(&[("username", user), ("password", password)])
+        .send()
+        .await?;
+    if resp.status().is_server_error() {
+        return Err(AgentError::Other(format!(
+            "OpenPLC login failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// `POST /upload-program` (multipart `file`) — OpenPLC stores the program under a
+/// server-assigned name and returns it in a hidden `prog_file` form field, which
+/// we parse out for the follow-up save/compile steps.
+async fn upload_program(
+    http: &reqwest::Client,
+    base_url: &str,
+    program: &PlcProgram,
+) -> Result<String, AgentError> {
+    let part = reqwest::multipart::Part::text(program.source.clone())
+        .file_name(program.file_name.clone())
+        .mime_str("application/octet-stream")?;
+    let form = reqwest::multipart::Form::new().part("file", part);
+    let resp = http
+        .post(format!("{base_url}/upload-program"))
+        .multipart(form)
+        .send()
+        .await?;
+    let html = resp.text().await?;
+    parse_prog_file(&html).ok_or_else(|| {
+        AgentError::Other("OpenPLC upload did not return a prog_file handle".to_string())
+    })
+}
+
+/// `POST /upload-program-action` — records the uploaded program in OpenPLC's
+/// program list. `epoch_time` must be close to the server's clock (OpenPLC
+/// rejects stale timestamps), so we send the current time.
+async fn save_program(
+    http: &reqwest::Client,
+    base_url: &str,
+    prog_file: &str,
+) -> Result<(), AgentError> {
+    let epoch = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+        .to_string();
+    let resp = http
+        .post(format!("{base_url}/upload-program-action"))
+        .form(&[
+            ("prog_name", PROG_NAME),
+            ("prog_descr", PROG_DESCR),
+            ("prog_file", prog_file),
+            ("epoch_time", &epoch),
+        ])
+        .send()
+        .await?;
+    if resp.status().is_server_error() {
+        return Err(AgentError::Other(format!(
+            "OpenPLC save-program failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// `GET /compile-program?file=<prog_file>` then poll `/compilation-logs` until
+/// MatIEC reports it finished (or the budget elapses). Errors if compilation
+/// finishes with errors — a program that won't compile can't be started.
+async fn compile(
+    http: &reqwest::Client,
+    base_url: &str,
+    prog_file: &str,
+    budget: Duration,
+) -> Result<(), AgentError> {
+    http.get(format!("{base_url}/compile-program"))
+        .query(&[("file", prog_file)])
+        .send()
+        .await?;
+
+    let logs_url = format!("{base_url}/compilation-logs");
+    let outcome = tokio::time::timeout(budget, async {
+        loop {
+            if let Ok(resp) = http.get(&logs_url).send().await {
+                if let Ok(text) = resp.text().await {
+                    if compilation_finished(&text) {
+                        return !compilation_failed(&text);
+                    }
+                }
+            }
+            tokio::time::sleep(POLL_INTERVAL).await;
+        }
+    })
+    .await;
+    match outcome {
+        Ok(true) => Ok(()),
+        Ok(false) => Err(AgentError::Other(
+            "OpenPLC compilation finished with errors".to_string(),
+        )),
+        Err(_) => Err(AgentError::Other(
+            "OpenPLC compilation did not finish in time".to_string(),
+        )),
+    }
+}
+
+/// `GET /start_plc` — starts the runtime, opening Modbus/TCP on 502.
+async fn start(http: &reqwest::Client, base_url: &str) -> Result<(), AgentError> {
+    let resp = http.get(format!("{base_url}/start_plc")).send().await?;
+    if resp.status().is_server_error() {
+        return Err(AgentError::Other(format!(
+            "OpenPLC start_plc failed: HTTP {}",
+            resp.status()
+        )));
+    }
+    Ok(())
+}
+
+/// Extract the server-assigned `prog_file` from the `/upload-program` response,
+/// which embeds it in a hidden input. Attribute order varies, so accept both
+/// `value=… name='prog_file'` and `name='prog_file' … value=…`.
+fn parse_prog_file(html: &str) -> Option<String> {
+    // The OpenPLC template renders `value='<name>.st' id='prog_file'
+    // name='prog_file'`. Match the value bound to that input, either order.
+    let value_then_name =
+        regex::Regex::new(r#"(?is)value=['"]([^'"]+)['"][^>]*name=['"]prog_file['"]"#).ok()?;
+    if let Some(c) = value_then_name.captures(html) {
+        return c.get(1).map(|m| m.as_str().to_string());
+    }
+    let name_then_value =
+        regex::Regex::new(r#"(?is)name=['"]prog_file['"][^>]*value=['"]([^'"]+)['"]"#).ok()?;
+    name_then_value
+        .captures(html)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().to_string())
+}
+
+/// Whether the MatIEC compilation log shows the build has finished (either way).
+fn compilation_finished(log: &str) -> bool {
+    log.contains("Compilation finished")
+}
+
+/// Whether a finished compilation ended in failure.
+fn compilation_failed(log: &str) -> bool {
+    log.contains("Compilation finished with errors")
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_prog_file_value_then_name() {
+        let html = "<form><input type='hidden' value='483927.st' id='prog_file' \
+                    name='prog_file'/></form>";
+        assert_eq!(parse_prog_file(html), Some("483927.st".to_string()));
+    }
+
+    #[test]
+    fn parses_prog_file_name_then_value() {
+        let html = r#"<input name="prog_file" id="prog_file" value="12.st" />"#;
+        assert_eq!(parse_prog_file(html), Some("12.st".to_string()));
+    }
+
+    #[test]
+    fn parse_prog_file_none_when_absent() {
+        assert_eq!(parse_prog_file("<html>no form here</html>"), None);
+    }
+
+    #[test]
+    fn compilation_predicates() {
+        assert!(!compilation_finished("Compiling..."));
+        assert!(compilation_finished(
+            "...\nCompilation finished successfully!\n"
+        ));
+        assert!(compilation_finished("Compilation finished with errors!"));
+        assert!(compilation_failed("Compilation finished with errors!"));
+        assert!(!compilation_failed("Compilation finished successfully!"));
+    }
+}

compliance-agent/src/pipeline/plc/runtime/provision.rs

@@ -0,0 +1,306 @@
+//! Ephemeral soft-PLC container lifecycle (#183, sub-task 1 + 5).
+//!
+//! Provisions a throwaway OpenPLC container per scan, isolated on the agent's own
+//! Docker network with hard resource caps and **no host port exposure**, then
+//! guarantees teardown. The container is reachable in-cluster only, by its name
+//! (the shared user-defined network's embedded DNS resolves it); it is never
+//! published to the host.
+//!
+//! The `docker` argv is produced by pure functions so provisioning is unit-tested
+//! without a Docker daemon — only the thin [`run_docker`] wrapper touches the OS.
+//! It requires the agent's runtime to have Docker access (a socket mount), which
+//! is why the whole path is gated behind [`PlcRuntimeConfig::enabled`].
+
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use compliance_core::PlcRuntimeConfig;
+
+use crate::error::AgentError;
+
+/// The Modbus/TCP port an OpenPLC instance opens once a program is running.
+const MODBUS_PORT: u16 = 502;
+/// The OpenPLC web-UI / WebVisu port.
+const WEBVISU_PORT: u16 = 8080;
+
+/// Label key marking a container as an ephemeral PLC runtime we own.
+const OWNER_LABEL_KEY: &str = "certifai.ephemeral";
+/// Label value for our ephemeral PLC runtimes.
+const OWNER_LABEL_VALUE: &str = "plc-runtime";
+
+/// A running ephemeral soft-PLC instance. Reachable in-cluster by `name`.
+#[derive(Debug, Clone)]
+pub struct ProvisionedRuntime {
+    /// The container name — also its in-network DNS alias.
+    pub name: String,
+    /// `name:502` — the Modbus/TCP endpoint the ICS probe targets.
+    pub modbus_endpoint: String,
+    /// `http://name:8080` — the WebVisu / OpenPLC web UI.
+    pub webvisu_url: String,
+}
+
+/// A source of ephemeral soft-PLC instances. Abstracted so the provision-and-test
+/// orchestration is unit-testable with a fake that never touches Docker.
+pub trait SoftPlc {
+    /// Start a fresh instance for a target and return its handle.
+    fn provision(
+        &self,
+        target_id: &str,
+    ) -> impl std::future::Future<Output = Result<ProvisionedRuntime, AgentError>> + Send;
+
+    /// Tear an instance down. Best-effort and idempotent — never fails the scan.
+    fn teardown(&self, handle: &ProvisionedRuntime)
+        -> impl std::future::Future<Output = ()> + Send;
+}
+
+/// Provisions OpenPLC instances by shelling out to the Docker CLI.
+pub struct DockerSoftPlc {
+    cfg: PlcRuntimeConfig,
+}
+
+impl DockerSoftPlc {
+    /// Build a provisioner from the PLC-runtime config.
+    pub fn new(cfg: PlcRuntimeConfig) -> Self {
+        Self { cfg }
+    }
+}
+
+impl SoftPlc for DockerSoftPlc {
+    async fn provision(&self, target_id: &str) -> Result<ProvisionedRuntime, AgentError> {
+        // Best-effort sweep of any container leaked by a crashed earlier run
+        // before we add another. Only removes instances past their max lifetime,
+        // so it can never disturb a concurrent run.
+        reap_stale(&self.cfg, now_epoch()).await;
+
+        let name = instance_name(target_id, now_epoch(), &random_suffix());
+        let args = run_args(&self.cfg, &name, target_id);
+        let out = run_docker(&args).await?;
+        if !out.status.success() {
+            return Err(AgentError::Other(format!(
+                "docker run for soft-PLC {name} failed: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            )));
+        }
+        Ok(ProvisionedRuntime {
+            modbus_endpoint: format!("{name}:{MODBUS_PORT}"),
+            webvisu_url: format!("http://{name}:{WEBVISU_PORT}"),
+            name,
+        })
+    }
+
+    async fn teardown(&self, handle: &ProvisionedRuntime) {
+        match run_docker(&rm_args(&handle.name)).await {
+            Ok(out) if out.status.success() => {
+                tracing::info!(instance = %handle.name, "soft-PLC instance torn down");
+            }
+            Ok(out) => tracing::warn!(
+                instance = %handle.name,
+                "soft-PLC teardown non-zero exit: {}",
+                String::from_utf8_lossy(&out.stderr).trim()
+            ),
+            Err(e) => {
+                tracing::warn!(instance = %handle.name, error = %e, "soft-PLC teardown failed")
+            }
+        }
+    }
+}
+
+/// Seconds since the Unix epoch (0 if the clock is before 1970, which never
+/// happens in practice).
+fn now_epoch() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+/// A short random, docker-name-safe suffix.
+fn random_suffix() -> String {
+    uuid::Uuid::new_v4().simple().to_string()
+}
+
+/// A unique, docker-safe container name that encodes the creation epoch (for the
+/// stale reaper) and the target it belongs to. Shape:
+/// `certifai-plc-<epoch>-<target12>-<rand6>`.
+fn instance_name(target_id: &str, epoch: u64, rand: &str) -> String {
+    let short: String = target_id
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .take(12)
+        .collect();
+    let rand: String = rand
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .take(6)
+        .collect();
+    format!("certifai-plc-{epoch}-{short}-{rand}")
+}
+
+/// The creation epoch encoded in an instance name, if it is one of ours.
+fn parse_epoch(name: &str) -> Option<u64> {
+    name.strip_prefix("certifai-plc-")?
+        .split('-')
+        .next()?
+        .parse()
+        .ok()
+}
+
+/// The `docker run` argv for an ephemeral soft-PLC: detached, joined to the
+/// agent's network, resource-capped, hardened, labelled for reaping, and — by
+/// omitting any `-p` — never published to the host.
+fn run_args(cfg: &PlcRuntimeConfig, name: &str, target_id: &str) -> Vec<String> {
+    vec![
+        "run".into(),
+        "-d".into(),
+        "--name".into(),
+        name.into(),
+        "--network".into(),
+        cfg.network.clone(),
+        "--memory".into(),
+        cfg.memory.clone(),
+        "--cpus".into(),
+        cfg.cpus.clone(),
+        "--pids-limit".into(),
+        "512".into(),
+        "--security-opt".into(),
+        "no-new-privileges".into(),
+        "--stop-timeout".into(),
+        "5".into(),
+        "--label".into(),
+        format!("{OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
+        "--label".into(),
+        format!("certifai.target={target_id}"),
+        cfg.image.clone(),
+    ]
+}
+
+/// The `docker rm -f` argv that stops and removes an instance.
+fn rm_args(name: &str) -> Vec<String> {
+    vec!["rm".into(), "-f".into(), name.into()]
+}
+
+/// The `docker ps` argv listing the names of every ephemeral PLC container we own.
+fn reap_list_args() -> Vec<String> {
+    vec![
+        "ps".into(),
+        "-a".into(),
+        "--filter".into(),
+        format!("label={OWNER_LABEL_KEY}={OWNER_LABEL_VALUE}"),
+        "--format".into(),
+        "{{.Names}}".into(),
+    ]
+}
+
+/// Remove any ephemeral PLC container older than twice the configured max
+/// lifetime — i.e. one a crashed run leaked. The generous threshold guarantees a
+/// container from a *live* run (still within its own deadline) is never swept.
+/// Best-effort: any Docker error (e.g. no daemon) is ignored.
+async fn reap_stale(cfg: &PlcRuntimeConfig, now: u64) {
+    let cutoff = cfg.max_lifetime_secs.saturating_mul(2);
+    let Ok(out) = run_docker(&reap_list_args()).await else {
+        return;
+    };
+    if !out.status.success() {
+        return;
+    }
+    let names = String::from_utf8_lossy(&out.stdout);
+    for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
+        let Some(epoch) = parse_epoch(name) else {
+            continue;
+        };
+        if now.saturating_sub(epoch) > cutoff {
+            tracing::warn!(instance = %name, "reaping stale soft-PLC instance");
+            let _ = run_docker(&rm_args(name)).await;
+        }
+    }
+}
+
+/// Run a `docker` subcommand, capturing its output.
+async fn run_docker(args: &[String]) -> Result<std::process::Output, AgentError> {
+    tokio::process::Command::new("docker")
+        .args(args)
+        .output()
+        .await
+        .map_err(AgentError::Io)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn cfg() -> PlcRuntimeConfig {
+        PlcRuntimeConfig {
+            enabled: true,
+            image: "registry.example.com/openplc:latest".into(),
+            network: "certifai".into(),
+            memory: "512m".into(),
+            cpus: "0.5".into(),
+            max_lifetime_secs: 180,
+            ..PlcRuntimeConfig::default()
+        }
+    }
+
+    #[test]
+    fn instance_name_is_unique_docker_safe_and_reaper_parseable() {
+        let a = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "abcdef123456");
+        assert_eq!(a, "certifai-plc-1700000000-64f0aabbccdd-abcdef");
+        assert_eq!(parse_epoch(&a), Some(1_700_000_000));
+        // Docker names: only [A-Za-z0-9_.-].
+        assert!(a
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '_' | '.' | '-')));
+        // A different random suffix yields a different name for the same target.
+        let b = instance_name("64f0aabbccddeeff00112233", 1_700_000_000, "zzzzzz999999");
+        assert_ne!(a, b);
+    }
+
+    #[test]
+    fn parse_epoch_rejects_foreign_names() {
+        assert_eq!(parse_epoch("some-other-container"), None);
+        assert_eq!(parse_epoch("certifai-plc-notanumber-x"), None);
+    }
+
+    #[test]
+    fn run_args_cap_resources_harden_label_and_never_publish_a_port() {
+        let args = run_args(&cfg(), "certifai-plc-1-t-r", "target-123");
+        // No host port publishing.
+        assert!(!args.iter().any(|a| a == "-p" || a == "--publish"));
+        // Detached.
+        assert!(args.contains(&"-d".to_string()));
+        // Joined to the agent's own network.
+        let net = args.iter().position(|a| a == "--network").expect("network");
+        assert_eq!(args[net + 1], "certifai");
+        // Resource caps.
+        let mem = args.iter().position(|a| a == "--memory").expect("memory");
+        assert_eq!(args[mem + 1], "512m");
+        let cpu = args.iter().position(|a| a == "--cpus").expect("cpus");
+        assert_eq!(args[cpu + 1], "0.5");
+        assert!(args.iter().any(|a| a == "--pids-limit"));
+        // Hardening.
+        let so = args
+            .iter()
+            .position(|a| a == "--security-opt")
+            .expect("secopt");
+        assert_eq!(args[so + 1], "no-new-privileges");
+        // Ownership + target labels for reaping / attribution.
+        assert!(args.contains(&"certifai.ephemeral=plc-runtime".to_string()));
+        assert!(args.contains(&"certifai.target=target-123".to_string()));
+        // Image is last.
+        assert_eq!(
+            args.last().map(String::as_str),
+            Some("registry.example.com/openplc:latest")
+        );
+    }
+
+    #[test]
+    fn rm_args_force_remove() {
+        assert_eq!(rm_args("x"), vec!["rm", "-f", "x"]);
+    }
+
+    #[test]
+    fn reap_list_filters_by_owner_label() {
+        let args = reap_list_args();
+        assert!(args.contains(&"label=certifai.ephemeral=plc-runtime".to_string()));
+        assert!(args.contains(&"{{.Names}}".to_string()));
+    }
+}

compliance-agent/src/pipeline/plc/sbom.rs

@@ -0,0 +1,253 @@
+//! Control-application dependency SBOM from a CODESYS `.projectarchive`.
+//!
+//! A `.projectarchive` is a ZIP that bundles the project plus its referenced
+//! libraries and the target runtime. Each referenced library is an entry whose
+//! path segment follows the CODESYS convention
+//! `Name, Major.Minor.Patch.Build (Company)` (e.g. `Standard, 3.5.18.0 (System)`,
+//! `CSV Utility SL, 1.9.0.0 (CODESYS)`); the runtime appears as a device-descriptor
+//! entry `CODESYS Control … <version> …`. We enumerate those entries — no binary
+//! parsing — and emit SBOM components tagged `pkg:codesys/…`, so the CVE pipeline
+//! can match them (the runtime `Cmp*` / `3SLicense` components carry real CODESYS
+//! CVEs).
+
+use std::collections::BTreeSet;
+use std::path::{Path, PathBuf};
+
+use compliance_core::models::SbomEntry;
+
+/// Collect the control-application SBOM from every `.projectarchive` reachable for
+/// a target: the ingested artifact file itself (an uploaded archive), plus any
+/// `*.projectarchive` committed inside the working tree — e.g. a git repo or an
+/// extracted source archive that ships the archive alongside its PLCopen XML / ST
+/// exports. Deduplicated by (name, version).
+pub fn collect_sbom(artifact_file: &Path, working_path: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let mut archives: Vec<PathBuf> = Vec::new();
+    if artifact_file.is_file() {
+        archives.push(artifact_file.to_path_buf());
+    }
+    for entry in walkdir::WalkDir::new(working_path)
+        .max_depth(8)
+        .into_iter()
+        .filter_map(|e| e.ok())
+    {
+        let p = entry.path();
+        if entry.file_type().is_file()
+            && p.extension()
+                .and_then(|x| x.to_str())
+                .is_some_and(|x| x.eq_ignore_ascii_case("projectarchive"))
+        {
+            archives.push(p.to_path_buf());
+        }
+    }
+    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
+    let mut out = Vec::new();
+    for a in archives {
+        for e in projectarchive_sbom(&a, repo_id) {
+            if seen.insert((e.name.clone(), e.version.clone())) {
+                out.push(e);
+            }
+        }
+    }
+    out
+}
+
+/// Extract CODESYS library + runtime components from a `.projectarchive` (a zip).
+/// Best-effort: returns empty if the file is not a readable zip (e.g. a bare
+/// `.st`/`.xml` project, which carries no library manifest).
+pub fn projectarchive_sbom(archive: &Path, repo_id: &str) -> Vec<SbomEntry> {
+    let Ok(file) = std::fs::File::open(archive) else {
+        return Vec::new();
+    };
+    let Ok(mut zip) = zip::ZipArchive::new(file) else {
+        return Vec::new();
+    };
+    let mut seen: BTreeSet<(String, String)> = BTreeSet::new();
+    let mut entries = Vec::new();
+    for i in 0..zip.len() {
+        let Ok(entry) = zip.by_index(i) else {
+            continue;
+        };
+        // Entry paths use `\` (Windows-authored) and/or `/` separators; the
+        // component id is one path segment.
+        for seg in entry.name().split(['/', '\\']) {
+            if let Some((name, version)) = parse_library(seg).or_else(|| parse_runtime(seg)) {
+                if seen.insert((name.clone(), version.clone())) {
+                    let mut e = SbomEntry::new(
+                        repo_id.to_string(),
+                        name.clone(),
+                        version.clone(),
+                        "codesys".to_string(),
+                    );
+                    e.purl = Some(format!(
+                        "pkg:codesys/{}@{version}",
+                        name.replace(' ', "%20")
+                    ));
+                    entries.push(e);
+                }
+            }
+        }
+    }
+    entries
+}
+
+/// `Name, X.Y.Z.W (Company)` → (name, version).
+fn parse_library(seg: &str) -> Option<(String, String)> {
+    let seg = seg.trim();
+    // Company is the trailing "(…)".
+    let open = seg.rfind(" (")?;
+    let rest = &seg[open + 2..];
+    let close = rest.find(')')?;
+    if rest[..close].trim().is_empty() {
+        return None;
+    }
+    let head = seg[..open].trim(); // "Name, X.Y.Z.W"
+    let comma = head.rfind(", ")?;
+    let name = head[..comma].trim().to_string();
+    let version = head[comma + 2..].trim().to_string();
+    if name.is_empty() || !is_dotted_version(&version) {
+        return None;
+    }
+    Some((name, version))
+}
+
+/// Device-descriptor entry `CODESYS Control … X.Y.Z.W …` → (runtime name, version).
+fn parse_runtime(seg: &str) -> Option<(String, String)> {
+    let seg = seg.trim();
+    if !seg.starts_with("CODESYS Control") {
+        return None;
+    }
+    let version = seg
+        .split_whitespace()
+        .find(|t| is_dotted_version(t))?
+        .to_string();
+    // The runtime name is the first field, before the run of padding spaces that
+    // precede the descriptor's numeric columns.
+    let name = seg.split("  ").next().unwrap_or(seg).trim().to_string();
+    if name.is_empty() {
+        return None;
+    }
+    Some((name, version))
+}
+
+/// A dotted numeric version with at least 3 components (`3.5.18.0`, `4.17.0.0`).
+fn is_dotted_version(s: &str) -> bool {
+    let parts: Vec<&str> = s.split('.').collect();
+    parts.len() >= 3
+        && parts
+            .iter()
+            .all(|p| !p.is_empty() && p.chars().all(|c| c.is_ascii_digit()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+    use std::io::Write;
+
+    /// Build a synthetic `.projectarchive` (zip) mirroring the real CODESYS entry
+    /// naming (verified against Proemion/codesys-examples): a native `.project`,
+    /// referenced libraries as `Name, Version (Company)` segments, and a runtime
+    /// device descriptor.
+    fn synthetic_archive(dir: &Path) -> std::path::PathBuf {
+        let path = dir.join("App.projectarchive");
+        write_synthetic_archive(&path);
+        path
+    }
+
+    fn write_synthetic_archive(path: &Path) {
+        let file = std::fs::File::create(path).expect("create");
+        let mut zip = zip::ZipWriter::new(file);
+        let opts: zip::write::SimpleFileOptions = Default::default();
+        let names = [
+            "App.project",
+            r"{b0b5}\App.Device.Plc.compileinfo",
+            r"{e179}\Standard, 3.5.18.0 (System)   standard.compiled-library-v3",
+            r"{e179}\Util, 3.5.21.0 (System)   util.compiled-library-v3",
+            r"{e179}\CSV Utility SL, 1.9.0.0 (CODESYS)   csv utility sl.compiled-library-v3",
+            r"{e179}\3SLicense, 3.5.20.0 (CODESYS)   3slicense.compiled-library-v3",
+            r"{0c63}\CODESYS Control for Linux ARM SL     0000 0006     4.17.0.0     4096     .zip",
+        ];
+        for n in names {
+            zip.start_file(n, opts).expect("start");
+            zip.write_all(b"x").expect("write");
+        }
+        zip.finish().expect("finish");
+    }
+
+    #[test]
+    fn extracts_libraries_and_runtime_from_projectarchive() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&tmp).expect("mkdir");
+        let archive = synthetic_archive(&tmp);
+
+        let entries = projectarchive_sbom(&archive, "plc-target");
+        let by_name: HashMap<&str, &SbomEntry> =
+            entries.iter().map(|e| (e.name.as_str(), e)).collect();
+
+        // Libraries with their versions.
+        assert_eq!(
+            by_name.get("Standard").map(|e| e.version.as_str()),
+            Some("3.5.18.0")
+        );
+        assert_eq!(
+            by_name.get("Util").map(|e| e.version.as_str()),
+            Some("3.5.21.0")
+        );
+        assert_eq!(
+            by_name.get("CSV Utility SL").map(|e| e.version.as_str()),
+            Some("1.9.0.0"),
+            "multi-word library names must parse"
+        );
+        assert!(by_name.contains_key("3SLicense"));
+
+        // The runtime, from the device descriptor.
+        assert_eq!(
+            by_name
+                .get("CODESYS Control for Linux ARM SL")
+                .map(|e| e.version.as_str()),
+            Some("4.17.0.0")
+        );
+
+        // Every component is CODESYS-tagged with a purl the CVE pipeline can match,
+        // and the native `.project` / compileinfo are not mistaken for components.
+        for e in &entries {
+            assert_eq!(e.package_manager, "codesys");
+            assert!(e.purl.as_deref().unwrap_or("").starts_with("pkg:codesys/"));
+        }
+        assert!(!by_name.contains_key("App"));
+
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn collect_sbom_finds_a_projectarchive_committed_in_a_git_tree() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-collect-{}", uuid::Uuid::new_v4()));
+        let src = tmp.join("clone/src");
+        std::fs::create_dir_all(&src).expect("mkdir");
+        // Simulate a git clone that commits the archive alongside its exports.
+        write_synthetic_archive(&src.join("PumpStation.projectarchive"));
+
+        // The artifact "file" is a git URL (not a real file), so the SBOM must
+        // come from walking the cloned tree.
+        let entries = collect_sbom(Path::new("https://git.example/plc.git"), &tmp, "t");
+        let names: std::collections::HashSet<&str> =
+            entries.iter().map(|e| e.name.as_str()).collect();
+        assert!(
+            names.contains("Standard"),
+            "found libs in the committed archive"
+        );
+        assert!(names.contains("CODESYS Control for Linux ARM SL"));
+
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn non_zip_file_yields_no_sbom() {
+        let tmp = std::env::temp_dir().join(format!("cs-plc-sbom-st-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&tmp).expect("mkdir");
+        let st = tmp.join("prog.st");
+        std::fs::write(&st, "PROGRAM P\nVAR x : INT; END_VAR\nEND_PROGRAM\n").expect("write");
+        assert!(projectarchive_sbom(&st, "t").is_empty());
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+}

compliance-agent/src/werkbank/mod.rs

@@ -0,0 +1,10 @@
+//! Werkbank control-plane: the dynamic-execution job queue.
+//!
+//! The control plane enqueues declarative [`Job`](compliance_core::models::werkbank::Job)s
+//! and Werkbank runners lease, run, and complete them. [`queue::JobQueue`] is the
+//! Mongo-backed queue behind that flow (WB-02); the runner-facing HTTP transport
+//! and the runner itself land in later stories.
+
+pub mod queue;
+
+pub use queue::{JobQueue, SweepOutcome};

compliance-agent/src/werkbank/queue.rs

@@ -0,0 +1,309 @@
+//! The Mongo-backed Werkbank job queue (WB-02).
+//!
+//! A pull queue: the control plane [`enqueue`](JobQueue::enqueue)s jobs; a runner
+//! [`lease`](JobQueue::lease)s the oldest queued job it can run (matched by
+//! executor + labels), [`heartbeat`](JobQueue::heartbeat)s while it works, and
+//! [`complete`](JobQueue::complete)s it. Leases carry a visibility timeout: if a
+//! runner dies mid-job its heartbeats stop, the lease expires, and
+//! [`sweep_expired`](JobQueue::sweep_expired) returns the job to `queued` (or
+//! `expired` once it has been retried too many times).
+//!
+//! All state transitions are single atomic Mongo updates guarded by the lease
+//! token, so two runners can never both own a job. Every operation takes an
+//! explicit `now` so the queue's time-dependent behaviour is deterministically
+//! testable.
+
+use std::time::Duration;
+
+use chrono::{DateTime, Utc};
+use mongodb::bson::{doc, Bson, DateTime as BsonDateTime};
+use mongodb::error::{ErrorKind, WriteFailure};
+use mongodb::options::ReturnDocument;
+use mongodb::Collection;
+
+use compliance_core::models::werkbank::{
+    Executor, HeartbeatAck, Job, JobRecord, JobResult, JobStatus, LeasedJob,
+};
+
+use crate::database::Database;
+use crate::error::AgentError;
+
+/// The non-terminal states a job can be swept or cancelled from.
+const ACTIVE_STATES: [&str; 2] = ["leased", "running"];
+/// Every terminal state (no further transitions).
+const TERMINAL_STATES: [&str; 4] = ["succeeded", "failed", "expired", "cancelled"];
+
+/// What a visibility-timeout sweep did.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct SweepOutcome {
+    /// Expired-lease jobs returned to `queued` for another runner.
+    pub requeued: u64,
+    /// Jobs that had exhausted their attempts and were marked `expired`.
+    pub expired: u64,
+}
+
+/// The Mongo-backed job queue.
+pub struct JobQueue {
+    coll: Collection<JobRecord>,
+}
+
+impl JobQueue {
+    /// Build a queue over a tenant database's `werkbank_jobs` collection.
+    pub fn new(db: &Database) -> Self {
+        Self {
+            coll: db.werkbank_jobs(),
+        }
+    }
+
+    /// Enqueue a job. Idempotent by job id: a job that is already present is a
+    /// no-op. Returns `true` if this call inserted it, `false` if it existed.
+    pub async fn enqueue(&self, job: Job, now: DateTime<Utc>) -> Result<bool, AgentError> {
+        let record = JobRecord::queued(job, now);
+        match self.coll.insert_one(&record).await {
+            Ok(_) => Ok(true),
+            Err(e) if is_duplicate_key(&e) => Ok(false),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    /// Atomically lease the oldest `queued` job this runner can run — matched by
+    /// executor and by labels (every label the job requires must be one the
+    /// runner advertises). Returns the job plus a lease token, or `None` if
+    /// nothing is runnable.
+    pub async fn lease(
+        &self,
+        runner_id: &str,
+        executor: Executor,
+        runner_labels: &[String],
+        lease_ttl: Duration,
+        now: DateTime<Utc>,
+    ) -> Result<Option<LeasedJob>, AgentError> {
+        let token = uuid::Uuid::new_v4().to_string();
+        let expires = bson_dt(now + ttl(lease_ttl));
+        let executor_bson = mongodb::bson::to_bson(&executor).unwrap_or(Bson::Null);
+
+        let filter = doc! {
+            "status": "queued",
+            "cancel_requested": { "$ne": true },
+            "job.executor": executor_bson,
+            // Every label the job requires must be in the runner's set — i.e. the
+            // job has no label that is not offered by the runner. Absent/empty
+            // job labels match any runner.
+            "job.labels": { "$not": { "$elemMatch": { "$nin": runner_labels.to_vec() } } },
+        };
+        let update = doc! {
+            "$set": {
+                "status": "leased",
+                "lease_token": &token,
+                "leased_by": runner_id,
+                "lease_expires_at": expires,
+                "heartbeat_at": bson_dt(now),
+                "updated_at": bson_dt(now),
+            },
+            "$inc": { "attempts": 1 },
+        };
+
+        let record = self
+            .coll
+            .find_one_and_update(filter, update)
+            .sort(doc! { "created_at": 1 }) // FIFO
+            .return_document(ReturnDocument::After)
+            .await?;
+        Ok(record.map(|r| LeasedJob {
+            job: r.job,
+            lease_token: token,
+        }))
+    }
+
+    /// Extend a lease and report whether the job has been asked to cancel.
+    /// Transitions the job to `running` on the first heartbeat. Returns `None`
+    /// when the lease is no longer valid (token mismatch, or the job is already
+    /// terminal) — the runner should then abandon the work.
+    pub async fn heartbeat(
+        &self,
+        job_id: &str,
+        lease_token: &str,
+        lease_ttl: Duration,
+        now: DateTime<Utc>,
+    ) -> Result<Option<HeartbeatAck>, AgentError> {
+        let filter = doc! {
+            "job.id": job_id,
+            "lease_token": lease_token,
+            "status": { "$in": ACTIVE_STATES.to_vec() },
+        };
+        let update = doc! {
+            "$set": {
+                "status": "running",
+                "lease_expires_at": bson_dt(now + ttl(lease_ttl)),
+                "heartbeat_at": bson_dt(now),
+                "updated_at": bson_dt(now),
+            },
+        };
+        let record = self
+            .coll
+            .find_one_and_update(filter, update)
+            .return_document(ReturnDocument::After)
+            .await?;
+        Ok(record.map(|r| HeartbeatAck {
+            cancelled: r.cancel_requested,
+        }))
+    }
+
+    /// Record a job's terminal result. Guarded by the lease token and only from
+    /// an active (`leased`/`running`) state, so it is idempotent — a duplicate or
+    /// late submission after the job already finished matches nothing. Returns
+    /// `true` if this call recorded the result.
+    pub async fn complete(
+        &self,
+        job_id: &str,
+        lease_token: &str,
+        result: &JobResult,
+        now: DateTime<Utc>,
+    ) -> Result<bool, AgentError> {
+        let status = result.status.unwrap_or(JobStatus::Failed);
+        let status_bson = mongodb::bson::to_bson(&status).unwrap_or(Bson::String("failed".into()));
+        let result_bson =
+            mongodb::bson::to_bson(result).map_err(|e| AgentError::Other(e.to_string()))?;
+
+        let filter = doc! {
+            "job.id": job_id,
+            "lease_token": lease_token,
+            "status": { "$in": ACTIVE_STATES.to_vec() },
+        };
+        let update = doc! {
+            "$set": {
+                "status": status_bson,
+                "result": result_bson,
+                "lease_token": Bson::Null,
+                "lease_expires_at": Bson::Null,
+                "updated_at": bson_dt(now),
+            },
+        };
+        let res = self.coll.update_one(filter, update).await?;
+        Ok(res.modified_count == 1)
+    }
+
+    /// Request cancellation of a job. A still-`queued` job is cancelled outright;
+    /// an in-flight one is flagged so the runner sees it on its next heartbeat and
+    /// tears down. Returns `true` if a non-terminal job matched.
+    pub async fn cancel(&self, job_id: &str, now: DateTime<Utc>) -> Result<bool, AgentError> {
+        let filter = doc! {
+            "job.id": job_id,
+            "status": { "$nin": TERMINAL_STATES.to_vec() },
+        };
+        // Pipeline update: flag cancellation, and if still queued flip straight to
+        // cancelled (nothing is running it).
+        let pipeline = vec![doc! {
+            "$set": {
+                "cancel_requested": true,
+                "status": {
+                    "$cond": [ { "$eq": ["$status", "queued"] }, "cancelled", "$status" ]
+                },
+                "updated_at": bson_dt(now),
+            }
+        }];
+        let res = self.coll.update_one(filter, pipeline).await?;
+        Ok(res.matched_count == 1)
+    }
+
+    /// Sweep leases whose visibility timeout has elapsed: return them to `queued`
+    /// for another runner, or mark them `expired` once they have been leased
+    /// `max_attempts` times. This is what makes a crashed runner's job recover.
+    pub async fn sweep_expired(
+        &self,
+        now: DateTime<Utc>,
+        max_attempts: u32,
+        // (kept explicit rather than a const so callers can tune retry policy)
+    ) -> Result<SweepOutcome, AgentError> {
+        let now_bson = bson_dt(now);
+        let max = i64::from(max_attempts);
+
+        let requeue = self
+            .coll
+            .update_many(
+                doc! {
+                    "status": { "$in": ACTIVE_STATES.to_vec() },
+                    "lease_expires_at": { "$lt": &now_bson },
+                    "attempts": { "$lt": max },
+                },
+                doc! { "$set": {
+                    "status": "queued",
+                    "lease_token": Bson::Null,
+                    "leased_by": Bson::Null,
+                    "lease_expires_at": Bson::Null,
+                    "updated_at": &now_bson,
+                } },
+            )
+            .await?;
+
+        let expire = self
+            .coll
+            .update_many(
+                doc! {
+                    "status": { "$in": ACTIVE_STATES.to_vec() },
+                    "lease_expires_at": { "$lt": &now_bson },
+                    "attempts": { "$gte": max },
+                },
+                doc! { "$set": {
+                    "status": "expired",
+                    "lease_token": Bson::Null,
+                    "lease_expires_at": Bson::Null,
+                    "updated_at": &now_bson,
+                } },
+            )
+            .await?;
+
+        Ok(SweepOutcome {
+            requeued: requeue.modified_count,
+            expired: expire.modified_count,
+        })
+    }
+
+    /// Fetch a job record by job id (inspection / control-plane reads).
+    pub async fn get(&self, job_id: &str) -> Result<Option<JobRecord>, AgentError> {
+        Ok(self.coll.find_one(doc! { "job.id": job_id }).await?)
+    }
+}
+
+/// A `chrono::Duration` for a lease TTL, saturating rather than panicking on an
+/// absurd input (`chrono::Duration::seconds` panics past its internal bound).
+fn ttl(d: Duration) -> chrono::Duration {
+    let secs = i64::try_from(d.as_secs()).unwrap_or(i64::MAX);
+    chrono::Duration::try_seconds(secs).unwrap_or(chrono::Duration::MAX)
+}
+
+/// A chrono instant as a BSON date (so Mongo stores/compares it as a real date).
+fn bson_dt(dt: DateTime<Utc>) -> BsonDateTime {
+    BsonDateTime::from_chrono(dt)
+}
+
+/// Whether a Mongo error is a duplicate-key (E11000) violation — a job with this
+/// id is already enqueued.
+fn is_duplicate_key(e: &mongodb::error::Error) -> bool {
+    match &*e.kind {
+        ErrorKind::Write(WriteFailure::WriteError(we)) => we.code == 11000,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn ttl_saturates_and_converts() {
+        assert_eq!(ttl(Duration::from_secs(30)), chrono::Duration::seconds(30));
+        // An absurd TTL saturates instead of panicking.
+        assert_eq!(ttl(Duration::from_secs(u64::MAX)), chrono::Duration::MAX);
+    }
+
+    #[test]
+    fn state_constants_are_disjoint() {
+        for s in ACTIVE_STATES {
+            assert!(
+                !TERMINAL_STATES.contains(&s),
+                "{s} cannot be both active and terminal"
+            );
+        }
+    }
+}

compliance-agent/tests/common/mod.rs

@@ -70,6 +70,7 @@ impl TestServer {
             pentest_imap_password: None,
             admin_api_token: None,
             tenant_registry_url: None,
+            plc_runtime: compliance_core::PlcRuntimeConfig::default(),
         };
 
         let agent = ComplianceAgent::new(config, db_pool);

compliance-agent/tests/werkbank_queue.rs

@@ -0,0 +1,258 @@
+//! Integration tests for the Werkbank job queue (WB-02).
+//!
+//! Exercises the atomic lease/heartbeat/complete/sweep flow against a real
+//! MongoDB — the guarantees (idempotent enqueue, single-owner lease, visibility
+//! timeout) are Mongo-semantics-dependent and can't be unit-tested in isolation.
+//! Skips cleanly when no Mongo is reachable (set `TEST_MONGODB_URI` to point at
+//! one; defaults to the local dev cluster).
+
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+use std::time::Duration;
+
+use chrono::{DateTime, TimeZone, Utc};
+
+use compliance_agent::database::Database;
+use compliance_agent::werkbank::JobQueue;
+use compliance_core::models::werkbank::{Executor, InputRef, Job, JobResult};
+
+/// Connect + ensure indexes on a throwaway database, or `None` if no Mongo.
+async fn setup() -> Option<(JobQueue, mongodb::Database)> {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let db_name = format!("wbq_{}", &uuid::Uuid::new_v4().simple().to_string()[..12]);
+    let db = match Database::connect(&uri, &db_name).await {
+        Ok(d) => d,
+        Err(_) => {
+            eprintln!("SKIP werkbank_queue: no MongoDB reachable at {uri}");
+            return None;
+        }
+    };
+    db.ensure_indexes().await.expect("ensure indexes");
+    let queue = JobQueue::new(&db);
+    Some((queue, db.inner().clone()))
+}
+
+fn base_time() -> DateTime<Utc> {
+    Utc.timestamp_opt(1_700_000_000, 0).unwrap()
+}
+
+fn job(id: &str) -> Job {
+    Job::plc_provision(id, "acme", "target-1", InputRef::blob("sha256:abc"), 180)
+}
+
+fn job_with_labels(id: &str, labels: &[&str]) -> Job {
+    let mut j = job(id);
+    j.labels = labels.iter().map(|s| s.to_string()).collect();
+    j
+}
+
+macro_rules! skip_if_no_mongo {
+    () => {
+        match setup().await {
+            Some(v) => v,
+            None => return,
+        }
+    };
+}
+
+#[tokio::test]
+async fn enqueue_is_idempotent() {
+    let (q, db) = skip_if_no_mongo!();
+    let now = base_time();
+
+    assert!(q.enqueue(job("j1"), now).await.expect("enqueue"));
+    // Same id again — no duplicate row, reports "already present".
+    assert!(!q.enqueue(job("j1"), now).await.expect("enqueue2"));
+
+    let rec = q.get("j1").await.expect("get").expect("exists");
+    assert_eq!(
+        rec.status,
+        compliance_core::models::werkbank::JobStatus::Queued
+    );
+    assert_eq!(rec.attempts, 0);
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn lease_matches_executor_and_labels_and_is_fifo() {
+    let (q, db) = skip_if_no_mongo!();
+    let t0 = base_time();
+
+    // Two docker jobs (j_old older than j_new) + one requiring a kvm label.
+    q.enqueue(job("j_old"), t0).await.unwrap();
+    q.enqueue(job("j_new"), t0 + chrono::Duration::seconds(5))
+        .await
+        .unwrap();
+    q.enqueue(job_with_labels("j_kvm", &["kvm=true"]), t0)
+        .await
+        .unwrap();
+
+    // Wrong executor: a shell runner leases nothing.
+    assert!(q
+        .lease("r-shell", Executor::Shell, &[], Duration::from_secs(30), t0)
+        .await
+        .unwrap()
+        .is_none());
+
+    // A docker runner without the kvm label gets the oldest label-free job (FIFO).
+    let leased = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
+        .await
+        .unwrap()
+        .expect("leased");
+    assert_eq!(leased.job.id, "j_old", "oldest matching job first");
+    assert!(!leased.lease_token.is_empty());
+
+    // The kvm job stays unleased for that runner (missing label)...
+    let none = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), t0)
+        .await
+        .unwrap()
+        .expect("next");
+    assert_eq!(none.job.id, "j_new", "label-free job, not the kvm one");
+
+    // ...but a runner advertising kvm can take it.
+    let kvm = q
+        .lease(
+            "r2",
+            Executor::Docker,
+            &["kvm=true".to_string(), "arch=amd64".to_string()],
+            Duration::from_secs(30),
+            t0,
+        )
+        .await
+        .unwrap()
+        .expect("kvm leased");
+    assert_eq!(kvm.job.id, "j_kvm");
+
+    // A leased job increments attempts and is no longer queued.
+    let rec = q.get("j_old").await.unwrap().unwrap();
+    assert_eq!(rec.attempts, 1);
+    assert_eq!(rec.leased_by.as_deref(), Some("r1"));
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn heartbeat_extends_lease_and_surfaces_cancel() {
+    let (q, db) = skip_if_no_mongo!();
+    let now = base_time();
+
+    q.enqueue(job("j1"), now).await.unwrap();
+    let leased = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .unwrap();
+
+    // A valid heartbeat moves it to running and reports not-cancelled.
+    let ack = q
+        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .expect("valid lease");
+    assert!(!ack.cancelled);
+    assert_eq!(
+        q.get("j1").await.unwrap().unwrap().status,
+        compliance_core::models::werkbank::JobStatus::Running
+    );
+
+    // A wrong token is a lost lease.
+    assert!(q
+        .heartbeat("j1", "wrong-token", Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .is_none());
+
+    // Cancelling an in-flight job flags it; the next heartbeat reports cancelled.
+    assert!(q.cancel("j1", now).await.unwrap());
+    let ack = q
+        .heartbeat("j1", &leased.lease_token, Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .expect("still leased");
+    assert!(ack.cancelled);
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn complete_is_idempotent_and_token_guarded() {
+    let (q, db) = skip_if_no_mongo!();
+    let now = base_time();
+
+    q.enqueue(job("j1"), now).await.unwrap();
+    let leased = q
+        .lease("r1", Executor::Docker, &[], Duration::from_secs(30), now)
+        .await
+        .unwrap()
+        .unwrap();
+
+    // Wrong token cannot complete.
+    let mut result = JobResult::succeeded("j1");
+    result.findings = Vec::new();
+    assert!(!q.complete("j1", "nope", &result, now).await.unwrap());
+
+    // The lease holder completes it once...
+    assert!(q
+        .complete("j1", &leased.lease_token, &result, now)
+        .await
+        .unwrap());
+    let rec = q.get("j1").await.unwrap().unwrap();
+    assert_eq!(
+        rec.status,
+        compliance_core::models::werkbank::JobStatus::Succeeded
+    );
+    assert!(rec.result.is_some());
+    assert!(rec.lease_token.is_none(), "lease cleared on completion");
+
+    // ...and a second (duplicate) completion is a no-op.
+    assert!(!q
+        .complete("j1", &leased.lease_token, &result, now)
+        .await
+        .unwrap());
+
+    db.drop().await.ok();
+}
+
+#[tokio::test]
+async fn sweep_requeues_expired_then_expires_after_max_attempts() {
+    let (q, db) = skip_if_no_mongo!();
+    let t0 = base_time();
+
+    q.enqueue(job("j1"), t0).await.unwrap();
+
+    // Lease #1 with a 10s TTL; then time jumps past expiry.
+    q.lease("r1", Executor::Docker, &[], Duration::from_secs(10), t0)
+        .await
+        .unwrap()
+        .unwrap();
+    let past = t0 + chrono::Duration::seconds(60);
+
+    // attempts=1 < max=2 → requeued.
+    let swept = q.sweep_expired(past, 2).await.unwrap();
+    assert_eq!(swept.requeued, 1);
+    assert_eq!(swept.expired, 0);
+    assert_eq!(
+        q.get("j1").await.unwrap().unwrap().status,
+        compliance_core::models::werkbank::JobStatus::Queued
+    );
+
+    // Lease #2 (attempts=2), let it expire again → now expired (>= max).
+    q.lease("r2", Executor::Docker, &[], Duration::from_secs(10), past)
+        .await
+        .unwrap()
+        .unwrap();
+    let later = past + chrono::Duration::seconds(60);
+    let swept = q.sweep_expired(later, 2).await.unwrap();
+    assert_eq!(swept.requeued, 0);
+    assert_eq!(swept.expired, 1);
+    assert_eq!(
+        q.get("j1").await.unwrap().unwrap().status,
+        compliance_core::models::werkbank::JobStatus::Expired
+    );
+
+    db.drop().await.ok();
+}

compliance-core/Cargo.toml

@@ -50,3 +50,7 @@ axum = { version = "0.8", optional = true }
 jsonwebtoken = { version = "9", optional = true }
 reqwest = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
+
+[dev-dependencies]
+# Parse the declarative TOML job specs in the Werkbank contract tests.
+toml = "0.8"

compliance-core/src/config.rs

@@ -49,6 +49,57 @@ pub struct AgentConfig {
     /// of tenants to iterate. When `None` or unreachable, scheduler
     /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
     pub tenant_registry_url: Option<String>,
+    /// Ephemeral soft-PLC provisioning for dynamic PLC testing (#183). Off by
+    /// default: it needs Docker access in the agent's runtime, which is a
+    /// deployment opt-in.
+    pub plc_runtime: PlcRuntimeConfig,
+}
+
+/// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).
+///
+/// When a PLC/SPS target ships control logic but no reachable live device, the
+/// agent can instantiate that logic itself: spin up a throwaway soft-PLC
+/// (OpenPLC) container in-cluster, load the program, start the runtime, probe it
+/// over industrial protocols, then tear it down. This struct carries the knobs
+/// for that container's lifecycle and the OpenPLC web-UI credentials used to
+/// upload the program.
+#[derive(Clone, Debug)]
+pub struct PlcRuntimeConfig {
+    /// Master switch. Provision-and-test does nothing unless this is set — it
+    /// shells out to `docker`, which requires the agent container to have Docker
+    /// access (socket mount), an explicit deployment decision.
+    pub enabled: bool,
+    /// Container image for the ephemeral soft-PLC (OpenPLC).
+    pub image: String,
+    /// Docker network the instance joins. Must be the agent's own network so it
+    /// is reachable in-cluster by container name and never published to the host.
+    pub network: String,
+    /// Memory cap passed to `docker run --memory` (e.g. `512m`).
+    pub memory: String,
+    /// CPU cap passed to `docker run --cpus` (e.g. `0.5`).
+    pub cpus: String,
+    /// Hard ceiling on a provisioned instance's lifetime. Teardown is guaranteed
+    /// no later than this even if a load/probe step hangs.
+    pub max_lifetime_secs: u64,
+    /// OpenPLC web-UI username for the program upload (image default `openplc`).
+    pub openplc_user: String,
+    /// OpenPLC web-UI password (image default `openplc`).
+    pub openplc_password: SecretString,
+}
+
+impl Default for PlcRuntimeConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            image: "registry.meghsakha.com/openplc:latest".to_string(),
+            network: "certifai".to_string(),
+            memory: "512m".to_string(),
+            cpus: "0.5".to_string(),
+            max_lifetime_secs: 180,
+            openplc_user: "openplc".to_string(),
+            openplc_password: SecretString::from("openplc".to_string()),
+        }
+    }
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/lib.rs

@@ -13,6 +13,6 @@ pub mod auth;
 #[cfg(feature = "axum")]
 pub mod tenant_ctx;
 
-pub use config::{AgentConfig, DashboardConfig};
+pub use config::{AgentConfig, DashboardConfig, PlcRuntimeConfig};
 pub use error::CoreError;
 pub use tenant::{OrgRole, TenantContext, TenantStatus};

compliance-core/src/models/mod.rs

@@ -15,6 +15,7 @@ pub mod repository;
 pub mod sbom;
 pub mod scan;
 pub(crate) mod serde_helpers;
+pub mod werkbank;
 
 pub use auth::AuthInfo;
 pub use chat::{ChatMessage, ChatRequest, ChatResponse, SourceReference};
@@ -47,3 +48,7 @@ pub use pentest::{
 pub use repository::ScanTrigger;
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
+pub use werkbank::{
+    DastCollect, Executor, HeartbeatAck, InputRef, Job, JobCollect, JobRecord, JobResult,
+    JobRuntime, JobStatus, JobType, LeasedJob,
+};

compliance-core/src/models/onboarding.rs

@@ -202,6 +202,9 @@ pub enum PlcFormat {
     PlcopenXml,
     /// IEC 61131-3 Structured Text source.
     StructuredText,
+    /// A CODESYS project archive (`.projectarchive` — a zip bundling the project
+    /// plus its referenced libraries and runtime; the source of the control-app SBOM).
+    ProjectArchive,
 }
 
 /// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.

compliance-core/src/models/scan.rs

@@ -24,6 +24,9 @@ pub enum ScanType {
     MobileStatic,
     /// Static analysis of a container image.
     ContainerScan,
+    /// Dynamic probing of a running PLC/SPS device over industrial protocols
+    /// (Modbus/TCP, OPC UA, …) for exposed/unauthenticated control access.
+    IcsProbe,
 }
 
 impl std::fmt::Display for ScanType {
@@ -43,6 +46,7 @@ impl std::fmt::Display for ScanType {
             Self::PlcControlLogic => write!(f, "plc_control_logic"),
             Self::MobileStatic => write!(f, "mobile_static"),
             Self::ContainerScan => write!(f, "container_scan"),
+            Self::IcsProbe => write!(f, "ics_probe"),
         }
     }
 }
@@ -76,6 +80,7 @@ pub enum ScanPhase {
     LlmTriage,
     IssueCreation,
     DastScanning,
+    IcsProbe,
     Completed,
 }
 

compliance-core/src/models/werkbank.rs

@@ -0,0 +1,461 @@
+//! The Werkbank job/result contract (WB-01).
+//!
+//! The shared, dependency-free vocabulary the control plane and the Werkbank
+//! execution runner agree on: what a [`Job`] is, which [`Executor`] runs it, how
+//! it moves through the queue ([`JobStatus`]), and what a [`JobResult`] carries
+//! back. Jobs are declarative — TOML on disk, JSON on the wire — and results
+//! reuse the existing scanner result types ([`Finding`], [`DastFinding`],
+//! [`SbomEntry`]) so the runner produces exactly what the control plane persists.
+//!
+//! This module is intentionally free of the `mongodb`/`axum` features so the
+//! runner can depend on `compliance-core` without pulling the server stack.
+
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::dast::DastFinding;
+use super::finding::Finding;
+use super::sbom::SbomEntry;
+
+/// The kind of dynamic-execution job.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum JobType {
+    /// Instantiate control logic on an ephemeral soft-PLC and probe it.
+    PlcProvision,
+    /// Boot a firmware image under QEMU and run dynamic checks.
+    QemuBoot,
+    /// Crawl and dynamically test a running web endpoint.
+    Dast,
+    /// Run an active penetration test against a running target.
+    Pentest,
+}
+
+/// How a runner executes a job — the CI-runner-style classification. A runner
+/// advertises exactly one; a job requires one.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Executor {
+    /// A subprocess on the runner host (dev / trusted single-node).
+    Shell,
+    /// One or more containers on the runner's Docker (default; QEMU runs here).
+    Docker,
+    /// A Pod/Job in a Kubernetes cluster (scale-out / multi-tenant).
+    K8s,
+}
+
+/// Lifecycle state of a job in the queue.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum JobStatus {
+    /// Waiting to be leased.
+    Queued,
+    /// Leased by a runner but not yet started.
+    Leased,
+    /// Executing on a runner.
+    Running,
+    /// Completed successfully.
+    Succeeded,
+    /// Completed with an error.
+    Failed,
+    /// The lease/lifetime deadline elapsed before completion.
+    Expired,
+    /// Cancelled by the control plane.
+    Cancelled,
+}
+
+impl JobStatus {
+    /// Whether the job has reached a terminal state (no further transitions).
+    pub fn is_terminal(self) -> bool {
+        matches!(
+            self,
+            JobStatus::Succeeded | JobStatus::Failed | JobStatus::Expired | JobStatus::Cancelled
+        )
+    }
+}
+
+/// A reference to an input artifact. Resolved by the runner from a source it can
+/// reach; the blob itself never flows through the control plane (so an on-prem
+/// runner keeps customer data local). Exactly one of `blob`/`url` should be set.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InputRef {
+    /// Content-addressed blob (e.g. `sha256:…`) the runner fetches from its store.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub blob: Option<String>,
+    /// A URL the runner can reach (git repo, internal artifact store, …).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub url: Option<String>,
+}
+
+impl InputRef {
+    /// A content-addressed blob reference.
+    pub fn blob(id: impl Into<String>) -> Self {
+        Self {
+            blob: Some(id.into()),
+            url: None,
+        }
+    }
+}
+
+/// Sandbox runtime knobs. Fields are executor/job-type specific and all optional;
+/// `extra` carries anything not modelled explicitly.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct JobRuntime {
+    /// Container image (Docker executor).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub image: Option<String>,
+    /// Memory cap (e.g. `512m`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub memory: Option<String>,
+    /// CPU cap (e.g. `0.5`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cpus: Option<String>,
+    /// Network to join (e.g. `isolated`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub network: Option<String>,
+    /// QEMU machine type (qemu-boot).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub machine: Option<String>,
+    /// QEMU target architecture (qemu-boot).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub arch: Option<String>,
+    /// Executor-specific extras not modelled above.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub extra: BTreeMap<String, String>,
+}
+
+/// DAST collection settings for jobs that scan a web endpoint.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DastCollect {
+    /// Maximum crawl depth (kept shallow for ephemeral instances).
+    pub max_crawl_depth: u32,
+}
+
+/// What to collect from a run.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct JobCollect {
+    /// Run the industrial-protocol probe (Modbus/OPC-UA/EtherNet-IP).
+    #[serde(default)]
+    pub ics_probe: bool,
+    /// Run DAST against the provisioned/booted web endpoint.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub dast: Option<DastCollect>,
+    /// Run an active pentest.
+    #[serde(default)]
+    pub pentest: bool,
+    /// Collect an SBOM.
+    #[serde(default)]
+    pub sbom: bool,
+}
+
+/// A declarative dynamic-execution job the control plane enqueues and a Werkbank
+/// runner leases and executes.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Job {
+    /// Unique job id (assigned by the control plane on enqueue).
+    pub id: String,
+    /// What kind of job this is.
+    #[serde(rename = "type")]
+    pub job_type: JobType,
+    /// Owning tenant.
+    pub tenant: String,
+    /// The onboarded target this job tests.
+    pub target_id: String,
+    /// The executor a runner must provide to run this job.
+    pub executor: Executor,
+    /// Runner capabilities this job requires (e.g. `arch=amd64`, `kvm=true`).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub labels: Vec<String>,
+    /// Hard lifetime deadline for the whole job.
+    pub timeout_secs: u64,
+    /// Named input artifacts (e.g. `program`, `firmware`), by reference.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub inputs: BTreeMap<String, InputRef>,
+    /// Sandbox runtime knobs.
+    #[serde(default)]
+    pub runtime: JobRuntime,
+    /// What to collect from the run.
+    #[serde(default)]
+    pub collect: JobCollect,
+}
+
+impl Job {
+    /// A `plc-provision` job: instantiate the control logic named `program` on an
+    /// ephemeral soft-PLC (Docker executor) and collect the ICS probe + DAST.
+    pub fn plc_provision(
+        id: impl Into<String>,
+        tenant: impl Into<String>,
+        target_id: impl Into<String>,
+        program: InputRef,
+        timeout_secs: u64,
+    ) -> Self {
+        let mut inputs = BTreeMap::new();
+        inputs.insert("program".to_string(), program);
+        Self {
+            id: id.into(),
+            job_type: JobType::PlcProvision,
+            tenant: tenant.into(),
+            target_id: target_id.into(),
+            executor: Executor::Docker,
+            labels: Vec::new(),
+            timeout_secs,
+            inputs,
+            runtime: JobRuntime::default(),
+            collect: JobCollect {
+                ics_probe: true,
+                dast: Some(DastCollect { max_crawl_depth: 2 }),
+                pentest: false,
+                sbom: false,
+            },
+        }
+    }
+}
+
+/// The outcome of running a job, posted back to the control plane. Findings and
+/// SBOM reuse the shared scanner types, so the control plane persists them
+/// unchanged. Submission is idempotent — keyed by [`JobResult::job_id`].
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct JobResult {
+    /// The job this result is for.
+    pub job_id: String,
+    /// Terminal status of the job.
+    pub status: Option<JobStatus>,
+    /// General scanner findings (e.g. ICS-probe findings).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub findings: Vec<Finding>,
+    /// DAST findings from a web-endpoint scan.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub dast_findings: Vec<DastFinding>,
+    /// SBOM components collected from the run.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub sbom: Vec<SbomEntry>,
+    /// Error message when the job failed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+    /// Captured execution log (truncated by the runner).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub logs: Option<String>,
+    /// When execution started on the runner.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub started_at: Option<DateTime<Utc>>,
+    /// When execution finished.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub finished_at: Option<DateTime<Utc>>,
+}
+
+impl JobResult {
+    /// A successful result for a job.
+    pub fn succeeded(job_id: impl Into<String>) -> Self {
+        Self {
+            job_id: job_id.into(),
+            status: Some(JobStatus::Succeeded),
+            ..Default::default()
+        }
+    }
+
+    /// A failed result carrying an error message.
+    pub fn failed(job_id: impl Into<String>, error: impl Into<String>) -> Self {
+        Self {
+            job_id: job_id.into(),
+            status: Some(JobStatus::Failed),
+            error: Some(error.into()),
+            ..Default::default()
+        }
+    }
+}
+
+/// A queued job as persisted by the control plane (WB-02): the [`Job`] contract
+/// plus the queue bookkeeping — status, lease ownership, attempt count, and the
+/// eventual result. The runner never sees this record; on lease it receives a
+/// [`LeasedJob`] (the job plus a token it presents to heartbeat/complete).
+///
+/// Timestamps persist as native BSON dates so the queue's range queries (lease
+/// FIFO by `created_at`, visibility-timeout sweep by `lease_expires_at`) compare
+/// correctly.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct JobRecord {
+    /// The job to run.
+    pub job: Job,
+    /// Current queue state.
+    pub status: JobStatus,
+    /// The lease token held by the current runner (proves lease ownership).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lease_token: Option<String>,
+    /// Id of the runner holding the lease.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub leased_by: Option<String>,
+    /// When the current lease expires — the visibility timeout after which a
+    /// crashed runner's job is swept back to `queued`.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub lease_expires_at: Option<DateTime<Utc>>,
+    /// Last heartbeat from the runner.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub heartbeat_at: Option<DateTime<Utc>>,
+    /// How many times the job has been leased (incremented on each lease).
+    #[serde(default)]
+    pub attempts: u32,
+    /// Set when the control plane requests cancellation; the runner sees it on
+    /// its next heartbeat and aborts.
+    #[serde(default)]
+    pub cancel_requested: bool,
+    /// The result, once the job reaches a terminal state.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub result: Option<JobResult>,
+    /// When the job was enqueued.
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub created_at: DateTime<Utc>,
+    /// Last modification.
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub updated_at: DateTime<Utc>,
+}
+
+impl JobRecord {
+    /// A freshly-enqueued (`queued`) record for a job.
+    pub fn queued(job: Job, now: DateTime<Utc>) -> Self {
+        Self {
+            job,
+            status: JobStatus::Queued,
+            lease_token: None,
+            leased_by: None,
+            lease_expires_at: None,
+            heartbeat_at: None,
+            attempts: 0,
+            cancel_requested: false,
+            result: None,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+}
+
+/// A job handed to a runner on lease: what to run plus the token the runner must
+/// present to heartbeat and complete it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct LeasedJob {
+    /// The job to execute.
+    pub job: Job,
+    /// The lease token proving ownership (opaque to the runner).
+    pub lease_token: String,
+}
+
+/// The runner's view of a heartbeat: whether the control plane has asked the job
+/// to stop. `None` from the queue means the lease was lost (token mismatch or the
+/// job already terminal) and the runner should abandon the work.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct HeartbeatAck {
+    /// The control plane requested cancellation — the runner should tear down.
+    pub cancelled: bool,
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn job_round_trips_through_json() {
+        let job = Job::plc_provision("job_1", "acme", "64f0aa", InputRef::blob("sha256:abc"), 180);
+        let json = serde_json::to_string(&job).expect("serialize");
+        let back: Job = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(job, back);
+        // Enum wire forms are the kebab/lowercase the contract documents.
+        assert!(json.contains("\"type\":\"plc-provision\""));
+        assert!(json.contains("\"executor\":\"docker\""));
+    }
+
+    #[test]
+    fn parses_the_design_doc_plc_provision_toml() {
+        // The exact shape from docs/DESIGN.md §5 (wrapped in a [job] table).
+        #[derive(Deserialize)]
+        struct JobFile {
+            job: Job,
+        }
+        let src = r#"
+            [job]
+            id = "job_01H"
+            type = "plc-provision"
+            tenant = "acme"
+            target_id = "64f0"
+            executor = "docker"
+            labels = ["arch=amd64"]
+            timeout_secs = 180
+
+            [job.inputs]
+            program = { blob = "sha256:deadbeef" }
+
+            [job.runtime]
+            image = "openplc:latest"
+            memory = "512m"
+            cpus = "0.5"
+            network = "isolated"
+
+            [job.collect]
+            ics_probe = true
+            dast = { max_crawl_depth = 2 }
+        "#;
+        let file: JobFile = toml::from_str(src).expect("parse job toml");
+        let job = file.job;
+        assert_eq!(job.job_type, JobType::PlcProvision);
+        assert_eq!(job.executor, Executor::Docker);
+        assert_eq!(job.labels, vec!["arch=amd64".to_string()]);
+        assert_eq!(
+            job.inputs.get("program").and_then(|i| i.blob.as_deref()),
+            Some("sha256:deadbeef")
+        );
+        assert_eq!(job.runtime.image.as_deref(), Some("openplc:latest"));
+        assert!(job.collect.ics_probe);
+        assert_eq!(job.collect.dast.map(|d| d.max_crawl_depth), Some(2));
+    }
+
+    #[test]
+    fn qemu_boot_runtime_fields_parse() {
+        #[derive(Deserialize)]
+        struct JobFile {
+            job: Job,
+        }
+        let src = r#"
+            [job]
+            id = "j2"
+            type = "qemu-boot"
+            tenant = "acme"
+            target_id = "t"
+            executor = "docker"
+            labels = ["kvm=true"]
+            timeout_secs = 600
+            [job.inputs]
+            firmware = { blob = "sha256:cafe" }
+            [job.runtime]
+            machine = "virt"
+            arch = "arm"
+            memory = "1g"
+        "#;
+        let file: JobFile = toml::from_str(src).expect("parse");
+        assert_eq!(file.job.job_type, JobType::QemuBoot);
+        assert_eq!(file.job.runtime.arch.as_deref(), Some("arm"));
+        assert_eq!(
+            file.job
+                .inputs
+                .get("firmware")
+                .and_then(|i| i.blob.as_deref()),
+            Some("sha256:cafe")
+        );
+    }
+
+    #[test]
+    fn status_terminality() {
+        assert!(JobStatus::Succeeded.is_terminal());
+        assert!(JobStatus::Expired.is_terminal());
+        assert!(!JobStatus::Queued.is_terminal());
+        assert!(!JobStatus::Running.is_terminal());
+    }
+
+    #[test]
+    fn result_constructors() {
+        assert_eq!(JobResult::succeeded("j").status, Some(JobStatus::Succeeded));
+        let f = JobResult::failed("j", "boom");
+        assert_eq!(f.status, Some(JobStatus::Failed));
+        assert_eq!(f.error.as_deref(), Some("boom"));
+    }
+}

compliance-core/src/scan_matrix.rs

@@ -14,8 +14,12 @@ use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
 pub enum ArtifactRequirement {
     /// Source code — a git repo or a source archive.
     Code,
-    /// A reachable running instance (live URL / endpoint).
+    /// A reachable running instance (any live URL / endpoint, scheme-agnostic —
+    /// e.g. the ICS probe works off the host:port of a modbus:// or http:// ref).
     RunningUrl,
+    /// A reachable **web** endpoint — a live URL with an http(s) scheme. DAST is
+    /// an HTTP crawler, so a modbus:// / opc.tcp:// endpoint does not satisfy it.
+    HttpUrl,
     /// A firmware image / binary blob.
     Firmware,
     /// A PLC project (PLCopen XML or Structured Text).
@@ -134,7 +138,7 @@ fn sast_umbrella() -> Vec<ScanRule> {
 /// The rule set for a target type. Scans that are never applicable to a type are
 /// simply absent (e.g. DAST is not listed for a PLC target).
 pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
-    use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
+    use ArtifactRequirement::{Firmware, HttpUrl, Mobile, Plc, RunningUrl};
     match target_type {
         TargetType::WebApp | TargetType::BackendService => {
             let mut r = sast_umbrella();
@@ -142,7 +146,7 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
                 ScanType::Dast,
                 true,
                 "Dynamic scan of the running endpoint",
-                RunningUrl,
+                HttpUrl,
             ));
             r
         }
@@ -203,16 +207,62 @@ pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
                 ScanType::Dast,
                 false,
                 "Dynamic scan of exposed network services (if any)",
-                RunningUrl,
+                HttpUrl,
             ));
             r
         }
-        TargetType::PlcSps => vec![ScanRule::new(
-            ScanType::PlcControlLogic,
-            true,
-            "Control-logic security rules over the PLC program",
-            Plc,
-        )],
+        TargetType::PlcSps => {
+            // A PLC/SPS device is a composite: the control application *and* the
+            // device it runs on (firmware/OS + reachable runtime services). The
+            // control-logic scan runs on the PLC project; the firmware and DAST
+            // scans light up only when a firmware image / running endpoint is
+            // attached (e.g. a CODESYS runtime on a Yocto image with WebVisu).
+            // Firmware-image SBOM/CVE *execution* is shared with the firmware
+            // families and tracked in #151/#128; DAST over a WebVisu/OPC-UA
+            // endpoint uses the existing DAST path.
+            vec![
+                ScanRule::new(
+                    ScanType::PlcControlLogic,
+                    true,
+                    "Control-logic security rules over the PLC program",
+                    Plc,
+                ),
+                // Device-level scans are offered but opt-in (default-off): they
+                // apply only when a firmware image is attached, and firmware-image
+                // SBOM/CVE *execution* is shared with the firmware families and
+                // still landing (#151/#128), so they must not silently auto-run.
+                ScanRule::new(
+                    ScanType::FirmwareStatic,
+                    false,
+                    "Static analysis of the device firmware image (OS + runtime)",
+                    Firmware,
+                ),
+                ScanRule::new(
+                    ScanType::Sbom,
+                    false,
+                    "SBOM from the device firmware image (OS packages + CODESYS runtime)",
+                    Firmware,
+                ),
+                ScanRule::new(
+                    ScanType::Cve,
+                    false,
+                    "Match device firmware components against known CVEs",
+                    Firmware,
+                ),
+                ScanRule::new(
+                    ScanType::Dast,
+                    false,
+                    "Dynamic scan of the running device (WebVisu / exposed services)",
+                    HttpUrl,
+                ),
+                ScanRule::new(
+                    ScanType::IcsProbe,
+                    false,
+                    "Probe the running device over industrial protocols (Modbus/TCP, …)",
+                    RunningUrl,
+                ),
+            ]
+        }
     }
 }
 
@@ -229,6 +279,9 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
             | TargetType::AndroidApp
             | TargetType::IosApp
             | TargetType::EmbeddedLinuxYocto
+            // A PLC/SPS device exposes reachable runtime services (WebVisu, OPC UA,
+            // the CODESYS programming protocol), so an active pentest applies.
+            | TargetType::PlcSps
     )
 }
 
@@ -236,7 +289,9 @@ pub fn supports_pentest(target_type: TargetType) -> bool {
 fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
     match req {
         ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
-        ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
+        ArtifactRequirement::RunningUrl | ArtifactRequirement::HttpUrl => {
+            Some(ArtifactKind::LiveUrl)
+        }
         ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
         ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
         ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
@@ -245,13 +300,29 @@ fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
     }
 }
 
+/// Whether a live-URL reference is an http(s) web endpoint (vs. an industrial
+/// endpoint like `modbus://` / `opc.tcp://`, which DAST cannot crawl).
+fn is_http_url(source_ref: &str) -> bool {
+    let s = source_ref.trim();
+    s.starts_with("http://") || s.starts_with("https://")
+}
+
 /// Whether the target carries an artifact that satisfies the requirement.
 fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
     match req {
         ArtifactRequirement::Code => target.code_artifact().is_some(),
         ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
+        ArtifactRequirement::HttpUrl => target
+            .artifacts
+            .iter()
+            .any(|a| a.kind == ArtifactKind::LiveUrl && is_http_url(&a.source_ref)),
         ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
-        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
+        // A PLC project artifact, or a code artifact (git repo / source archive)
+        // holding the control logic as PLCopen XML / ST exports — the common way
+        // CODESYS projects are version-controlled.
+        ArtifactRequirement::Plc => {
+            target.has(ArtifactKind::PlcProject) || target.code_artifact().is_some()
+        }
         ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
         ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
         ArtifactRequirement::Any => true,
@@ -268,6 +339,10 @@ pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
             let required_artifact = representative_kind(rule.requires);
             let blocked_reason = if satisfied {
                 None
+            } else if rule.requires == ArtifactRequirement::HttpUrl {
+                // A live URL may be present but non-HTTP (e.g. modbus://): be
+                // specific so the user knows DAST needs a web endpoint.
+                Some("no http(s) live URL — DAST needs a web endpoint".to_string())
             } else {
                 Some(match required_artifact {
                     Some(kind) => format!("no {kind} artifact provided"),
@@ -340,22 +415,124 @@ mod tests {
     }
 
     #[test]
-    fn plc_offers_only_control_logic() {
+    fn plc_control_logic_is_default_on_and_device_scans_block_without_artifacts() {
+        // A PLC project alone: control-logic runs; the device-level scans are
+        // offered but blocked until a firmware image / running endpoint is added.
         let t = target_with(
             TargetType::PlcSps,
             vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
         );
         let opts = applicable_scans(&t);
-        assert_eq!(opts.len(), 1);
-        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
-        assert!(opts[0].default_on);
+        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert!(plc.default_on && plc.blocked_reason.is_none());
+        for scan in [ScanType::FirmwareStatic, ScanType::Sbom, ScanType::Cve] {
+            let o = option(&opts, scan).expect("device scan offered");
+            assert!(
+                !o.default_on,
+                "{scan} must not pre-select without a firmware image"
+            );
+            assert!(o.blocked_reason.is_some());
+        }
+        let dast = option(&opts, ScanType::Dast).expect("dast offered");
+        assert!(!dast.default_on);
+        assert!(dast.blocked_reason.is_some());
+    }
+
+    #[test]
+    fn plc_control_logic_is_satisfied_by_a_git_repo() {
+        // A CODESYS project version-controlled in git (PLCopen XML / ST exports),
+        // no uploaded PlcProject artifact.
+        let t = target_with(TargetType::PlcSps, vec![Artifact::git_repo("u", "main")]);
+        let opts = applicable_scans(&t);
+        let plc = option(&opts, ScanType::PlcControlLogic).expect("control-logic offered");
+        assert!(
+            plc.default_on && plc.blocked_reason.is_none(),
+            "a git repo should satisfy PLC control-logic"
+        );
+    }
+
+    #[test]
+    fn plc_composite_lights_up_device_scans_with_firmware_and_url() {
+        // A CODESYS-on-Yocto device: PLC project + firmware image + WebVisu URL.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![
+                Artifact::plc_project("p.xml", PlcFormat::PlcopenXml),
+                Artifact::firmware_image("device.img"),
+                Artifact::live_url("http://plc.local/webvisu"),
+            ],
+        );
+        let opts = applicable_scans(&t);
+        for scan in [
+            ScanType::PlcControlLogic,
+            ScanType::FirmwareStatic,
+            ScanType::Sbom,
+            ScanType::Cve,
+        ] {
+            let o = option(&opts, scan).expect("scan offered");
+            assert!(o.blocked_reason.is_none(), "{scan} should be unblocked");
+        }
+        // Control-logic auto-runs; the device-level scans are unblocked but opt-in
+        // (default-off) until firmware-image execution lands (#151/#128).
+        assert!(option(&opts, ScanType::PlcControlLogic).unwrap().default_on);
+        assert!(!option(&opts, ScanType::Sbom).unwrap().default_on);
+        assert!(!option(&opts, ScanType::Dast).unwrap().default_on);
+        assert!(option(&opts, ScanType::Dast)
+            .unwrap()
+            .blocked_reason
+            .is_none());
+    }
+
+    #[test]
+    fn plc_with_modbus_url_offers_ics_probe_but_blocks_dast() {
+        // A soft-PLC reachable only over Modbus/TCP (no WebVisu). The ICS probe
+        // is applicable (it works off host:port), but DAST — an HTTP crawler —
+        // must be blocked so it isn't offered/run against a non-web endpoint.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![Artifact::live_url("modbus://plc-sim:502")],
+        );
+        let opts = applicable_scans(&t);
+        let ics = option(&opts, ScanType::IcsProbe).expect("ics probe offered");
+        assert!(
+            ics.blocked_reason.is_none(),
+            "ICS probe should be unblocked for a modbus:// endpoint"
+        );
+        assert!(!ics.default_on, "ICS probe stays opt-in (default-off)");
+        let dast = option(&opts, ScanType::Dast).expect("dast listed");
+        assert!(
+            dast.blocked_reason.is_some(),
+            "DAST must be blocked without an http(s) endpoint"
+        );
+        assert!(!dast.default_on);
+    }
+
+    #[test]
+    fn plc_with_http_webvisu_offers_both_dast_and_ics_probe() {
+        // A PLC exposing a WebVisu over HTTP: both DAST (web) and the ICS probe
+        // (OT ports on the same host) are applicable.
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![Artifact::live_url("http://plc.local/webvisu")],
+        );
+        let opts = applicable_scans(&t);
+        assert!(option(&opts, ScanType::Dast)
+            .expect("dast offered")
+            .blocked_reason
+            .is_none());
+        assert!(option(&opts, ScanType::IcsProbe)
+            .expect("ics probe offered")
+            .blocked_reason
+            .is_none());
     }
 
     #[test]
     fn pentest_support_matches_reachable_families() {
         assert!(supports_pentest(TargetType::WebApp));
         assert!(supports_pentest(TargetType::BackendService));
-        assert!(!supports_pentest(TargetType::PlcSps));
+        assert!(supports_pentest(TargetType::EmbeddedLinuxYocto));
+        // A PLC/SPS device is network-reachable (WebVisu / OPC UA / 11740).
+        assert!(supports_pentest(TargetType::PlcSps));
         assert!(!supports_pentest(TargetType::FirmwareBareMetal));
         assert!(!supports_pentest(TargetType::DesktopApp));
     }

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -78,8 +78,16 @@ pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
                 .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
         }
         "live_url" => {
-            let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
-            (!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
+            // http(s) for web/DAST targets; modbus:// and opc.tcp:// for ICS
+            // devices probed by the ICS probe (e.g. modbus://plc:502).
+            let ok = (s.starts_with("https://")
+                || s.starts_with("http://")
+                || s.starts_with("modbus://")
+                || s.starts_with("opc.tcp://"))
+                && no_space;
+            (!ok).then(|| {
+                "Enter a URL — https://app.example.com, or modbus://host:502 for a PLC".to_string()
+            })
         }
         "container_image" => {
             (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
@@ -130,6 +138,37 @@ pub async fn create_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
+/// Upload a file artifact (PLC project, firmware image, source archive, mobile
+/// package) to a target — proxied to the agent as multipart.
+#[server]
+pub async fn upload_target_artifact(
+    id: String,
+    kind: String,
+    plc_format: Option<String>,
+    filename: String,
+    bytes: Vec<u8>,
+) -> Result<TargetResponse, ServerFnError> {
+    let mut form = reqwest::multipart::Form::new().text("kind", kind).part(
+        "file",
+        reqwest::multipart::Part::bytes(bytes).file_name(filename),
+    );
+    if let Some(pf) = plc_format {
+        form = form.text("plc_format", pf);
+    }
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/artifacts/upload"),
+    )
+    .await?
+    .multipart(form)
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
 /// Update a target's name / type / artifacts (dashboard editor).
 #[server]
 pub async fn update_target(
@@ -165,6 +204,28 @@ pub async fn update_target(
         .map_err(|e| ServerFnError::new(e.to_string()))
 }
 
+/// Enable specific opt-in scans on a target by setting `scan_config.enabled_scans`.
+/// `scans` are serde scan-type names (lowercase, no underscores — e.g. `icsprobe`).
+#[server]
+pub async fn enable_target_scans(
+    id: String,
+    scans: Vec<String>,
+) -> Result<TargetResponse, ServerFnError> {
+    let body = serde_json::json!({ "scan_config": { "enabled_scans": scans } });
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::PATCH,
+        &format!("/api/v1/targets/{id}"),
+    )
+    .await?
+    .json(&body)
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
 /// Run kind-based classification on a target.
 #[server]
 pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {

compliance-dashboard/src/infrastructure/server.rs

@@ -1,3 +1,4 @@
+use axum::extract::DefaultBodyLimit;
 use axum::routing::{get, post};
 use axum::{middleware, Extension};
 use dioxus::prelude::*;
@@ -66,6 +67,9 @@ pub fn server_start(app: fn() -> Element) -> Result<(), DashboardError> {
                 // Webhook proxy: forward to agent (no auth required)
                 .route("/webhook/{platform}/{repo_id}", post(webhook_proxy))
                 .serve_dioxus_application(ServeConfig::new(), app)
+                // Allow large artifact uploads through the upload server function
+                // (PLC .projectarchive, firmware, mobile) — default is 2 MiB.
+                .layer(DefaultBodyLimit::max(512 * 1024 * 1024))
                 .layer(Extension(PendingOAuthStore::default()))
                 .layer(middleware::from_fn(require_auth))
                 .layer(Extension(server_state))

compliance-dashboard/src/pages/onboarding.rs

@@ -2,8 +2,8 @@ use dioxus::prelude::*;
 
 use crate::components::page_header::PageHeader;
 use crate::infrastructure::onboarding::{
-    create_target, detect_target, fetch_applicable_scans, trigger_target_scan,
-    validate_artifact_ref, validate_target_name, ArtifactInputDto,
+    create_target, detect_target, enable_target_scans, fetch_applicable_scans, trigger_target_scan,
+    upload_target_artifact, validate_artifact_ref, validate_target_name, ArtifactInputDto,
 };
 
 /// (value, label, one-line description) for the 9 target families.
@@ -41,6 +41,23 @@ const ARTIFACT_KINDS: &[(&str, &str)] = &[
 
 const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
 
+/// Artifact kinds provided as an uploaded file (rather than a URL/text ref).
+fn is_file_kind(kind: &str) -> bool {
+    matches!(
+        kind,
+        "plc_project" | "firmware_image" | "source_archive" | "mobile_package"
+    )
+}
+
+/// A file artifact staged in the wizard, uploaded after the target is created.
+#[derive(Clone, PartialEq)]
+struct PendingFile {
+    kind: String,
+    plc_format: Option<String>,
+    filename: String,
+    bytes: Vec<u8>,
+}
+
 /// One row in the applicable-scans list on the success step.
 #[component]
 fn ScanRow(scan: serde_json::Value) -> Element {
@@ -108,6 +125,10 @@ pub fn OnboardingPage() -> Element {
     let mut new_kind = use_signal(|| "git_repo".to_string());
     let mut new_source = use_signal(String::new);
     let mut new_branch = use_signal(|| "main".to_string());
+    // File-upload artifacts (PLC project, firmware image, ...).
+    let mut new_plc_format = use_signal(|| "plcopen_xml".to_string());
+    let mut new_file = use_signal(|| Option::<(String, Vec<u8>)>::None);
+    let mut pending_files = use_signal(Vec::<PendingFile>::new);
 
     // Create + result state.
     let mut creating = use_signal(|| false);
@@ -116,11 +137,35 @@ pub fn OnboardingPage() -> Element {
     let mut suggested = use_signal(|| Option::<String>::None);
     let mut created_id = use_signal(|| Option::<String>::None);
     let mut scan_msg = use_signal(|| Option::<String>::None);
+    // Opt-in scans (default-off but unblocked) the user ticks to enable before
+    // running — stored as serde scan-type names (lowercase, no underscores).
+    let mut enabled_extra = use_signal(Vec::<String>::new);
 
     let step_now = step();
     let name_error = validate_target_name(&name());
     let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
-    let has_artifacts = !artifacts().is_empty();
+    let has_artifacts = !artifacts().is_empty() || !pending_files().is_empty();
+    // Opt-in scans: applicable + unblocked, but default-off (e.g. the ICS probe).
+    // The user ticks these to enable them before the first run. Each entry is
+    // (display name for the label, serde scan-type name for the enable call —
+    // lowercase, no underscores, matching ScanType's rename_all = "lowercase").
+    let optin_scans: Vec<(String, String)> = scans()
+        .iter()
+        .filter_map(|s| {
+            let unblocked = s.get("blocked_reason").and_then(|v| v.as_str()).is_none();
+            let default_on = s
+                .get("default_on")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
+            if unblocked && !default_on {
+                let display = s.get("scan").and_then(|v| v.as_str())?.to_string();
+                let serde_name = display.replace('_', "");
+                Some((display, serde_name))
+            } else {
+                None
+            }
+        })
+        .collect();
     // Live validation of the artifact reference being typed (empty = no error yet).
     let new_source_error = if new_source().is_empty() {
         None
@@ -193,6 +238,36 @@ pub fn OnboardingPage() -> Element {
             // ---- Step 1: artifacts ----
             if step_now == 1 {
                 div { class: "card-header", "Attach artifacts" }
+                if target_type() == "plc_sps" {
+                    div {
+                        style: "margin: 12px 16px 0; padding: 12px 14px; border-left: 3px solid var(--accent, #3b82f6); background: var(--surface-2, rgba(59,130,246,0.08)); font-size: 0.88em; line-height: 1.55;",
+                        div { style: "font-weight: 600; margin-bottom: 4px;", "CODESYS / PLC projects" }
+                        "Attach a "
+                        b { "PLC project" }
+                        " (PLCopen XML / ST, or a .projectarchive), or a "
+                        b { "Git repository" }
+                        " of exported source — every scan is then just a pull."
+                        ul { style: "margin: 6px 0 0; padding-left: 18px;",
+                            li {
+                                b { "Control-logic SAST" }
+                                " — commit "
+                                b { "PLCopen XML exports" }
+                                " (Project → Export PLCopenXML) or raw .st; ST and graphical FBD/LD are both analyzed."
+                            }
+                            li {
+                                b { "Library + runtime SBOM" }
+                                " — include the "
+                                b { ".projectarchive" }
+                                "; PLCopen XML alone carries no libraries."
+                            }
+                            li {
+                                "Avoid committing only the binary "
+                                code { ".project" }
+                                " — it can't be parsed and doesn't diff."
+                            }
+                        }
+                    }
+                }
                 div { style: "padding: 16px;",
                     div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
                         div { class: "form-group", style: "margin: 0;",
@@ -205,49 +280,143 @@ pub fn OnboardingPage() -> Element {
                                 }
                             }
                         }
-                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                            label { "Reference (URL / path / text)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "https://git.example.com/acme.git",
-                                value: "{new_source}",
-                                oninput: move |e| new_source.set(e.value()),
+                        if is_file_kind(&new_kind()) {
+                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                                label { "File" }
+                                input {
+                                    r#type: "file",
+                                    onchange: move |evt| {
+                                        let Some(file) = evt.files().into_iter().next() else { return; };
+                                        let name = file.name();
+                                        // Auto-detect the PLC format from the file extension.
+                                        let lname = name.to_ascii_lowercase();
+                                        if lname.ends_with(".projectarchive") || lname.ends_with(".project") {
+                                            new_plc_format.set("project_archive".to_string());
+                                        } else if lname.ends_with(".xml") || lname.ends_with(".plcopen") {
+                                            new_plc_format.set("plcopen_xml".to_string());
+                                        } else if lname.ends_with(".st") || lname.ends_with(".exp") || lname.ends_with(".scl") {
+                                            new_plc_format.set("structured_text".to_string());
+                                        }
+                                        spawn(async move {
+                                            if let Ok(bytes) = file.read_bytes().await {
+                                                new_file.set(Some((name, bytes.to_vec())));
+                                            }
+                                        });
+                                    },
+                                }
                             }
-                        }
-                        if new_kind() == "git_repo" {
-                            div { class: "form-group", style: "margin: 0;",
-                                label { "Branch" }
+                            if new_kind() == "plc_project" {
+                                div { class: "form-group", style: "margin: 0;",
+                                    label { "Format" }
+                                    select {
+                                        value: "{new_plc_format}",
+                                        oninput: move |e| new_plc_format.set(e.value()),
+                                        option {
+                                            value: "plcopen_xml",
+                                            selected: new_plc_format() == "plcopen_xml",
+                                            "PLCopen XML",
+                                        }
+                                        option {
+                                            value: "structured_text",
+                                            selected: new_plc_format() == "structured_text",
+                                            "Structured Text",
+                                        }
+                                        option {
+                                            value: "project_archive",
+                                            selected: new_plc_format() == "project_archive",
+                                            "Project archive (.projectarchive)",
+                                        }
+                                    }
+                                }
+                            }
+                            button {
+                                class: "btn btn-secondary",
+                                disabled: new_file().is_none(),
+                                onclick: move |_| {
+                                    if let Some((fname, data)) = new_file() {
+                                        let kind = new_kind();
+                                        let plc_format = if kind == "plc_project" {
+                                            Some(new_plc_format())
+                                        } else {
+                                            None
+                                        };
+                                        pending_files.write().push(PendingFile {
+                                            kind,
+                                            plc_format,
+                                            filename: fname,
+                                            bytes: data,
+                                        });
+                                        new_file.set(None);
+                                    }
+                                },
+                                "+ Add file"
+                            }
+                        } else {
+                            div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                                label { "Reference (URL / path / text)" }
                                 input {
                                     r#type: "text",
-                                    value: "{new_branch}",
-                                    oninput: move |e| new_branch.set(e.value()),
+                                    placeholder: "https://git.example.com/acme.git",
+                                    value: "{new_source}",
+                                    oninput: move |e| new_source.set(e.value()),
                                 }
                             }
-                        }
-                        button {
-                            class: "btn btn-secondary",
-                            disabled: new_source().trim().is_empty() || new_source_error.is_some(),
-                            onclick: move |_| {
-                                let kind = new_kind();
-                                if !new_source().trim().is_empty()
-                                    && validate_artifact_ref(&kind, &new_source()).is_none()
-                                {
-                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
-                                    artifacts.write().push(ArtifactInputDto {
-                                        kind,
-                                        source_ref: new_source(),
-                                        branch,
-                                        plc_format: None,
-                                    });
-                                    new_source.set(String::new());
+                            if new_kind() == "git_repo" {
+                                div { class: "form-group", style: "margin: 0;",
+                                    label { "Branch" }
+                                    input {
+                                        r#type: "text",
+                                        value: "{new_branch}",
+                                        oninput: move |e| new_branch.set(e.value()),
+                                    }
                                 }
-                            },
-                            "+ Add"
+                            }
+                            button {
+                                class: "btn btn-secondary",
+                                disabled: new_source().trim().is_empty() || new_source_error.is_some(),
+                                onclick: move |_| {
+                                    let kind = new_kind();
+                                    if !new_source().trim().is_empty()
+                                        && validate_artifact_ref(&kind, &new_source()).is_none()
+                                    {
+                                        let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
+                                        artifacts.write().push(ArtifactInputDto {
+                                            kind,
+                                            source_ref: new_source(),
+                                            branch,
+                                            plc_format: None,
+                                        });
+                                        new_source.set(String::new());
+                                    }
+                                },
+                                "+ Add"
+                            }
                         }
                     }
-                    if let Some(err) = new_source_error.clone() {
+                    if is_file_kind(&new_kind()) {
+                        if let Some((fname, data)) = new_file() {
+                            div { style: "font-size: 0.85em; opacity: 0.7; margin-top: 6px;",
+                                "Selected: {fname} ({data.len()} bytes)"
+                            }
+                        }
+                    } else if let Some(err) = new_source_error.clone() {
                         div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
                     }
+                    // Staged file artifacts (uploaded after the target is created).
+                    for (i, pf) in pending_files().iter().enumerate() {
+                        div {
+                            style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-top: 6px;",
+                            span {
+                                span { style: "opacity: 0.7;", "{kind_label(&pf.kind)} (file): " }
+                                "{pf.filename} ({pf.bytes.len()} bytes)"
+                            }
+                            button {
+                                class: "btn btn-ghost-danger btn-sm",
+                                onclick: move |_| { pending_files.write().remove(i); },
+                                "Remove"
+                            }
+                        }
+                    }
 
                     div { style: "margin-top: 16px;",
                         if has_artifacts {
@@ -311,6 +480,39 @@ pub fn OnboardingPage() -> Element {
                             ScanRow { scan: s }
                         }
                     }
+                    if !optin_scans.is_empty() {
+                        div { style: "margin-top: 12px; padding: 10px; border: 1px dashed var(--border, #ccc); border-radius: 6px;",
+                            div { style: "font-weight: 600; margin-bottom: 6px;", "Enable opt-in scans" }
+                            div { style: "opacity: 0.7; font-size: 0.85em; margin-bottom: 8px;",
+                                "These are applicable but off by default (they touch a live device). Tick to enable before running."
+                            }
+                            for pair in optin_scans.clone() {
+                                {
+                                    let (display, serde_name) = pair;
+                                    let cb_name = serde_name.clone();
+                                    rsx! {
+                                        label {
+                                            style: "display: flex; gap: 6px; align-items: center; margin-top: 4px;",
+                                            input {
+                                                r#type: "checkbox",
+                                                checked: enabled_extra().contains(&serde_name),
+                                                onchange: move |_| {
+                                                    let mut v = enabled_extra();
+                                                    if let Some(p) = v.iter().position(|x| x == &cb_name) {
+                                                        v.remove(p);
+                                                    } else {
+                                                        v.push(cb_name.clone());
+                                                    }
+                                                    enabled_extra.set(v);
+                                                },
+                                            }
+                                            "Enable {display}"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
                     if let Some(msg) = scan_msg() {
                         div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
                     }
@@ -319,8 +521,21 @@ pub fn OnboardingPage() -> Element {
                             class: "btn btn-primary",
                             onclick: move |_| {
                                 if let Some(id) = created_id() {
+                                    let extra = enabled_extra();
                                     scan_msg.set(Some("Scan triggered...".to_string()));
                                     spawn(async move {
+                                        // Persist any ticked opt-in scans first, so the
+                                        // agent's build_scan_plan includes them this run.
+                                        if !extra.is_empty() {
+                                            if let Err(e) =
+                                                enable_target_scans(id.clone(), extra).await
+                                            {
+                                                scan_msg.set(Some(format!(
+                                                    "Failed to enable opt-in scans: {e}"
+                                                )));
+                                                return;
+                                            }
+                                        }
                                         match trigger_target_scan(id).await {
                                             Ok(_) => scan_msg.set(Some(
                                                 "Scan started — findings will appear as it runs.".to_string(),
@@ -340,6 +555,8 @@ pub fn OnboardingPage() -> Element {
                                 target_type.set(String::new());
                                 description.set(String::new());
                                 artifacts.write().clear();
+                                pending_files.write().clear();
+                                new_file.set(None);
                                 scans.write().clear();
                                 suggested.set(None);
                                 created_id.set(None);
@@ -378,6 +595,7 @@ pub fn OnboardingPage() -> Element {
                             let tt = target_type();
                             let desc = description();
                             let arts = artifacts();
+                            let files = pending_files();
                             let d = if desc.trim().is_empty() { None } else { Some(desc) };
                             creating.set(true);
                             error.set(None);
@@ -392,6 +610,23 @@ pub fn OnboardingPage() -> Element {
                                             .map(String::from);
                                         if let Some(id) = id {
                                             created_id.set(Some(id.clone()));
+                                            // Upload staged file artifacts now that the target exists.
+                                            for pf in files {
+                                                let fname = pf.filename.clone();
+                                                if let Err(e) = upload_target_artifact(
+                                                    id.clone(),
+                                                    pf.kind,
+                                                    pf.plc_format,
+                                                    pf.filename,
+                                                    pf.bytes,
+                                                )
+                                                .await
+                                                {
+                                                    error.set(Some(format!(
+                                                        "Upload failed for {fname}: {e}"
+                                                    )));
+                                                }
+                                            }
                                             if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
                                                 scans.set(sc.data.scans);
                                             }

compliance-dashboard/src/pages/targets.rs

@@ -232,7 +232,7 @@ pub fn TargetsPage() -> Element {
                                 value: "{edit_type}",
                                 oninput: move |e| edit_type.set(e.value()),
                                 for (v, l) in TARGET_TYPES.iter().copied() {
-                                    option { value: "{v}", "{l}" }
+                                    option { value: "{v}", selected: edit_type() == v, "{l}" }
                                 }
                             }
                         }
@@ -257,7 +257,7 @@ pub fn TargetsPage() -> Element {
                                     value: "{e_kind}",
                                     oninput: move |e| e_kind.set(e.value()),
                                     for (v, l) in ARTIFACT_KINDS.iter().copied() {
-                                        option { value: "{v}", "{l}" }
+                                        option { value: "{v}", selected: e_kind() == v, "{l}" }
                                     }
                                 }
                             }

docs/.vitepress/config.mts

@@ -20,6 +20,7 @@ export default withMermaid(defineConfig({
           { text: 'Getting Started', link: '/guide/getting-started' },
           { text: 'Adding Repositories', link: '/guide/repositories' },
           { text: 'Running Scans', link: '/guide/scanning' },
+          { text: 'PLC / SPS (CODESYS)', link: '/guide/plc' },
           { text: 'Understanding Findings', link: '/guide/findings' },
           { text: 'SBOM & Licenses', link: '/guide/sbom' },
           { text: 'Issues & Tracking', link: '/guide/issues' },
@@ -43,6 +44,7 @@ export default withMermaid(defineConfig({
         items: [
           { text: 'Glossary', link: '/reference/glossary' },
           { text: 'Tools & Scanners', link: '/reference/tools' },
+          { text: 'PLC Runtime Landscape', link: '/reference/plc-runtimes' },
         ],
       },
     ],

docs/guide/plc.md

@@ -0,0 +1,163 @@
+# PLC / SPS Projects (CODESYS)
+
+Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such
+as CODESYS projects. A single PLC/SPS target is treated as a **composite device**:
+the control application *and* the device it runs on.
+
+| What you provide | What Certifai does |
+| --- | --- |
+| PLC project (PLCopen XML / ST, or a `.projectarchive`) | **Control-logic SAST** — semantic security rules over ST **and** graphical FBD/LD |
+| A `.projectarchive` | **Control-app SBOM** — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
+| A device firmware image | Firmware SBOM / CVE (opt-in) |
+| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
+
+## Anatomy: a soft PLC is a SoC + Linux + runtime
+
+A CODESYS controller is **not** a monolithic appliance like a classic Siemens
+S7. It is **PC-based ("soft") control** — commodity silicon running a
+general-purpose Linux, with a **software PLC runtime** as just another process:
+
+| Classic PLC (e.g. Siemens S7) | Soft PLC (CODESYS-on-Yocto, OpenPLC-on-Raspbian) |
+| --- | --- |
+| Proprietary hardware + firmware | Commodity SoC (x86 / ARM) |
+| Proprietary OS | General-purpose Linux (a **Yocto** image, or Raspbian) |
+| Proprietary runtime | Software runtime (**CODESYS Control**, or OpenPLC) |
+| STEP7 / TIA project | IEC 61131-3 control app (ST / LD / FBD / SFC) |
+
+Because of this, the device is built along **two independent tracks**, by
+different people, on different timelines, and shipped separately. It also
+inherits the **entire Linux / IT attack surface on top of** the OT / control
+one — which is exactly why a PLC/SPS target is treated as a **composite**:
+Certifai ingests one artifact per layer and scans each with the right pipeline.
+
+```mermaid
+flowchart TB
+    subgraph TA["Track A · Device platform — built by the hardware OEM / vendor"]
+        direction LR
+        A1["Yocto / OpenEmbedded<br/>BSP + RT kernel"] --> A2["Bake in the CODESYS<br/>Control for Linux runtime"] --> A3["bitbake → device image<br/>.wic / .tar + manifest"]
+    end
+    subgraph TB2["Track B · Control application — built by the machine builder / customer"]
+        direction LR
+        B1["CODESYS IDE<br/>ST / LD / FBD / SFC + WebVisu"] --> B2["Reference CODESYS +<br/>vendor libraries"] --> B3["Compile → download<br/>to device (gateway 11740)"]
+    end
+
+    A3 --> DEV(["Running soft-PLC device<br/>SoC + Linux + runtime + control app<br/>Modbus · OPC UA · EtherNet/IP · WebVisu"])
+    B3 --> DEV
+
+    subgraph CERT["What Certifai scans — one layer per artifact"]
+        direction LR
+        S1["Firmware layer<br/>FirmwareStatic · SBOM · CVE"]
+        S2["Control-logic layer<br/>PLC SAST — ST + FBD/LD"]
+        S3["Control-app SBOM<br/>libraries + runtime → CVE"]
+        S4["Running layer<br/>ICS probe · DAST (WebVisu)"]
+    end
+
+    A3 -. firmware image .-> S1
+    B1 -. PLCopen XML / ST via git .-> S2
+    B2 -. projectarchive (zip) .-> S3
+    DEV -. live URL / provisioned .-> S4
+
+    classDef yocto fill:#fde68a,stroke:#b45309,color:#111
+    classDef codesys fill:#bfdbfe,stroke:#1d4ed8,color:#111
+    classDef dev fill:#e9d5ff,stroke:#7e22ce,color:#111
+    classDef cert fill:#bbf7d0,stroke:#15803d,color:#111
+    class A1,A2,A3 yocto
+    class B1,B2,B3 codesys
+    class DEV dev
+    class S1,S2,S3,S4 cert
+```
+
+::: tip Where Yocto fits
+Yocto is **Track A** — the *build system* for the device platform. It produces
+the Linux image and bakes in the CODESYS runtime, so it is the **firmware
+layer**, entirely separate from the control application. Hand it to Certifai as
+its own **firmware image** artifact (scanned by the firmware pipeline, not the
+PLC pipeline). The device OS need not be Yocto — Raspbian/Debian/Buildroot, or
+even an RTOS / bare-metal, are all possible — but Yocto is the common,
+product-grade industrial choice.
+:::
+
+## Two ways to deliver the project
+
+You can either **upload** the project when onboarding, or point Certifai at a
+**git repository** (recommended — every scan is just a `git pull`, no re-upload).
+
+### Option A — Upload
+
+On the onboarding wizard, choose target type **PLC / SPS**, then attach a **PLC
+project** artifact and pick its format:
+
+- **PLCopen XML** (`.xml`) — export from CODESYS via *Project → Export PLCopenXML*.
+- **Structured Text** (`.st`) — a raw ST file.
+- **Project archive** (`.projectarchive`) — *File → Project Archive → Save/Send
+  Archive…* with **"Referenced libraries"** ticked. This is the only form that
+  also yields the **library + runtime SBOM**.
+
+### Option B — Git repository (recommended)
+
+Attach a **Git repository** artifact to the PLC/SPS target. Certifai clones it and
+runs the control-logic scan over the exported source in the repo.
+
+## Best-case git repository layout
+
+Because the binary `.project` does not diff or merge in git, commit **textual
+exports** for review-friendly SAST, and include the **`.projectarchive`** so the
+library/runtime SBOM is available too:
+
+```text
+my-plc-project/
+├── src/
+│   ├── PLC_PRG.xml          # PLCopen XML export (ST or FBD/LD) — one per POU
+│   ├── PumpController.xml
+│   ├── SafetyInterlock.xml
+│   └── GVL.xml              # global variable lists, also as PLCopen XML
+├── PumpStation.projectarchive   # optional but recommended → library + runtime SBOM
+└── README.md
+```
+
+**Guidelines**
+
+- **Export to PLCopen XML** (`Project → Export PLCopenXML`), one file per POU, and
+  commit those. ST, **and graphical FBD/LD**, are both analyzed.
+- Alternatively commit raw `.st` / `.exp` / `.scl` files — also analyzed.
+- **Do not** commit only the binary `.project` — it cannot be parsed (and does not
+  diff). If you want the library SBOM, commit the **`.projectarchive`** as well.
+- CODESYS's built-in Git integration, which stores an exported representation,
+  works too — as long as the committed form is PLCopen XML / textual.
+
+::: tip What unlocks what
+- **Control-logic SAST** needs textual source in the repo (PLCopen XML or `.st`).
+- **Library + runtime SBOM** needs a **`.projectarchive`** — PLCopen XML exports do
+  **not** carry the referenced libraries.
+:::
+
+## What the scanner finds
+
+The control-logic rules are CWE-mapped and include: hardcoded credentials
+(CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass
+(CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369,
+guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports
+(CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
+
+The **SBOM** view lists the CODESYS libraries (`pkg:codesys/<name>@<version>`) and
+the runtime; matching runtime components (e.g. the `Cmp*` / `3SLicense` libraries)
+surface real CODESYS advisories as CVE alerts.
+
+## Dynamic testing — ICS protocol probe
+
+Beyond the static analysis, Certifai can **probe the running device** over
+industrial protocols. Attach a **Live URL** artifact (the device host / WebVisu
+URL) to the PLC/SPS target and enable the **ICS Probe** scan.
+
+The probe is **read-only** — it never writes to the live process. It currently
+speaks **Modbus/TCP** (port 502): it confirms whether the device answers
+unauthenticated Modbus requests and reads its device identity (vendor / product /
+revision). Because Modbus/TCP has no authentication or encryption in the protocol,
+a reachable endpoint that answers is reported as an exposed control interface
+(CWE-306). OPC UA and EtherNet/IP probes are planned.
+
+::: warning
+The ICS probe connects to the live device. It is **opt-in** (off by default) and
+should only be run against targets you are authorized to test. It performs reads
+only, never writes.
+:::

docs/reference/plc-runtimes.md

@@ -0,0 +1,97 @@
+# PLC Runtime Landscape & Support
+
+A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app**
+(see [PLC / SPS Projects](/guide/plc)).
+The **runtime** is what defines the device — it provides the IEC engine, the
+Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
+runtime ecosystems Certifai may encounter.
+
+We do **not** aim to support every runtime up front. Certifai supports the
+**CODESYS family** today; everything else is a **watch-list** — when a customer
+shows up using one, we add the parser/support for it then. The dynamic OT probe
+(Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of
+the runtime.
+
+## Support status
+
+| Status | Meaning |
+| --- | --- |
+| ✅ **Supported** | Static analysis works today (control-logic SAST + library/runtime SBOM + CVE). |
+| 🟡 **Covered via CODESYS** | A rebranded CODESYS runtime — our CODESYS parsing applies (may need minor per-vendor tweaks). |
+| 🔭 **Watch-list** | Own project format — we add a format parser when a customer needs it. The dynamic OT probe already applies. |
+| 🧪 **Test-bench** | A free runtime we use to *reconstruct and dynamically test* a device (see epic: provision-and-test). |
+
+## 1. CODESYS and rebranded CODESYS (the largest slice)
+
+Much of the market licenses the CODESYS runtime and rebrands the IDE. If a
+customer "doesn't use CODESYS", they often do — under another name.
+
+| Product / vendor | Based on | Status |
+| --- | --- | --- |
+| **CODESYS** (3S-Smart Software Solutions) | CODESYS | ✅ Supported |
+| Schneider **EcoStruxure Machine Expert** (ex-SoMachine) | CODESYS | 🟡 Covered via CODESYS |
+| **WAGO** e!COCKPIT / PFC controllers | CODESYS | 🟡 Covered via CODESYS |
+| **ABB** AC500 / Automation Builder | CODESYS | 🟡 Covered via CODESYS |
+| **Bosch Rexroth** ctrlX / IndraLogic | CODESYS | 🟡 Covered via CODESYS |
+| **Eaton** XSoft-CODESYS, **KEBA** KeStudio, Berghof, Kontron, Festo (CPX-E), IFM, Turck, … | CODESYS | 🟡 Covered via CODESYS |
+
+## 2. Other embeddable IEC 61131-3 runtime toolkits
+
+Same model as CODESYS (an OEM licenses a runtime + IDE and bakes it into a
+device), but with **different project formats and libraries**.
+
+| Toolkit | Vendor | Status |
+| --- | --- | --- |
+| **ProConOS / MULTIPROG** | Phoenix Contact / KW-Software | 🔭 Watch-list |
+| **ISaGRAF** (also does IEC 61499) | Rockwell | 🔭 Watch-list |
+| **straton** | COPA-DATA | 🔭 Watch-list |
+| **logi.CAD** | logi.cals | 🔭 Watch-list |
+
+## 3. Fully proprietary ecosystems (own runtime + IDE + protocols)
+
+Static analysis here needs a **per-vendor project parser**; the **dynamic OT
+probe still works** (they speak Modbus / OPC UA / EtherNet/IP, plus vendor
+protocols like S7comm / CIP).
+
+| Ecosystem | Vendor | Notes | Status |
+| --- | --- | --- | --- |
+| **TIA Portal / STEP 7** (S7-1200/1500), S7-1500 **Software Controller**, **Virtual PLC** | Siemens | Largest install base; the soft/virtual variants are Linux/container | 🔭 Watch-list |
+| **Studio 5000** (ControlLogix / CompactLogix) | Rockwell / Allen-Bradley | Strong in North America | 🔭 Watch-list |
+| **TwinCAT 3** | Beckhoff | Genuine PC-based control on Windows / TwinCAT-BSD; IEC 61131-3 **+ C++ + Simulink** | 🔭 Watch-list |
+| **Automation Studio** | B&R (ABB) | Own Automation Runtime | 🔭 Watch-list |
+| **GX Works** (MELSEC) | Mitsubishi | | 🔭 Watch-list |
+| **Sysmac Studio** (NX / NJ) | Omron | | 🔭 Watch-list |
+| **Proficy Machine Edition** (PACSystems) | Emerson / GE | | 🔭 Watch-list |
+
+## 4. Linux-native / containerized soft-PLC (the direction of travel)
+
+| Product | Vendor | Notes | Status |
+| --- | --- | --- | --- |
+| **PLCnext** | Phoenix Contact | Open, Linux-based; native runtime is eCLR (not CODESYS), but can also run CODESYS as an app | 🔭 Watch-list |
+| **ctrlX** | Bosch Rexroth | Ubuntu-core, app-store model (CODESYS runtime inside) | 🟡 Covered via CODESYS |
+| **Virtual PLC** / **CODESYS Virtual Control** | Siemens / CODESYS | Containerized PLCs (Docker / K8s) | 🟡 / 🔭 |
+
+## 5. Open-source runtimes (free — our test-bench substrates)
+
+Used to **reconstruct and dynamically test** a customer device without touching
+their network (provision-and-test).
+
+| Runtime | Standard | Notes | Status |
+| --- | --- | --- | --- |
+| **OpenPLC** | IEC 61131-3 | Modbus-centric, education/small automation; uses MatIEC | 🧪 Test-bench (current) |
+| **Beremiz + MatIEC** | IEC 61131-3 | Fuller open-source IDE; compiles ST/IL → C. Natural fidelity step-up from OpenPLC | 🧪 Test-bench (candidate) |
+| **Eclipse 4diac (FORTE)** | IEC **61499** | Distributed, event-driven — a *different paradigm* from 61131-3's scan cycle | 🔭 Watch-list |
+| **ProView** | — | Open-source process control + SCADA | 🔭 Watch-list |
+
+## How we add support for a new runtime
+
+- **Static (SAST / SBOM):** needs a parser for that runtime's **project format**
+  (and its library/package convention). This is the per-vendor work.
+- **Dynamic (ICS probe / DAST):** already **vendor-agnostic** — it targets the
+  device's OT ports and WebVisu, not the runtime's file format. So a brand-new
+  ecosystem still gets dynamic coverage on day one.
+
+::: tip Rule of thumb
+Confirm whether a "non-CODESYS" controller is actually a **rebranded CODESYS**
+runtime (Section 1) before assuming new work — most of the long tail is.
+:::

examples/plc-demo/pump_fbd.xml

@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Function Block Diagram (FBD) POU in PLCopen TC6 XML form. Demonstrates that
+     the scanner analyses graphical logic, not just Structured Text: the same
+     defects (cleartext Modbus master on 502, a hardcoded HMI password, a safety
+     enable driven FALSE) are here wired as blocks and in/out variables. -->
+<project xmlns="http://www.plcopen.org/xml/tc6_0201">
+  <types>
+    <pous>
+      <pou name="PumpFbdCtrl" pouType="functionBlock">
+        <interface>
+          <inputVars>
+            <variable name="HmiPassword"><type><string/></type></variable>
+            <variable name="Safety_Enable"><type><BOOL/></type></variable>
+            <variable name="ServerIp"><type><string/></type></variable>
+          </inputVars>
+        </interface>
+        <body>
+          <FBD>
+            <!-- Modbus/TCP master: cleartext (AUTH := FALSE) on port 502 -->
+            <inVariable localId="1"><expression>'10.20.0.5'</expression><connectionPointOut/></inVariable>
+            <inVariable localId="2"><expression>502</expression><connectionPointOut/></inVariable>
+            <inVariable localId="3"><expression>FALSE</expression><connectionPointOut/></inVariable>
+            <block localId="10" typeName="Modbus_TCP_Master">
+              <inputVariables>
+                <variable formalParameter="IP">
+                  <connectionPointIn><connection refLocalId="1"/></connectionPointIn>
+                </variable>
+                <variable formalParameter="PORT">
+                  <connectionPointIn><connection refLocalId="2"/></connectionPointIn>
+                </variable>
+                <variable formalParameter="AUTH">
+                  <connectionPointIn><connection refLocalId="3"/></connectionPointIn>
+                </variable>
+              </inputVariables>
+              <outputVariables/>
+            </block>
+
+            <!-- Hardcoded HMI password wired into an output -->
+            <inVariable localId="20"><expression>'admin123'</expression><connectionPointOut/></inVariable>
+            <outVariable localId="21">
+              <expression>HmiPassword</expression>
+              <connectionPointIn><connection refLocalId="20"/></connectionPointIn>
+            </outVariable>
+
+            <!-- Safety enable driven FALSE in logic -->
+            <inVariable localId="30"><expression>FALSE</expression><connectionPointOut/></inVariable>
+            <outVariable localId="31">
+              <expression>Safety_Enable</expression>
+              <connectionPointIn><connection refLocalId="30"/></connectionPointIn>
+            </outVariable>
+          </FBD>
+        </body>
+      </pou>
+    </pous>
+  </types>
+</project>