fix(semgrep): extract CWE from list-form metadata (was always null)

semgrep emits metadata.cwe as a LIST (e.g. "CWE-798: Use of Hard-coded
Credentials"), but the extractor called v.as_str() on it -> always None, so SAST
findings never carried a CWE at all (silently breaking control mapping AND the
CWE-based dedup). Handle list + bare-string forms and normalise to the CWE-NNN
id. Found by the live control-triage end-to-end test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/src/api/handlers/oscal.rs

@@ -1,9 +1,9 @@
 //! OSCAL assessment endpoint.
 //!
-//! Returns a standard OSCAL assessment-results document for a target's findings,
-//! driven by each finding's stamped `control_refs` (from the scan's control-triage
-//! stage): mapped findings target their controls, unmapped findings are reported
-//! as-is. See `compliance_core::models::oscal_assessment`.
+//! Assesses a target's findings against the breakpilot-compliance control
+//! catalog and returns a standard OSCAL assessment-results document. Ties
+//! together the ingest provider ([`OscalControlsProvider`]) and the assessment
+//! emitter (`compliance_core::models::oscal_assessment`).
 
 use axum::extract::Extension;
 use axum::http::StatusCode;
@@ -12,24 +12,45 @@ use axum::Json;
 use mongodb::bson::doc;
 use serde::Deserialize;
 
-use compliance_core::models::oscal_assessment::assess;
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::models::oscal_assessment::{assess, ControlLinker};
 use compliance_core::models::Finding;
 use compliance_core::tenant_ctx::TenantCtx;
 
 use super::dto::{collect_cursor_async, tenant_db, AgentExt};
+use crate::controls::OscalControlsProvider;
 
 #[derive(Debug, Deserialize)]
 pub struct AssessRequest {
     /// The target / repo id whose findings are assessed.
     pub target_id: String,
+    /// Frameworks to assess against; defaults to `[Cra]` when empty.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
 }
 
-/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
+/// `POST /api/v1/oscal/assess` — pull the catalog(s), load the target's findings,
+/// and emit an OSCAL assessment-results document linking findings to controls.
 pub async fn assess_target(
     Extension(agent): AgentExt,
     tenant: TenantCtx,
     Json(req): Json<AssessRequest>,
 ) -> Response {
+    let cfg = &agent.config.breakpilot;
+    let Some(base_url) = cfg.base_url.clone() else {
+        return (
+            StatusCode::SERVICE_UNAVAILABLE,
+            "breakpilot base URL not configured (set BREAKPILOT_BASE_URL)",
+        )
+            .into_response();
+    };
+
+    let frameworks = if req.frameworks.is_empty() {
+        vec![ComplianceFramework::Cra]
+    } else {
+        req.frameworks.clone()
+    };
+
     let db = match tenant_db(&agent, &tenant).await {
         Ok(db) => db,
         Err(code) => return code.into_response(),
@@ -44,5 +65,25 @@ pub async fn assess_target(
         }
     };
 
-    Json(assess(&findings, chrono::Utc::now())).into_response()
+    let provider = OscalControlsProvider::new(
+        agent.http.clone(),
+        base_url,
+        cfg.token.clone(),
+        &cfg.snapshot_dir,
+    );
+    let mut controls = Vec::new();
+    for framework in &frameworks {
+        match provider.load(*framework).await {
+            Ok(document) => controls.extend(document.to_controls()),
+            Err(e) => tracing::warn!(?framework, error = %e, "OSCAL catalog load failed"),
+        }
+    }
+
+    let assessment = assess(
+        &controls,
+        &findings,
+        &ControlLinker::cra_seed(),
+        chrono::Utc::now(),
+    );
+    Json(assessment).into_response()
 }

compliance-agent/src/controls/index.rs

@@ -1,110 +0,0 @@
-//! In-memory embedding index over the control corpus, for region → control
-//! retrieval.
-//!
-//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
-//! controls carry none), so we map by *similarity*: embed each control's
-//! requirement text once, then for a code region pull the top-K nearest controls
-//! to hand to the grounded judge. This is the retrieval half of the semantic path.
-
-use compliance_core::control_check::ControlCheckSpec;
-use compliance_core::error::CoreError;
-
-use crate::llm::LlmClient;
-
-/// A control spec paired with its requirement-text embedding.
-pub struct ControlIndex {
-    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
-}
-
-impl ControlIndex {
-    /// Build directly from precomputed embeddings (used by tests + callers that
-    /// already embedded the corpus).
-    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
-        Self { entries }
-    }
-
-    /// Build by embedding each control's requirement text.
-    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
-        if specs.is_empty() {
-            return Ok(Self {
-                entries: Vec::new(),
-            });
-        }
-        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
-        let embeddings = llm
-            .embed(texts)
-            .await
-            .map_err(|e| CoreError::Llm(e.to_string()))?;
-        Ok(Self {
-            entries: specs.into_iter().zip(embeddings).collect(),
-        })
-    }
-
-    pub fn len(&self) -> usize {
-        self.entries.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.entries.is_empty()
-    }
-
-    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
-    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
-        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
-            .entries
-            .iter()
-            .map(|(spec, emb)| (cosine(query, emb), spec))
-            .collect();
-        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
-        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
-    }
-}
-
-/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
-fn cosine(a: &[f64], b: &[f64]) -> f64 {
-    if a.len() != b.len() || a.is_empty() {
-        return 0.0;
-    }
-    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
-    let na: f64 = a.iter().map(|x| x * x).sum();
-    let nb: f64 = b.iter().map(|x| x * x).sum();
-    if na == 0.0 || nb == 0.0 {
-        return 0.0;
-    }
-    dot / (na.sqrt() * nb.sqrt())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[test]
-    fn nearest_ranks_by_cosine() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-            (spec("c"), vec![0.7, 0.7]),
-        ]);
-        let hits = index.nearest(&[0.9, 0.1], 2);
-        assert_eq!(hits.len(), 2);
-        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
-    }
-
-    #[test]
-    fn cosine_edges_are_zero() {
-        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
-        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
-        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
-    }
-}

compliance-agent/src/controls/mod.rs

@@ -6,17 +6,13 @@
 //! and snapshots it locally.
 
 mod checker;
-mod index;
 mod judge;
 mod oscal_provider;
 mod scan_triage;
-mod semantic;
 mod triage;
 
 pub use checker::GroundedControlChecker;
-pub use index::ControlIndex;
 pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
 pub use oscal_provider::OscalControlsProvider;
-pub use scan_triage::{semantic_stamp_findings, triage_repo_findings};
-pub use semantic::SemanticControlChecker;
+pub use scan_triage::triage_repo_findings;
 pub use triage::{ControlTriage, TriageOutcome};

compliance-agent/src/controls/oscal_provider.rs

@@ -43,20 +43,20 @@ impl OscalControlsProvider {
         }
     }
 
-    fn catalog_url(&self, framework: &str) -> String {
+    fn catalog_url(&self, framework: ComplianceFramework) -> String {
         format!(
             "{}/api/compliance/v1/oscal/catalog?framework={framework}",
             self.base_url.trim_end_matches('/')
         )
     }
 
-    fn snapshot_path(&self, framework: &str) -> PathBuf {
+    fn snapshot_path(&self, framework: ComplianceFramework) -> PathBuf {
         self.snapshot_dir
             .join(format!("oscal-catalog-{framework}.json"))
     }
 
-    /// Fetch the raw catalog bytes for a framework token over HTTP.
-    async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
+    /// Fetch the raw catalog bytes for a framework over HTTP.
+    async fn fetch_raw(&self, framework: ComplianceFramework) -> Result<Vec<u8>, CoreError> {
         let mut req = self.http.get(self.catalog_url(framework));
         if let Some(token) = &self.token {
             req = req.bearer_auth(token.expose_secret());
@@ -78,7 +78,11 @@ impl OscalControlsProvider {
     }
 
     /// Write a catalog snapshot atomically (temp file + rename).
-    async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
+    async fn write_snapshot(
+        &self,
+        framework: ComplianceFramework,
+        raw: &[u8],
+    ) -> Result<(), CoreError> {
         tokio::fs::create_dir_all(&self.snapshot_dir).await?;
         let path = self.snapshot_path(framework);
         let tmp = path.with_extension("json.tmp");
@@ -88,7 +92,10 @@ impl OscalControlsProvider {
     }
 
     /// Read a previously written snapshot, if one exists.
-    async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
+    async fn read_snapshot(
+        &self,
+        framework: ComplianceFramework,
+    ) -> Result<Option<OscalDocument>, CoreError> {
         match tokio::fs::read(self.snapshot_path(framework)).await {
             Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
             Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
@@ -96,21 +103,21 @@ impl OscalControlsProvider {
         }
     }
 
-    /// Load the catalog for a framework token: fetch fresh + snapshot the exact
-    /// bytes; on network failure, fall back to the last snapshot so scans run.
-    async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
+    /// Load the catalog for a framework: fetch fresh + snapshot the exact bytes;
+    /// on network failure, fall back to the last snapshot so scans still run.
+    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
         match self.fetch_raw(framework).await {
             Ok(raw) => {
                 let doc: OscalDocument = serde_json::from_slice(&raw)?;
                 if let Err(e) = self.write_snapshot(framework, &raw).await {
-                    tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
+                    tracing::warn!(%framework, error = %e, "failed to write OSCAL snapshot");
                 }
                 Ok(doc)
             }
             Err(fetch_err) => match self.read_snapshot(framework).await? {
                 Some(doc) => {
                     tracing::warn!(
-                        framework, error = %fetch_err,
+                        %framework, error = %fetch_err,
                         "OSCAL catalog fetch failed; falling back to snapshot"
                     );
                     Ok(doc)
@@ -119,17 +126,6 @@ impl OscalControlsProvider {
             },
         }
     }
-
-    /// Load the OSCAL catalog for a compliance framework.
-    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
-        self.load_token(&framework.to_string()).await
-    }
-
-    /// Load the code-checkable master-controls catalog
-    /// (`?framework=master-controls`).
-    pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
-        self.load_token("master-controls").await
-    }
 }
 
 /// Order controls whose title/text mention the query context first (stable), then
@@ -185,11 +181,11 @@ mod tests {
     fn builds_catalog_url_and_snapshot_path() {
         let p = provider(std::path::Path::new("/snap"));
         assert_eq!(
-            p.catalog_url("cra"),
+            p.catalog_url(ComplianceFramework::Cra),
             "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
         );
         assert_eq!(
-            p.snapshot_path("cra"),
+            p.snapshot_path(ComplianceFramework::Cra),
             std::path::Path::new("/snap/oscal-catalog-cra.json")
         );
     }
@@ -217,11 +213,19 @@ mod tests {
     async fn snapshot_round_trip_and_offline_fallback() {
         let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
         let p = provider(&dir);
-        assert!(p.read_snapshot("cra").await.unwrap().is_none());
-        p.write_snapshot("cra", MINI_CATALOG.as_bytes())
+        assert!(p
+            .read_snapshot(ComplianceFramework::Cra)
+            .await
+            .unwrap()
+            .is_none());
+        p.write_snapshot(ComplianceFramework::Cra, MINI_CATALOG.as_bytes())
             .await
             .unwrap();
-        let doc = p.read_snapshot("cra").await.unwrap().unwrap();
+        let doc = p
+            .read_snapshot(ComplianceFramework::Cra)
+            .await
+            .unwrap()
+            .unwrap();
         assert_eq!(doc.to_controls().len(), 1);
         assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
         let _ = std::fs::remove_dir_all(&dir);

compliance-agent/src/controls/scan_triage.rs

@@ -16,15 +16,9 @@ use compliance_core::models::onboarding::ComplianceFramework;
 use compliance_core::AgentConfig;
 use control_map::ControlMap;
 
-use super::{
-    ControlIndex, ControlTriage, LlmControlJudge, OscalControlsProvider, SemanticControlChecker,
-    TriageOutcome,
-};
+use super::{ControlTriage, LlmControlJudge, OscalControlsProvider, TriageOutcome};
 use crate::llm::LlmClient;
 
-/// Nearest master controls judged per code region in the semantic pass.
-const SEMANTIC_TOP_K: usize = 5;
-
 /// Lines of context to read on each side of a finding's line.
 const REGION_WINDOW: usize = 6;
 
@@ -122,103 +116,6 @@ fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegi
     })
 }
 
-/// Master-controls **semantic** pass: for each finding's code region, retrieve the
-/// top-K nearest master controls by embedding, have the grounded judge confirm,
-/// and stamp the confirmed control ids onto the finding — the scale path for the
-/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
-/// of findings that gained a master-control ref.
-///
-/// Opt-in: the orchestrator does not run this yet. It builds the control embedding
-/// index per call (embeds the whole corpus) — production should cache/persist that
-/// index rather than rebuild it each scan.
-pub async fn semantic_stamp_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0;
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let doc = match provider.load_master_controls().await {
-        Ok(d) => d,
-        Err(e) => {
-            tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
-            return 0;
-        }
-    };
-    let specs: Vec<ControlCheckSpec> = doc
-        .to_controls()
-        .into_iter()
-        .map(|c| ControlCheckSpec {
-            control_id: c.id,
-            title: c.title,
-            requirement: c.text,
-            default_cwe: None,
-            severity: Severity::Medium,
-        })
-        .collect();
-    let index = match ControlIndex::build(&llm, specs).await {
-        Ok(i) if !i.is_empty() => i,
-        Ok(_) => return 0,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to embed master-controls corpus");
-            return 0;
-        }
-    };
-    let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        if finding.status == FindingStatus::FalsePositive {
-            continue;
-        }
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        let region_emb = match llm.embed(vec![region.content.clone()]).await {
-            Ok(mut embs) => match embs.pop() {
-                Some(v) => v,
-                None => continue,
-            },
-            Err(e) => {
-                tracing::warn!(error = %e, "region embed failed; skipping finding");
-                continue;
-            }
-        };
-        let confirmed = checker
-            .check(
-                &index,
-                &region,
-                &region_emb,
-                SEMANTIC_TOP_K,
-                &finding.repo_id,
-            )
-            .await;
-        let before = finding.control_refs.len();
-        for f in confirmed {
-            for cref in f.control_refs {
-                if !finding.control_refs.contains(&cref) {
-                    finding.control_refs.push(cref);
-                }
-            }
-        }
-        if finding.control_refs.len() > before {
-            tagged += 1;
-        }
-    }
-    tagged
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

compliance-agent/src/controls/semantic.rs

@@ -1,119 +0,0 @@
-//! Semantic control mapping: retrieve the top-K controls nearest a code region,
-//! then confirm each with the grounded judge.
-//!
-//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
-//! what scales to the full master-control corpus: the LLM only ever judges a
-//! handful of retrieved candidates, and every surviving verdict is still anchored
-//! to real code by the grounding gate.
-
-use compliance_core::control_check::{ground, CandidateRegion};
-use compliance_core::models::Finding;
-
-use super::index::ControlIndex;
-use super::judge::ControlJudge;
-
-/// Retrieve → judge → ground, generic over the judge so tests use a stub.
-pub struct SemanticControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> SemanticControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Map a code region to the controls it violates. `region_embedding` is the
-    /// region's embedding (the caller computes it via the LLM); the top-`k`
-    /// nearest controls in `index` are judged and grounded.
-    pub async fn check(
-        &self,
-        index: &ControlIndex,
-        region: &CandidateRegion,
-        region_embedding: &[f64],
-        k: usize,
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let candidates = index.nearest(region_embedding, k);
-        let mut findings = Vec::new();
-        for spec in &candidates {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
-    use compliance_core::models::finding::Severity;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[tokio::test]
-    async fn retrieves_then_grounds_the_nearest_control() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("mc-near"), vec![1.0, 0.0]),
-            (spec("mc-far"), vec![0.0, 1.0]),
-        ]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin\"\n".into(),
-        };
-        // Query embedding nearest to mc-near; k=1 → only mc-near is judged.
-        let findings = checker
-            .check(&index, &region, &[0.95, 0.05], 1, "repo")
-            .await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
-    }
-
-    #[tokio::test]
-    async fn ungrounded_verdict_is_dropped() {
-        let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "not in the region".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "f".into(),
-            start_line: 1,
-            content: "real code\n".into(),
-        };
-        let findings = checker.check(&index, &region, &[1.0, 0.0], 1, "repo").await;
-        assert!(findings.is_empty());
-    }
-}

compliance-core/src/models/oscal_assessment.rs

@@ -15,7 +15,8 @@ use chrono::{DateTime, Utc};
 use serde::Serialize;
 use uuid::Uuid;
 
-use crate::models::finding::{Finding, FindingStatus};
+use crate::models::finding::Finding;
+use crate::traits::Control;
 
 const OSCAL_VERSION: &str = "1.1.2";
 /// Same namespace as the catalog exporter, so ids are stable and correlatable.
@@ -82,23 +83,22 @@ impl ControlLinker {
     }
 }
 
-/// Build a standard OSCAL assessment-results document from `findings`, using each
-/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
-/// finding is emitted as an observation — mapped findings additionally produce a
-/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
-/// (an observation carrying their CWE/tool/severity, with no control target) so
-/// nothing is lost. `at` is the assessment timestamp.
-pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
+/// Assess `findings` against `controls`: link findings to control-ids and build a
+/// standard OSCAL assessment-results document. `at` is the assessment timestamp.
+pub fn assess(
+    controls: &[Control],
+    findings: &[Finding],
+    linker: &ControlLinker,
+    at: DateTime<Utc>,
+) -> AssessmentResultsDoc {
     let ts = at.to_rfc3339();
 
     let mut observations = Vec::new();
     let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
-    let mut mapped = 0usize;
-    let mut unmapped = 0usize;
-
     for finding in findings {
-        if finding.status == FindingStatus::FalsePositive {
-            continue; // flagged tool false positive — excluded from the report
+        let targets = linker.controls_for(finding);
+        if targets.is_empty() {
+            continue;
         }
         let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
         let location = match (&finding.file_path, finding.line_number) {
@@ -106,47 +106,37 @@ pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
             (Some(f), None) => Some(f.clone()),
             _ => None,
         };
-        let is_mapped = !finding.control_refs.is_empty();
-        if is_mapped {
-            mapped += 1;
-        } else {
-            unmapped += 1;
-        }
-        let mut props = vec![
-            ObsProp::new("tool", &finding.scanner),
-            ObsProp::new("severity", &finding.severity.to_string()),
-            ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
-        ];
-        if let Some(cwe) = &finding.cwe {
-            props.push(ObsProp::new("cwe", cwe));
-        }
         observations.push(Observation {
             uuid: obs_uuid.clone(),
-            title: finding.title.clone(),
-            description: finding.description.clone(),
+            description: finding.title.clone(),
             methods: vec!["TEST".to_string()],
             collected: ts.clone(),
-            props,
             relevant_evidence: vec![RelevantEvidence {
                 href: location.map(|l| format!("file://{l}")),
                 description: format!("[{}] {}", finding.scanner, finding.title),
             }],
         });
-        for control_id in &finding.control_refs {
+        for control_id in targets {
             obs_by_control
-                .entry(control_id.clone())
+                .entry(control_id)
                 .or_default()
                 .push(obs_uuid.clone());
         }
     }
 
+    let titles: HashMap<&str, &str> = controls
+        .iter()
+        .map(|c| (c.id.as_str(), c.title.as_str()))
+        .collect();
     let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
     hit_controls.sort();
     let ar_findings: Vec<ArFinding> = hit_controls
-        .iter()
-        .map(|control_id| ArFinding {
+        .into_iter()
+        .map(|control_id| {
+            let title = titles.get(control_id.as_str()).copied().unwrap_or("");
+            ArFinding {
                 uuid: det_uuid(&format!("finding:{control_id}")),
-            title: format!("Findings affect {control_id}"),
+                title: format!("Findings affect {control_id}: {title}"),
                 target: FindingTarget {
                     target_type: "statement-id".to_string(),
                     target_id: format!("{control_id}_smt"),
@@ -154,19 +144,20 @@ pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
                         state: "not-satisfied".to_string(),
                     },
                 },
-            related_observations: obs_by_control[*control_id]
+                related_observations: obs_by_control[control_id]
                     .iter()
                     .map(|u| RelatedObservation {
                         observation_uuid: u.clone(),
                     })
                     .collect(),
+            }
         })
         .collect();
 
-    let include_controls: Vec<SelectControlById> = hit_controls
+    let include_controls = controls
         .iter()
         .map(|c| SelectControlById {
-            control_id: (*c).clone(),
+            control_id: c.id.clone(),
         })
         .collect();
 
@@ -174,9 +165,9 @@ pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
         uuid: det_uuid("result:cra"),
         title: "Automated code-compliance assessment".to_string(),
         description: format!(
-            "{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
+            "{} finding-linked observation(s) across {} reviewed control(s)",
             observations.len(),
-            include_controls.len()
+            controls.len()
         ),
         start: ts.clone(),
         reviewed_controls: ReviewedControls {
@@ -271,33 +262,13 @@ pub struct SelectControlById {
 #[derive(Debug, Clone, Serialize)]
 pub struct Observation {
     pub uuid: String,
-    pub title: String,
     pub description: String,
     pub methods: Vec<String>,
     pub collected: String,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub props: Vec<ObsProp>,
     #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
     pub relevant_evidence: Vec<RelevantEvidence>,
 }
 
-/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
-/// unmapped finding be reported fully as-is.
-#[derive(Debug, Clone, Serialize)]
-pub struct ObsProp {
-    pub name: String,
-    pub value: String,
-}
-
-impl ObsProp {
-    fn new(name: &str, value: &str) -> Self {
-        Self {
-            name: name.to_string(),
-            value: value.to_string(),
-        }
-    }
-}
-
 #[derive(Debug, Clone, Serialize)]
 pub struct RelevantEvidence {
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -339,9 +310,20 @@ pub struct RelatedObservation {
 mod tests {
     use super::*;
     use crate::models::finding::Severity;
+    use crate::models::onboarding::ComplianceFramework;
     use crate::models::scan::ScanType;
 
-    fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
+    fn control(id: &str, title: &str) -> Control {
+        Control {
+            id: id.into(),
+            framework: ComplianceFramework::Cra,
+            title: title.into(),
+            text: String::new(),
+            source: None,
+        }
+    }
+
+    fn finding(fp: &str, cwe: Option<&str>) -> Finding {
         let mut f = Finding::new(
             "repo".into(),
             fp.into(),
@@ -354,7 +336,6 @@ mod tests {
         f.cwe = cwe.map(Into::into);
         f.file_path = Some("src/auth.rs".into());
         f.line_number = Some(42);
-        f.control_refs = refs.iter().map(|s| s.to_string()).collect();
         f
     }
 
@@ -365,60 +346,57 @@ mod tests {
     }
 
     #[test]
-    fn mapped_finding_becomes_control_finding() {
-        let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
+    fn links_cwe_finding_to_control_not_satisfied() {
+        let controls = vec![
+            control("cra-ai-8", "No default passwords"),
+            control("cra-ai-13", "Crypto"),
+        ];
+        let findings = vec![finding("f1", Some("CWE-798"))];
+        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
         let r = &doc.assessment_results.results[0];
         assert_eq!(r.observations.len(), 1);
         assert_eq!(r.findings.len(), 1);
         assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
         assert_eq!(r.findings[0].target.status.state, "not-satisfied");
+        assert_eq!(r.findings[0].related_observations.len(), 1);
         assert_eq!(
             r.reviewed_controls.control_selections[0]
                 .include_controls
                 .len(),
-            1
+            2
         );
     }
 
     #[test]
-    fn unmapped_finding_is_reported_as_is() {
-        let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
+    fn unlinked_finding_yields_no_control_finding() {
+        let controls = vec![control("cra-ai-8", "x")];
+        let findings = vec![finding("f1", Some("CWE-99999"))];
+        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
         let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1); // still emitted...
-        assert!(r.findings.is_empty()); // ...but no control finding
-        assert!(r.reviewed_controls.control_selections[0]
-            .include_controls
-            .is_empty());
-        let props: Vec<(&str, &str)> = r.observations[0]
-            .props
-            .iter()
-            .map(|p| (p.name.as_str(), p.value.as_str()))
-            .collect();
-        assert!(props.contains(&("mapping", "unmapped")));
-        assert!(props.contains(&("cwe", "CWE-319")));
+        assert!(r.observations.is_empty());
+        assert!(r.findings.is_empty());
     }
 
     #[test]
-    fn false_positive_is_excluded() {
-        let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
-        f.status = FindingStatus::FalsePositive;
-        let doc = assess(&[f], at());
-        assert!(doc.assessment_results.results[0].observations.is_empty());
-    }
-
-    #[test]
-    fn deterministic_and_valid_oscal() {
-        let mk = || {
-            vec![
-                finding("f1", Some("CWE-798"), &["cra-ai-8"]),
-                finding("f2", Some("CWE-319"), &[]),
-            ]
-        };
-        let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
-        let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
+    fn output_is_deterministic_and_valid_oscal() {
+        let controls = vec![control("cra-ai-8", "x")];
+        let findings = vec![finding("f1", Some("798"))];
+        let a = serde_json::to_string(&assess(
+            &controls,
+            &findings,
+            &ControlLinker::cra_seed(),
+            at(),
+        ))
+        .unwrap();
+        let b = serde_json::to_string(&assess(
+            &controls,
+            &findings,
+            &ControlLinker::cra_seed(),
+            at(),
+        ))
+        .unwrap();
         assert_eq!(a, b);
         assert!(a.contains("\"oscal-version\":\"1.1.2\""));
         assert!(a.contains("\"not-satisfied\""));
-        assert!(a.contains("\"mapping\""));
     }
 }

compliance-mcp/src/server.rs

@@ -4,7 +4,7 @@ use rmcp::{
 
 use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
-use crate::tools::{dast, findings, oscal, pentest, sbom};
+use crate::tools::{dast, findings, pentest, sbom};
 
 pub struct ComplianceMcpServer {
     pool: DatabasePool,
@@ -68,17 +68,6 @@ impl ComplianceMcpServer {
         findings::findings_summary(&db, params).await
     }
 
-    #[tool(
-        description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
-    )]
-    async fn oscal_assessment(
-        &self,
-        Parameters(params): Parameters<oscal::OscalAssessmentParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        oscal::oscal_assessment(&db, params).await
-    }
-
     // ── SBOM ──────────────────────────────────────────────
 
     #[tool(

compliance-mcp/src/tools/mod.rs

@@ -1,5 +1,4 @@
 pub mod dast;
 pub mod findings;
-pub mod oscal;
 pub mod pentest;
 pub mod sbom;

compliance-mcp/src/tools/oscal.rs

@@ -1,51 +0,0 @@
-//! OSCAL assessment MCP tool.
-//!
-//! Emits a standard OSCAL assessment-results document for a repo's findings —
-//! what breakpilot's scanner MCP client pulls. Mapped findings target their
-//! compliance controls (via the stamped `control_refs`); unmapped findings are
-//! reported as-is, so nothing is lost.
-
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use compliance_core::models::oscal_assessment::assess;
-use compliance_core::models::Finding;
-
-use crate::database::Database;
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct OscalAssessmentParams {
-    /// Repository / target id to assess.
-    pub repo_id: String,
-}
-
-pub async fn oscal_assessment(
-    db: &Database,
-    params: OscalAssessmentParams,
-) -> Result<CallToolResult, McpError> {
-    let mut cursor = db
-        .findings()
-        .find(doc! { "repo_id": &params.repo_id })
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut findings: Vec<Finding> = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        findings.push(
-            cursor
-                .deserialize_current()
-                .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
-        );
-    }
-
-    let document = assess(&findings, chrono::Utc::now());
-    let json = serde_json::to_string_pretty(&document)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}