feat(agent): live OSCAL assessment endpoint POST /api/v1/oscal/assess

Wires ingest (OscalControlsProvider) + assessment (assess) behind an agent
endpoint: pulls the catalog for the target's frameworks (default CRA), loads the
target's findings from the tenant DB, and returns an OSCAL assessment-results
document linking findings to controls.

- BreakpilotConfig (base_url/token/snapshot_dir) from BREAKPILOT_* env; endpoint
  returns 503 when base_url is unset
- handlers::oscal::assess_target on the authenticated (tenant-scoped) router
- test helpers updated for the new config field

clippy -D warnings + fmt + CI test cmd (287+47+27) clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -109,8 +109,6 @@ jobs:
         run: cargo clippy -p compliance-mcp -- -D warnings
       - name: Clippy (werkbank-exec)
         run: cargo clippy -p werkbank-exec -- -D warnings
-      - name: Clippy (control-map)
-        run: cargo clippy -p control-map -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -119,8 +117,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent + werkbank-exec + control-map)
+      - name: Tests (core + agent + werkbank-exec)
-        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
+        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)

Cargo.lock

@@ -666,7 +666,6 @@ dependencies = [
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
- "control-map",
  "dashmap",
  "dotenvy",
  "futures-core",
@@ -969,15 +968,6 @@ dependencies = [
  "charset",
 ]
 
-[[package]]
-name = "control-map"
-version = "0.1.0"
-dependencies = [
- "serde",
- "serde_json",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "convert_case"
 version = "0.8.0"

Cargo.toml

@@ -8,7 +8,6 @@ members = [
     "compliance-mcp",
     "compliance-smoke",
     "werkbank-exec",
-    "control-map",
 ]
 resolver = "2"
 
@@ -18,7 +17,6 @@ expect_used = "deny"
 
 [workspace.dependencies]
 compliance-core = { path = "compliance-core", default-features = false }
-control-map = { path = "control-map" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }

compliance-agent/Cargo.toml

@@ -8,7 +8,6 @@ workspace = true
 
 [dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
-control-map = { workspace = true }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
 # Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also

compliance-agent/src/api/handlers/oscal.rs

@@ -1,9 +1,9 @@
 //! OSCAL assessment endpoint.
 //!
-//! Returns a standard OSCAL assessment-results document for a target's findings,
+//! Assesses a target's findings against the breakpilot-compliance control
-//! driven by each finding's stamped `control_refs` (from the scan's control-triage
+//! catalog and returns a standard OSCAL assessment-results document. Ties
-//! stage): mapped findings target their controls, unmapped findings are reported
+//! together the ingest provider ([`OscalControlsProvider`]) and the assessment
-//! as-is. See `compliance_core::models::oscal_assessment`.
+//! emitter (`compliance_core::models::oscal_assessment`).
 
 use axum::extract::Extension;
 use axum::http::StatusCode;
@@ -12,24 +12,45 @@ use axum::Json;
 use mongodb::bson::doc;
 use serde::Deserialize;
 
-use compliance_core::models::oscal_assessment::assess;
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::models::oscal_assessment::{assess, ControlLinker};
 use compliance_core::models::Finding;
 use compliance_core::tenant_ctx::TenantCtx;
 
 use super::dto::{collect_cursor_async, tenant_db, AgentExt};
+use crate::controls::OscalControlsProvider;
 
 #[derive(Debug, Deserialize)]
 pub struct AssessRequest {
     /// The target / repo id whose findings are assessed.
     pub target_id: String,
+    /// Frameworks to assess against; defaults to `[Cra]` when empty.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
 }
 
-/// `POST /api/v1/oscal/assess` — OSCAL assessment-results for a target's findings.
+/// `POST /api/v1/oscal/assess` — pull the catalog(s), load the target's findings,
+/// and emit an OSCAL assessment-results document linking findings to controls.
 pub async fn assess_target(
     Extension(agent): AgentExt,
     tenant: TenantCtx,
     Json(req): Json<AssessRequest>,
 ) -> Response {
+    let cfg = &agent.config.breakpilot;
+    let Some(base_url) = cfg.base_url.clone() else {
+        return (
+            StatusCode::SERVICE_UNAVAILABLE,
+            "breakpilot base URL not configured (set BREAKPILOT_BASE_URL)",
+        )
+            .into_response();
+    };
+
+    let frameworks = if req.frameworks.is_empty() {
+        vec![ComplianceFramework::Cra]
+    } else {
+        req.frameworks.clone()
+    };
+
     let db = match tenant_db(&agent, &tenant).await {
         Ok(db) => db,
         Err(code) => return code.into_response(),
@@ -44,5 +65,25 @@ pub async fn assess_target(
         }
     };
 
-    Json(assess(&findings, chrono::Utc::now())).into_response()
+    let provider = OscalControlsProvider::new(
+        agent.http.clone(),
+        base_url,
+        cfg.token.clone(),
+        &cfg.snapshot_dir,
+    );
+    let mut controls = Vec::new();
+    for framework in &frameworks {
+        match provider.load(*framework).await {
+            Ok(document) => controls.extend(document.to_controls()),
+            Err(e) => tracing::warn!(?framework, error = %e, "OSCAL catalog load failed"),
+        }
+    }
+
+    let assessment = assess(
+        &controls,
+        &findings,
+        &ControlLinker::cra_seed(),
+        chrono::Utc::now(),
+    );
+    Json(assessment).into_response()
 }

compliance-agent/src/controls/checker.rs

@@ -1,114 +0,0 @@
-//! The grounded control checker: judge each candidate region for a control, then
-//! keep only the verdicts that survive the grounding gate.
-//!
-//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
-//! the whole recognize → ground path is then exercised without an LLM. With the
-//! real judge, determinism comes from temperature 0 plus the gate.
-
-use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
-use compliance_core::models::Finding;
-
-use super::judge::ControlJudge;
-
-/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
-pub struct GroundedControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> GroundedControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Judge every candidate region for `spec` and return the grounded findings.
-    /// A verdict that doesn't quote real code in its region is dropped by
-    /// [`ground`], so nothing fabricated reaches the caller.
-    pub async fn check(
-        &self,
-        spec: &ControlCheckSpec,
-        regions: &[CandidateRegion],
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let mut findings = Vec::new();
-        for region in regions {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::LlmVerdict;
-    use compliance_core::models::finding::Severity;
-
-    /// Deterministic stub: returns a fixed verdict for every region, so the
-    /// recognize → ground composition is tested without an LLM.
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "No default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    fn region(content: &str) -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: content.into(),
-        }
-    }
-
-    #[tokio::test]
-    async fn keeps_grounded_and_drops_ungrounded() {
-        let checker = GroundedControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let regions = vec![
-            region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
-            region("totally unrelated code\n"),      // snippet absent → dropped
-        ];
-        let findings = checker.check(&spec(), &regions, "repo").await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
-        assert_eq!(findings[0].line_number, Some(2));
-    }
-
-    #[tokio::test]
-    async fn non_violation_yields_nothing() {
-        let checker = GroundedControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: false,
-                snippet: String::new(),
-                cwe: None,
-                confidence: 0.0,
-            },
-        });
-        let findings = checker
-            .check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
-            .await;
-        assert!(findings.is_empty());
-    }
-}

compliance-agent/src/controls/index.rs

@@ -1,110 +0,0 @@
-//! In-memory embedding index over the control corpus, for region → control
-//! retrieval.
-//!
-//! At master-control scale (~13.6k) findings can't be mapped by CWE (the master
-//! controls carry none), so we map by *similarity*: embed each control's
-//! requirement text once, then for a code region pull the top-K nearest controls
-//! to hand to the grounded judge. This is the retrieval half of the semantic path.
-
-use compliance_core::control_check::ControlCheckSpec;
-use compliance_core::error::CoreError;
-
-use crate::llm::LlmClient;
-
-/// A control spec paired with its requirement-text embedding.
-pub struct ControlIndex {
-    entries: Vec<(ControlCheckSpec, Vec<f64>)>,
-}
-
-impl ControlIndex {
-    /// Build directly from precomputed embeddings (used by tests + callers that
-    /// already embedded the corpus).
-    pub fn from_embeddings(entries: Vec<(ControlCheckSpec, Vec<f64>)>) -> Self {
-        Self { entries }
-    }
-
-    /// Build by embedding each control's requirement text.
-    pub async fn build(llm: &LlmClient, specs: Vec<ControlCheckSpec>) -> Result<Self, CoreError> {
-        if specs.is_empty() {
-            return Ok(Self {
-                entries: Vec::new(),
-            });
-        }
-        let texts: Vec<String> = specs.iter().map(|s| s.requirement.clone()).collect();
-        let embeddings = llm
-            .embed(texts)
-            .await
-            .map_err(|e| CoreError::Llm(e.to_string()))?;
-        Ok(Self {
-            entries: specs.into_iter().zip(embeddings).collect(),
-        })
-    }
-
-    pub fn len(&self) -> usize {
-        self.entries.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.entries.is_empty()
-    }
-
-    /// The top-`k` control specs whose embedding is nearest (cosine) to `query`.
-    pub fn nearest(&self, query: &[f64], k: usize) -> Vec<ControlCheckSpec> {
-        let mut scored: Vec<(f64, &ControlCheckSpec)> = self
-            .entries
-            .iter()
-            .map(|(spec, emb)| (cosine(query, emb), spec))
-            .collect();
-        scored.sort_by(|a, b| b.0.total_cmp(&a.0));
-        scored.into_iter().take(k).map(|(_, s)| s.clone()).collect()
-    }
-}
-
-/// Cosine similarity; 0.0 for length-mismatched, empty, or zero vectors.
-fn cosine(a: &[f64], b: &[f64]) -> f64 {
-    if a.len() != b.len() || a.is_empty() {
-        return 0.0;
-    }
-    let dot: f64 = a.iter().zip(b).map(|(x, y)| x * y).sum();
-    let na: f64 = a.iter().map(|x| x * x).sum();
-    let nb: f64 = b.iter().map(|x| x * x).sum();
-    if na == 0.0 || nb == 0.0 {
-        return 0.0;
-    }
-    dot / (na.sqrt() * nb.sqrt())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[test]
-    fn nearest_ranks_by_cosine() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("a"), vec![1.0, 0.0]),
-            (spec("b"), vec![0.0, 1.0]),
-            (spec("c"), vec![0.7, 0.7]),
-        ]);
-        let hits = index.nearest(&[0.9, 0.1], 2);
-        assert_eq!(hits.len(), 2);
-        assert_eq!(hits[0].control_id, "a"); // closest to [0.9,0.1]
-    }
-
-    #[test]
-    fn cosine_edges_are_zero() {
-        assert_eq!(cosine(&[1.0], &[1.0, 2.0]), 0.0); // length mismatch
-        assert_eq!(cosine(&[0.0, 0.0], &[1.0, 1.0]), 0.0); // zero vector
-        assert!((cosine(&[1.0, 0.0], &[1.0, 0.0]) - 1.0).abs() < 1e-9); // identical
-    }
-}

compliance-agent/src/controls/judge.rs

@@ -1,167 +0,0 @@
-//! The "recognize" stage: judge whether a code region violates a control.
-//!
-//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
-//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
-//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
-//! and everything it returns is then re-checked by the grounding gate
-//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
-//! smart; it is never trusted.
-
-use std::sync::Arc;
-
-use serde::Deserialize;
-
-use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
-
-use crate::llm::LlmClient;
-
-/// Prompt/logic version — part of the verdict cache key, bump on any change here.
-pub const PROMPT_VERSION: &str = "control-judge-v1";
-
-const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
-You are given ONE compliance control (a requirement) and ONE code region. Decide \
-ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
-shown — never assume code that is not present. (2) If and only if it violates, copy \
-the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
-region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
-violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
-Respond with STRICT JSON only, no prose: \
-{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
-
-/// Judges one (control, region). Async-in-trait so a stub can drive tests.
-#[allow(async_fn_in_trait)]
-pub trait ControlJudge: Send + Sync {
-    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
-}
-
-/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
-pub struct LlmControlJudge {
-    llm: Arc<LlmClient>,
-}
-
-impl LlmControlJudge {
-    pub fn new(llm: Arc<LlmClient>) -> Self {
-        Self { llm }
-    }
-}
-
-impl ControlJudge for LlmControlJudge {
-    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
-        let user = build_user_prompt(spec, region);
-        match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
-            Ok(response) => parse_verdict(&response),
-            Err(e) => {
-                // Fail closed: a transient model error yields no finding, never a
-                // fabricated one.
-                tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
-                no_violation()
-            }
-        }
-    }
-}
-
-fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
-    format!(
-        "CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
-        id = spec.control_id,
-        title = spec.title,
-        req = spec.requirement,
-        file = region.file,
-        line = region.start_line,
-        code = region.content,
-    )
-}
-
-#[derive(Debug, Default, Deserialize)]
-struct RawVerdict {
-    #[serde(default)]
-    violates: bool,
-    #[serde(default)]
-    snippet: String,
-    #[serde(default)]
-    cwe: Option<String>,
-    #[serde(default)]
-    confidence: f64,
-}
-
-/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
-/// degrades to a non-violation (never a fabricated finding).
-fn parse_verdict(response: &str) -> LlmVerdict {
-    let cleaned = response
-        .trim()
-        .trim_start_matches("```json")
-        .trim_start_matches("```")
-        .trim_end_matches("```")
-        .trim();
-    match serde_json::from_str::<RawVerdict>(cleaned) {
-        Ok(raw) => LlmVerdict {
-            violates: raw.violates,
-            snippet: raw.snippet,
-            cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
-            confidence: raw.confidence,
-        },
-        Err(e) => {
-            tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
-            no_violation()
-        }
-    }
-}
-
-fn no_violation() -> LlmVerdict {
-    LlmVerdict {
-        violates: false,
-        snippet: String::new(),
-        cwe: None,
-        confidence: 0.0,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::models::finding::Severity;
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "Products must not ship default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    #[test]
-    fn parses_plain_and_fenced_json() {
-        let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
-        let v = parse_verdict(plain);
-        assert!(v.violates);
-        assert_eq!(v.snippet, "PASSWORD = \"x\"");
-        assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
-
-        let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
-        assert!(!parse_verdict(fenced).violates);
-    }
-
-    #[test]
-    fn garbage_and_empty_cwe_are_safe() {
-        assert!(!parse_verdict("not json at all").violates); // fail closed
-        let no_cwe =
-            parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": "  ", "confidence": 0.5}"#);
-        assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
-    }
-
-    #[test]
-    fn user_prompt_carries_control_and_code() {
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 10,
-            content: "PASSWORD = \"admin\"".into(),
-        };
-        let p = build_user_prompt(&spec(), &region);
-        assert!(p.contains("cra-ai-8"));
-        assert!(p.contains("Products must not ship default credentials"));
-        assert!(p.contains("PASSWORD = \"admin\""));
-        assert!(p.contains("src/auth.py"));
-    }
-}

compliance-agent/src/controls/mod.rs

@@ -5,18 +5,6 @@
 //! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
 //! and snapshots it locally.
 
-mod checker;
-mod index;
-mod judge;
 mod oscal_provider;
-mod scan_triage;
-mod semantic;
-mod triage;
 
-pub use checker::GroundedControlChecker;
-pub use index::ControlIndex;
-pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
 pub use oscal_provider::OscalControlsProvider;
-pub use scan_triage::{semantic_stamp_findings, triage_repo_findings};
-pub use semantic::SemanticControlChecker;
-pub use triage::{ControlTriage, TriageOutcome};

compliance-agent/src/controls/oscal_provider.rs

@@ -43,20 +43,20 @@ impl OscalControlsProvider {
         }
     }
 
-    fn catalog_url(&self, framework: &str) -> String {
+    fn catalog_url(&self, framework: ComplianceFramework) -> String {
         format!(
             "{}/api/compliance/v1/oscal/catalog?framework={framework}",
             self.base_url.trim_end_matches('/')
         )
     }
 
-    fn snapshot_path(&self, framework: &str) -> PathBuf {
+    fn snapshot_path(&self, framework: ComplianceFramework) -> PathBuf {
         self.snapshot_dir
             .join(format!("oscal-catalog-{framework}.json"))
     }
 
-    /// Fetch the raw catalog bytes for a framework token over HTTP.
+    /// Fetch the raw catalog bytes for a framework over HTTP.
-    async fn fetch_raw(&self, framework: &str) -> Result<Vec<u8>, CoreError> {
+    async fn fetch_raw(&self, framework: ComplianceFramework) -> Result<Vec<u8>, CoreError> {
         let mut req = self.http.get(self.catalog_url(framework));
         if let Some(token) = &self.token {
             req = req.bearer_auth(token.expose_secret());
@@ -78,7 +78,11 @@ impl OscalControlsProvider {
     }
 
     /// Write a catalog snapshot atomically (temp file + rename).
-    async fn write_snapshot(&self, framework: &str, raw: &[u8]) -> Result<(), CoreError> {
+    async fn write_snapshot(
+        &self,
+        framework: ComplianceFramework,
+        raw: &[u8],
+    ) -> Result<(), CoreError> {
         tokio::fs::create_dir_all(&self.snapshot_dir).await?;
         let path = self.snapshot_path(framework);
         let tmp = path.with_extension("json.tmp");
@@ -88,7 +92,10 @@ impl OscalControlsProvider {
     }
 
     /// Read a previously written snapshot, if one exists.
-    async fn read_snapshot(&self, framework: &str) -> Result<Option<OscalDocument>, CoreError> {
+    async fn read_snapshot(
+        &self,
+        framework: ComplianceFramework,
+    ) -> Result<Option<OscalDocument>, CoreError> {
         match tokio::fs::read(self.snapshot_path(framework)).await {
             Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
             Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
@@ -96,21 +103,21 @@ impl OscalControlsProvider {
         }
     }
 
-    /// Load the catalog for a framework token: fetch fresh + snapshot the exact
+    /// Load the catalog for a framework: fetch fresh + snapshot the exact bytes;
-    /// bytes; on network failure, fall back to the last snapshot so scans run.
+    /// on network failure, fall back to the last snapshot so scans still run.
-    async fn load_token(&self, framework: &str) -> Result<OscalDocument, CoreError> {
+    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
         match self.fetch_raw(framework).await {
             Ok(raw) => {
                 let doc: OscalDocument = serde_json::from_slice(&raw)?;
                 if let Err(e) = self.write_snapshot(framework, &raw).await {
-                    tracing::warn!(framework, error = %e, "failed to write OSCAL snapshot");
+                    tracing::warn!(%framework, error = %e, "failed to write OSCAL snapshot");
                 }
                 Ok(doc)
             }
             Err(fetch_err) => match self.read_snapshot(framework).await? {
                 Some(doc) => {
                     tracing::warn!(
-                        framework, error = %fetch_err,
+                        %framework, error = %fetch_err,
                         "OSCAL catalog fetch failed; falling back to snapshot"
                     );
                     Ok(doc)
@@ -119,17 +126,6 @@ impl OscalControlsProvider {
             },
         }
     }
-
-    /// Load the OSCAL catalog for a compliance framework.
-    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
-        self.load_token(&framework.to_string()).await
-    }
-
-    /// Load the code-checkable master-controls catalog
-    /// (`?framework=master-controls`).
-    pub async fn load_master_controls(&self) -> Result<OscalDocument, CoreError> {
-        self.load_token("master-controls").await
-    }
 }
 
 /// Order controls whose title/text mention the query context first (stable), then
@@ -185,11 +181,11 @@ mod tests {
     fn builds_catalog_url_and_snapshot_path() {
         let p = provider(std::path::Path::new("/snap"));
         assert_eq!(
-            p.catalog_url("cra"),
+            p.catalog_url(ComplianceFramework::Cra),
             "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
         );
         assert_eq!(
-            p.snapshot_path("cra"),
+            p.snapshot_path(ComplianceFramework::Cra),
             std::path::Path::new("/snap/oscal-catalog-cra.json")
         );
     }
@@ -217,11 +213,19 @@ mod tests {
     async fn snapshot_round_trip_and_offline_fallback() {
         let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
         let p = provider(&dir);
-        assert!(p.read_snapshot("cra").await.unwrap().is_none());
+        assert!(p
-        p.write_snapshot("cra", MINI_CATALOG.as_bytes())
+            .read_snapshot(ComplianceFramework::Cra)
+            .await
+            .unwrap()
+            .is_none());
+        p.write_snapshot(ComplianceFramework::Cra, MINI_CATALOG.as_bytes())
             .await
             .unwrap();
-        let doc = p.read_snapshot("cra").await.unwrap().unwrap();
+        let doc = p
+            .read_snapshot(ComplianceFramework::Cra)
+            .await
+            .unwrap()
+            .unwrap();
         assert_eq!(doc.to_controls().len(), 1);
         assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
         let _ = std::fs::remove_dir_all(&dir);

compliance-agent/src/controls/scan_triage.rs

@@ -1,242 +0,0 @@
-//! Scan-pipeline integration for control triage.
-//!
-//! After the deterministic tools have produced findings, this stamps each finding
-//! with the compliance control(s) it's evidence for and marks control-level false
-//! positives — using the ingested OSCAL catalog for control text, the
-//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
-//! confirm. Skipped entirely unless breakpilot is configured.
-
-use std::collections::HashMap;
-use std::path::Path;
-use std::sync::Arc;
-
-use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
-use compliance_core::models::finding::{Finding, FindingStatus, Severity};
-use compliance_core::models::onboarding::ComplianceFramework;
-use compliance_core::AgentConfig;
-use control_map::ControlMap;
-
-use super::{
-    ControlIndex, ControlTriage, LlmControlJudge, OscalControlsProvider, SemanticControlChecker,
-    TriageOutcome,
-};
-use crate::llm::LlmClient;
-
-/// Nearest master controls judged per code region in the semantic pass.
-const SEMANTIC_TOP_K: usize = 5;
-
-/// Lines of context to read on each side of a finding's line.
-const REGION_WINDOW: usize = 6;
-
-/// Triage every finding in `findings` against the CRA control map: stamp
-/// `control_refs` on confirmed findings and flag control false positives. Returns
-/// the number of findings tagged with at least one control.
-pub async fn triage_repo_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let specs = build_specs(&provider).await;
-    if specs.is_empty() {
-        return 0;
-    }
-    let map = match ControlMap::cra() {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(error = %e, "control map failed to load; skipping control triage");
-            return 0;
-        }
-    };
-    let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        match triage.triage(finding, &region).await {
-            TriageOutcome::Confirmed(controls) => {
-                finding.control_refs = controls;
-                tagged += 1;
-            }
-            TriageOutcome::FalsePositive => {
-                finding.status = FindingStatus::FalsePositive;
-                finding.triage_action = Some("control_false_positive".to_string());
-            }
-            TriageOutcome::Unmapped => {}
-        }
-    }
-    tagged
-}
-
-/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
-async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
-    let mut specs = HashMap::new();
-    match provider.load(ComplianceFramework::Cra).await {
-        Ok(doc) => {
-            for control in doc.to_controls() {
-                specs.insert(
-                    control.id.clone(),
-                    ControlCheckSpec {
-                        control_id: control.id,
-                        title: control.title,
-                        requirement: control.text,
-                        default_cwe: None,
-                        severity: Severity::Medium,
-                    },
-                );
-            }
-        }
-        Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
-    }
-    specs
-}
-
-/// Read a window of lines around `line` (1-based) from `repo_path/file`.
-fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
-    let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
-    let lines: Vec<&str> = content.lines().collect();
-    if lines.is_empty() {
-        return None;
-    }
-    let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
-    let start = center.saturating_sub(REGION_WINDOW);
-    let end = (center + REGION_WINDOW + 1).min(lines.len());
-    Some(CandidateRegion {
-        file: file.to_string(),
-        start_line: (start as u32) + 1,
-        content: lines[start..end].join("\n"),
-    })
-}
-
-/// Master-controls **semantic** pass: for each finding's code region, retrieve the
-/// top-K nearest master controls by embedding, have the grounded judge confirm,
-/// and stamp the confirmed control ids onto the finding — the scale path for the
-/// ~13.6k master-control corpus (which has no CWE to LUT on). Returns the number
-/// of findings that gained a master-control ref.
-///
-/// Opt-in: the orchestrator does not run this yet. It builds the control embedding
-/// index per call (embeds the whole corpus) — production should cache/persist that
-/// index rather than rebuild it each scan.
-pub async fn semantic_stamp_findings(
-    config: &AgentConfig,
-    llm: Arc<LlmClient>,
-    repo_path: &Path,
-    findings: &mut [Finding],
-) -> usize {
-    let Some(base_url) = config.breakpilot.base_url.clone() else {
-        return 0;
-    };
-    let provider = OscalControlsProvider::new(
-        reqwest::Client::new(),
-        base_url,
-        config.breakpilot.token.clone(),
-        &config.breakpilot.snapshot_dir,
-    );
-    let doc = match provider.load_master_controls().await {
-        Ok(d) => d,
-        Err(e) => {
-            tracing::warn!(error = %e, "master-controls catalog unavailable; skipping semantic pass");
-            return 0;
-        }
-    };
-    let specs: Vec<ControlCheckSpec> = doc
-        .to_controls()
-        .into_iter()
-        .map(|c| ControlCheckSpec {
-            control_id: c.id,
-            title: c.title,
-            requirement: c.text,
-            default_cwe: None,
-            severity: Severity::Medium,
-        })
-        .collect();
-    let index = match ControlIndex::build(&llm, specs).await {
-        Ok(i) if !i.is_empty() => i,
-        Ok(_) => return 0,
-        Err(e) => {
-            tracing::warn!(error = %e, "failed to embed master-controls corpus");
-            return 0;
-        }
-    };
-    let checker = SemanticControlChecker::new(LlmControlJudge::new(llm.clone()));
-
-    let mut tagged = 0;
-    for finding in findings.iter_mut() {
-        if finding.status == FindingStatus::FalsePositive {
-            continue;
-        }
-        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
-            continue;
-        };
-        let Some(region) = fetch_region(repo_path, &file, line) else {
-            continue;
-        };
-        let region_emb = match llm.embed(vec![region.content.clone()]).await {
-            Ok(mut embs) => match embs.pop() {
-                Some(v) => v,
-                None => continue,
-            },
-            Err(e) => {
-                tracing::warn!(error = %e, "region embed failed; skipping finding");
-                continue;
-            }
-        };
-        let confirmed = checker
-            .check(
-                &index,
-                &region,
-                &region_emb,
-                SEMANTIC_TOP_K,
-                &finding.repo_id,
-            )
-            .await;
-        let before = finding.control_refs.len();
-        for f in confirmed {
-            for cref in f.control_refs {
-                if !finding.control_refs.contains(&cref) {
-                    finding.control_refs.push(cref);
-                }
-            }
-        }
-        if finding.control_refs.len() > before {
-            tagged += 1;
-        }
-    }
-    tagged
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn fetch_region_windows_around_the_line() {
-        let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let file = "a.py";
-        std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
-        let r = fetch_region(&dir, file, 4).unwrap();
-        assert!(r.content.contains("SECRET=1"));
-        assert_eq!(r.start_line, 1); // window clamps to file start
-        let _ = std::fs::remove_dir_all(&dir);
-    }
-
-    #[test]
-    fn fetch_region_missing_file_is_none() {
-        assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
-    }
-}

compliance-agent/src/controls/semantic.rs

@@ -1,119 +0,0 @@
-//! Semantic control mapping: retrieve the top-K controls nearest a code region,
-//! then confirm each with the grounded judge.
-//!
-//! The `region → controls` direction (vs. the CWE-LUT's `finding → control`) is
-//! what scales to the full master-control corpus: the LLM only ever judges a
-//! handful of retrieved candidates, and every surviving verdict is still anchored
-//! to real code by the grounding gate.
-
-use compliance_core::control_check::{ground, CandidateRegion};
-use compliance_core::models::Finding;
-
-use super::index::ControlIndex;
-use super::judge::ControlJudge;
-
-/// Retrieve → judge → ground, generic over the judge so tests use a stub.
-pub struct SemanticControlChecker<J> {
-    judge: J,
-}
-
-impl<J: ControlJudge> SemanticControlChecker<J> {
-    pub fn new(judge: J) -> Self {
-        Self { judge }
-    }
-
-    /// Map a code region to the controls it violates. `region_embedding` is the
-    /// region's embedding (the caller computes it via the LLM); the top-`k`
-    /// nearest controls in `index` are judged and grounded.
-    pub async fn check(
-        &self,
-        index: &ControlIndex,
-        region: &CandidateRegion,
-        region_embedding: &[f64],
-        k: usize,
-        repo_id: &str,
-    ) -> Vec<Finding> {
-        let candidates = index.nearest(region_embedding, k);
-        let mut findings = Vec::new();
-        for spec in &candidates {
-            let verdict = self.judge.judge(spec, region).await;
-            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
-                findings.push(finding);
-            }
-        }
-        findings
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::{ControlCheckSpec, LlmVerdict};
-    use compliance_core::models::finding::Severity;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn spec(id: &str) -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: id.into(),
-            title: id.into(),
-            requirement: id.into(),
-            default_cwe: None,
-            severity: Severity::Medium,
-        }
-    }
-
-    #[tokio::test]
-    async fn retrieves_then_grounds_the_nearest_control() {
-        let index = ControlIndex::from_embeddings(vec![
-            (spec("mc-near"), vec![1.0, 0.0]),
-            (spec("mc-far"), vec![0.0, 1.0]),
-        ]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "PASSWORD = \"admin\"".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin\"\n".into(),
-        };
-        // Query embedding nearest to mc-near; k=1 → only mc-near is judged.
-        let findings = checker
-            .check(&index, &region, &[0.95, 0.05], 1, "repo")
-            .await;
-        assert_eq!(findings.len(), 1);
-        assert_eq!(findings[0].control_refs, vec!["mc-near".to_string()]);
-    }
-
-    #[tokio::test]
-    async fn ungrounded_verdict_is_dropped() {
-        let index = ControlIndex::from_embeddings(vec![(spec("mc-near"), vec![1.0, 0.0])]);
-        let checker = SemanticControlChecker::new(StubJudge {
-            verdict: LlmVerdict {
-                violates: true,
-                snippet: "not in the region".into(),
-                cwe: None,
-                confidence: 0.9,
-            },
-        });
-        let region = CandidateRegion {
-            file: "f".into(),
-            start_line: 1,
-            content: "real code\n".into(),
-        };
-        let findings = checker.check(&index, &region, &[1.0, 0.0], 1, "repo").await;
-        assert!(findings.is_empty());
-    }
-}

compliance-agent/src/controls/triage.rs

@@ -1,184 +0,0 @@
-//! Triage step: confirm/refute a deterministic tool finding against the controls
-//! it maps to (via the `control-map` LUT), grounding the judgment.
-//!
-//! This is where the LLM finally enters — as a **false-positive filter over tool
-//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
-//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
-//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
-//! judge then confirms or refutes each, and only judgments anchored to real code
-//! survive.
-
-use std::collections::HashMap;
-
-use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
-use compliance_core::models::Finding;
-use control_map::ControlMap;
-
-use super::judge::ControlJudge;
-
-/// What triage decided for one tool finding.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TriageOutcome {
-    /// The finding maps to no control in the LUT — keep it, untagged.
-    Unmapped,
-    /// Maps to controls and the grounded judge confirmed at least one — keep the
-    /// finding and tag it with these control ids.
-    Confirmed(Vec<String>),
-    /// Maps to controls but the judge grounded none — treat as a false positive.
-    FalsePositive,
-}
-
-/// Triages tool findings against the control map, confirming with a grounded judge.
-pub struct ControlTriage<J> {
-    judge: J,
-    map: ControlMap,
-    /// Control requirement specs (by control id), built from the ingested catalog.
-    specs: HashMap<String, ControlCheckSpec>,
-}
-
-impl<J: ControlJudge> ControlTriage<J> {
-    pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
-        Self { judge, map, specs }
-    }
-
-    /// Triage one tool finding. `region` is the code around the finding, used as
-    /// the grounding evidence for the judge.
-    pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
-        let Some(cwe) = finding.cwe.as_deref() else {
-            return TriageOutcome::Unmapped;
-        };
-        let mapped = self.map.controls_for(&finding.scanner, cwe);
-        if mapped.is_empty() {
-            return TriageOutcome::Unmapped;
-        }
-
-        let mut confirmed = Vec::new();
-        for entry in mapped {
-            let Some(spec) = self.specs.get(&entry.control) else {
-                continue;
-            };
-            let verdict = self.judge.judge(spec, region).await;
-            // The verdict only counts if it grounds to real code in the region.
-            if ground(spec, region, &verdict, &finding.repo_id).is_some() {
-                confirmed.push(entry.control.clone());
-            }
-        }
-
-        if confirmed.is_empty() {
-            TriageOutcome::FalsePositive
-        } else {
-            TriageOutcome::Confirmed(confirmed)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use compliance_core::control_check::LlmVerdict;
-    use compliance_core::models::finding::Severity;
-    use compliance_core::models::scan::ScanType;
-
-    struct StubJudge {
-        verdict: LlmVerdict,
-    }
-    impl ControlJudge for StubJudge {
-        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
-            self.verdict.clone()
-        }
-    }
-
-    fn specs() -> HashMap<String, ControlCheckSpec> {
-        let mut m = HashMap::new();
-        m.insert(
-            "cra-ai-8".to_string(),
-            ControlCheckSpec {
-                control_id: "cra-ai-8".into(),
-                title: "No default passwords".into(),
-                requirement: "No default credentials".into(),
-                default_cwe: Some("CWE-798".into()),
-                severity: Severity::High,
-            },
-        );
-        m
-    }
-
-    fn semgrep_finding(cwe: &str) -> Finding {
-        let mut f = Finding::new(
-            "repo".into(),
-            "fp1".into(),
-            "semgrep".into(),
-            ScanType::Sast,
-            "hardcoded credential".into(),
-            "desc".into(),
-            Severity::High,
-        );
-        f.cwe = Some(cwe.into());
-        f
-    }
-
-    fn region() -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 1,
-            content: "PASSWORD = \"admin123\"\n".into(),
-        }
-    }
-
-    #[tokio::test]
-    async fn confirmed_finding_is_tagged_with_control() {
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "PASSWORD = \"admin123\"".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
-        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
-    }
-
-    #[tokio::test]
-    async fn refuted_mapped_finding_is_false_positive() {
-        // Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: false,
-                    snippet: String::new(),
-                    cwe: None,
-                    confidence: 0.1,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
-        assert_eq!(out, TriageOutcome::FalsePositive);
-    }
-
-    #[tokio::test]
-    async fn unmapped_cwe_is_left_untagged() {
-        let triage = ControlTriage::new(
-            StubJudge {
-                verdict: LlmVerdict {
-                    violates: true,
-                    snippet: "PASSWORD = \"admin123\"".into(),
-                    cwe: None,
-                    confidence: 0.9,
-                },
-            },
-            ControlMap::cra().unwrap(),
-            specs(),
-        );
-        let out = triage
-            .triage(&semgrep_finding("CWE-99999"), &region())
-            .await;
-        assert_eq!(out, TriageOutcome::Unmapped);
-    }
-}

compliance-agent/src/pipeline/orchestrator.rs

@@ -215,21 +215,6 @@ impl PipelineOrchestrator {
         .await;
         tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
 
-        // Stage 5b: control triage — stamp findings with the compliance control(s)
-        // they're evidence for and flag control false positives (grounded LLM over
-        // deterministic tool output). No-op unless breakpilot is configured.
-        self.update_phase(scan_run_id, "control_triage").await;
-        let tagged = crate::controls::triage_repo_findings(
-            &self.config,
-            self.llm.clone(),
-            &repo_path,
-            &mut all_findings,
-        )
-        .await;
-        if tagged > 0 {
-            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
-        }
-
         // Dedup against existing findings and insert new ones
         let mut new_count = 0u32;
         let mut new_findings: Vec<Finding> = Vec::new();

compliance-agent/src/pipeline/semgrep.rs

@@ -82,7 +82,10 @@ impl Scanner for SemgrepScanner {
                 finding.file_path = Some(r.path);
                 finding.line_number = Some(r.start.line);
                 finding.code_snippet = Some(r.extra.lines);
-                finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
+                finding.cwe = r
+                    .extra
+                    .metadata
+                    .and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
                 finding
             })
             .collect();
@@ -121,34 +124,10 @@ struct SemgrepExtra {
     metadata: Option<serde_json::Value>,
 }
 
-/// semgrep emits `metadata.cwe` as a list of strings like
-/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
-/// the first entry and normalise it to just the `CWE-NNN` id.
-fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
-    let raw = metadata.get("cwe")?;
-    let text = match raw {
-        serde_json::Value::Array(items) => items.first()?.as_str()?,
-        serde_json::Value::String(s) => s.as_str(),
-        _ => return None,
-    };
-    let id = text.split(':').next().unwrap_or(text).trim();
-    (!id.is_empty()).then(|| id.to_string())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn extract_cwe_handles_list_and_normalises() {
-        let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
-        assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
-        let bare = serde_json::json!({"cwe": "CWE-89"});
-        assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
-        let none = serde_json::json!({"severity": "ERROR"});
-        assert_eq!(extract_cwe(&none), None);
-    }
-
     #[test]
     fn deserialize_semgrep_output() {
         let json = r#"{

compliance-core/src/control_check.rs

@@ -1,204 +0,0 @@
-//! Grounded control-driven checking.
-//!
-//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
-//! whose output is grounded to real code — so a hallucinated finding cannot
-//! survive. Determinism is structural, not a prompt plea:
-//!
-//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
-//!    code it never saw;
-//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
-//!    in the region, and the line is recomputed from that match — the model's own
-//!    line number is never trusted ([`ground`]);
-//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
-//!
-//! The LLM supplies cross-language / cross-stack pattern recognition; this module
-//! supplies the determinism.
-
-use sha2::{Digest, Sha256};
-
-use crate::models::finding::{Finding, Severity};
-use crate::models::scan::ScanType;
-
-/// A control rendered as a check the LLM judges code against.
-#[derive(Debug, Clone)]
-pub struct ControlCheckSpec {
-    /// Stable control id, e.g. `"cra-ai-8"`.
-    pub control_id: String,
-    /// Short control title (used in the finding title).
-    pub title: String,
-    /// The requirement text the LLM judges against (control objective/statement).
-    pub requirement: String,
-    /// CWE to fall back to when the model doesn't supply one.
-    pub default_cwe: Option<String>,
-    /// Severity for findings raised from this control.
-    pub severity: Severity,
-}
-
-/// A retrieved code region the LLM judges — never the whole repo.
-#[derive(Debug, Clone)]
-pub struct CandidateRegion {
-    /// Repo-relative path.
-    pub file: String,
-    /// 1-based line number of the region's first line in `file`.
-    pub start_line: u32,
-    /// The region's source text.
-    pub content: String,
-}
-
-/// The LLM's structured verdict for one (control, region). `snippet` is the
-/// verbatim code the model claims proves the violation — it is the anchor the
-/// grounding gate checks.
-#[derive(Debug, Clone)]
-pub struct LlmVerdict {
-    pub violates: bool,
-    pub snippet: String,
-    pub cwe: Option<String>,
-    pub confidence: f64,
-}
-
-/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
-/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
-/// finding's line is computed from the match, so a fabricated or mis-located
-/// snippet is dropped. Pure — no LLM, no I/O.
-pub fn ground(
-    spec: &ControlCheckSpec,
-    region: &CandidateRegion,
-    verdict: &LlmVerdict,
-    repo_id: &str,
-) -> Option<Finding> {
-    if !verdict.violates {
-        return None;
-    }
-    let snippet = verdict.snippet.trim();
-    if snippet.is_empty() {
-        return None;
-    }
-    // Grounding: the quoted snippet must literally exist in the retrieved region.
-    let pos = region.content.find(snippet)?;
-    // Recompute the real line from the match — never trust the model's number.
-    let newlines_before = region.content[..pos].matches('\n').count();
-    let line = region.start_line + newlines_before as u32;
-
-    let mut finding = Finding::new(
-        repo_id.to_string(),
-        control_finding_fingerprint(&spec.control_id, &region.file, snippet),
-        "control-check".to_string(),
-        ScanType::CodeReview,
-        format!("{}: {}", spec.control_id, spec.title),
-        format!(
-            "Control {} appears violated ({}) at {}:{line}",
-            spec.control_id, spec.requirement, region.file
-        ),
-        spec.severity.clone(),
-    );
-    finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
-    finding.file_path = Some(region.file.clone());
-    finding.line_number = Some(line);
-    finding.code_snippet = Some(snippet.to_string());
-    finding.confidence = Some(verdict.confidence);
-    // Carry the control reference on the finding.
-    finding.control_refs = vec![spec.control_id.clone()];
-    Some(finding)
-}
-
-/// Deterministic cache key for a (control, region, model, prompt-version) verdict
-/// so identical inputs reproduce the same verdict without another LLM call.
-pub fn cache_key(
-    control_id: &str,
-    region_content: &str,
-    model: &str,
-    prompt_version: &str,
-) -> String {
-    hash_parts(&[control_id, region_content, model, prompt_version])
-}
-
-fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
-    hash_parts(&[control_id, file, snippet])
-}
-
-fn hash_parts(parts: &[&str]) -> String {
-    let mut hasher = Sha256::new();
-    for part in parts {
-        hasher.update(part.as_bytes());
-        hasher.update([0u8]); // domain separator between parts
-    }
-    hex::encode(hasher.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn spec() -> ControlCheckSpec {
-        ControlCheckSpec {
-            control_id: "cra-ai-8".into(),
-            title: "No default passwords".into(),
-            requirement: "Products must not ship default credentials".into(),
-            default_cwe: Some("CWE-798".into()),
-            severity: Severity::High,
-        }
-    }
-
-    fn region() -> CandidateRegion {
-        CandidateRegion {
-            file: "src/auth.py".into(),
-            start_line: 10,
-            content: "def login():\n    PASSWORD = \"admin123\"\n    return PASSWORD\n".into(),
-        }
-    }
-
-    #[test]
-    fn grounds_real_snippet_with_recomputed_line() {
-        let v = LlmVerdict {
-            violates: true,
-            snippet: "PASSWORD = \"admin123\"".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        let f = ground(&spec(), &region(), &v, "repo").expect("should ground");
-        assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
-        assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
-        assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
-        assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
-        assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
-    }
-
-    #[test]
-    fn drops_fabricated_snippet_not_in_region() {
-        let v = LlmVerdict {
-            violates: true,
-            snippet: "SECRET = \"totally-made-up\"".into(),
-            cwe: None,
-            confidence: 0.99,
-        };
-        assert!(ground(&spec(), &region(), &v, "repo").is_none());
-    }
-
-    #[test]
-    fn drops_non_violation_and_empty_snippet() {
-        let no = LlmVerdict {
-            violates: false,
-            snippet: "PASSWORD = \"admin123\"".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        assert!(ground(&spec(), &region(), &no, "repo").is_none());
-        let empty = LlmVerdict {
-            violates: true,
-            snippet: "   ".into(),
-            cwe: None,
-            confidence: 0.9,
-        };
-        assert!(ground(&spec(), &region(), &empty, "repo").is_none());
-    }
-
-    #[test]
-    fn cache_key_and_fingerprint_are_deterministic() {
-        assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
-        assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
-        assert_eq!(
-            control_finding_fingerprint("c", "f", "s"),
-            control_finding_fingerprint("c", "f", "s")
-        );
-    }
-}

compliance-core/src/lib.rs

@@ -1,5 +1,4 @@
 pub mod config;
-pub mod control_check;
 pub mod db;
 pub mod error;
 pub mod models;

compliance-core/src/models/finding.rs

@@ -76,10 +76,6 @@ pub struct Finding {
     pub triage_rationale: Option<String>,
     /// Developer feedback on finding quality
     pub developer_feedback: Option<String>,
-    /// Compliance control ids this finding is evidence for (stamped by control
-    /// triage against the `control-map` LUT). Empty when unmapped.
-    #[serde(default)]
-    pub control_refs: Vec<String>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
@@ -122,7 +118,6 @@ impl Finding {
             triage_action: None,
             triage_rationale: None,
             developer_feedback: None,
-            control_refs: Vec::new(),
             created_at: now,
             updated_at: now,
         }

compliance-core/src/models/oscal_assessment.rs

@@ -15,7 +15,8 @@ use chrono::{DateTime, Utc};
 use serde::Serialize;
 use uuid::Uuid;
 
-use crate::models::finding::{Finding, FindingStatus};
+use crate::models::finding::Finding;
+use crate::traits::Control;
 
 const OSCAL_VERSION: &str = "1.1.2";
 /// Same namespace as the catalog exporter, so ids are stable and correlatable.
@@ -82,23 +83,22 @@ impl ControlLinker {
     }
 }
 
-/// Build a standard OSCAL assessment-results document from `findings`, using each
+/// Assess `findings` against `controls`: link findings to control-ids and build a
-/// finding's stamped `control_refs` for control linkage. EVERY non-false-positive
+/// standard OSCAL assessment-results document. `at` is the assessment timestamp.
-/// finding is emitted as an observation — mapped findings additionally produce a
+pub fn assess(
-/// per-control `not-satisfied` finding; **unmapped findings are reported as-is**
+    controls: &[Control],
-/// (an observation carrying their CWE/tool/severity, with no control target) so
+    findings: &[Finding],
-/// nothing is lost. `at` is the assessment timestamp.
+    linker: &ControlLinker,
-pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
+    at: DateTime<Utc>,
+) -> AssessmentResultsDoc {
     let ts = at.to_rfc3339();
 
     let mut observations = Vec::new();
     let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
-    let mut mapped = 0usize;
-    let mut unmapped = 0usize;
-
     for finding in findings {
-        if finding.status == FindingStatus::FalsePositive {
+        let targets = linker.controls_for(finding);
-            continue; // flagged tool false positive — excluded from the report
+        if targets.is_empty() {
+            continue;
         }
         let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
         let location = match (&finding.file_path, finding.line_number) {
@@ -106,67 +106,58 @@ pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
             (Some(f), None) => Some(f.clone()),
             _ => None,
         };
-        let is_mapped = !finding.control_refs.is_empty();
-        if is_mapped {
-            mapped += 1;
-        } else {
-            unmapped += 1;
-        }
-        let mut props = vec![
-            ObsProp::new("tool", &finding.scanner),
-            ObsProp::new("severity", &finding.severity.to_string()),
-            ObsProp::new("mapping", if is_mapped { "mapped" } else { "unmapped" }),
-        ];
-        if let Some(cwe) = &finding.cwe {
-            props.push(ObsProp::new("cwe", cwe));
-        }
         observations.push(Observation {
             uuid: obs_uuid.clone(),
-            title: finding.title.clone(),
+            description: finding.title.clone(),
-            description: finding.description.clone(),
             methods: vec!["TEST".to_string()],
             collected: ts.clone(),
-            props,
             relevant_evidence: vec![RelevantEvidence {
                 href: location.map(|l| format!("file://{l}")),
                 description: format!("[{}] {}", finding.scanner, finding.title),
             }],
         });
-        for control_id in &finding.control_refs {
+        for control_id in targets {
             obs_by_control
-                .entry(control_id.clone())
+                .entry(control_id)
                 .or_default()
                 .push(obs_uuid.clone());
         }
     }
 
+    let titles: HashMap<&str, &str> = controls
+        .iter()
+        .map(|c| (c.id.as_str(), c.title.as_str()))
+        .collect();
     let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
     hit_controls.sort();
     let ar_findings: Vec<ArFinding> = hit_controls
-        .iter()
+        .into_iter()
-        .map(|control_id| ArFinding {
+        .map(|control_id| {
-            uuid: det_uuid(&format!("finding:{control_id}")),
+            let title = titles.get(control_id.as_str()).copied().unwrap_or("");
-            title: format!("Findings affect {control_id}"),
+            ArFinding {
-            target: FindingTarget {
+                uuid: det_uuid(&format!("finding:{control_id}")),
-                target_type: "statement-id".to_string(),
+                title: format!("Findings affect {control_id}: {title}"),
-                target_id: format!("{control_id}_smt"),
+                target: FindingTarget {
-                status: TargetStatus {
+                    target_type: "statement-id".to_string(),
-                    state: "not-satisfied".to_string(),
+                    target_id: format!("{control_id}_smt"),
+                    status: TargetStatus {
+                        state: "not-satisfied".to_string(),
+                    },
                 },
-            },
+                related_observations: obs_by_control[control_id]
-            related_observations: obs_by_control[*control_id]
+                    .iter()
-                .iter()
+                    .map(|u| RelatedObservation {
-                .map(|u| RelatedObservation {
+                        observation_uuid: u.clone(),
-                    observation_uuid: u.clone(),
+                    })
-                })
+                    .collect(),
-                .collect(),
+            }
         })
         .collect();
 
-    let include_controls: Vec<SelectControlById> = hit_controls
+    let include_controls = controls
         .iter()
         .map(|c| SelectControlById {
-            control_id: (*c).clone(),
+            control_id: c.id.clone(),
         })
         .collect();
 
@@ -174,9 +165,9 @@ pub fn assess(findings: &[Finding], at: DateTime<Utc>) -> AssessmentResultsDoc {
         uuid: det_uuid("result:cra"),
         title: "Automated code-compliance assessment".to_string(),
         description: format!(
-            "{} observation(s): {mapped} control-linked, {unmapped} unmapped (as-is); {} control(s) affected",
+            "{} finding-linked observation(s) across {} reviewed control(s)",
             observations.len(),
-            include_controls.len()
+            controls.len()
         ),
         start: ts.clone(),
         reviewed_controls: ReviewedControls {
@@ -271,33 +262,13 @@ pub struct SelectControlById {
 #[derive(Debug, Clone, Serialize)]
 pub struct Observation {
     pub uuid: String,
-    pub title: String,
     pub description: String,
     pub methods: Vec<String>,
     pub collected: String,
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub props: Vec<ObsProp>,
     #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
     pub relevant_evidence: Vec<RelevantEvidence>,
 }
 
-/// A name/value observation property (cwe, tool, severity, mapping status). Lets an
-/// unmapped finding be reported fully as-is.
-#[derive(Debug, Clone, Serialize)]
-pub struct ObsProp {
-    pub name: String,
-    pub value: String,
-}
-
-impl ObsProp {
-    fn new(name: &str, value: &str) -> Self {
-        Self {
-            name: name.to_string(),
-            value: value.to_string(),
-        }
-    }
-}
-
 #[derive(Debug, Clone, Serialize)]
 pub struct RelevantEvidence {
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -339,9 +310,20 @@ pub struct RelatedObservation {
 mod tests {
     use super::*;
     use crate::models::finding::Severity;
+    use crate::models::onboarding::ComplianceFramework;
     use crate::models::scan::ScanType;
 
-    fn finding(fp: &str, cwe: Option<&str>, refs: &[&str]) -> Finding {
+    fn control(id: &str, title: &str) -> Control {
+        Control {
+            id: id.into(),
+            framework: ComplianceFramework::Cra,
+            title: title.into(),
+            text: String::new(),
+            source: None,
+        }
+    }
+
+    fn finding(fp: &str, cwe: Option<&str>) -> Finding {
         let mut f = Finding::new(
             "repo".into(),
             fp.into(),
@@ -354,7 +336,6 @@ mod tests {
         f.cwe = cwe.map(Into::into);
         f.file_path = Some("src/auth.rs".into());
         f.line_number = Some(42);
-        f.control_refs = refs.iter().map(|s| s.to_string()).collect();
         f
     }
 
@@ -365,60 +346,57 @@ mod tests {
     }
 
     #[test]
-    fn mapped_finding_becomes_control_finding() {
+    fn links_cwe_finding_to_control_not_satisfied() {
-        let doc = assess(&[finding("f1", Some("CWE-798"), &["cra-ai-8"])], at());
+        let controls = vec![
+            control("cra-ai-8", "No default passwords"),
+            control("cra-ai-13", "Crypto"),
+        ];
+        let findings = vec![finding("f1", Some("CWE-798"))];
+        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
         let r = &doc.assessment_results.results[0];
         assert_eq!(r.observations.len(), 1);
         assert_eq!(r.findings.len(), 1);
         assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
         assert_eq!(r.findings[0].target.status.state, "not-satisfied");
+        assert_eq!(r.findings[0].related_observations.len(), 1);
         assert_eq!(
             r.reviewed_controls.control_selections[0]
                 .include_controls
                 .len(),
-            1
+            2
         );
     }
 
     #[test]
-    fn unmapped_finding_is_reported_as_is() {
+    fn unlinked_finding_yields_no_control_finding() {
-        let doc = assess(&[finding("f1", Some("CWE-319"), &[])], at());
+        let controls = vec![control("cra-ai-8", "x")];
+        let findings = vec![finding("f1", Some("CWE-99999"))];
+        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
         let r = &doc.assessment_results.results[0];
-        assert_eq!(r.observations.len(), 1); // still emitted...
+        assert!(r.observations.is_empty());
-        assert!(r.findings.is_empty()); // ...but no control finding
+        assert!(r.findings.is_empty());
-        assert!(r.reviewed_controls.control_selections[0]
-            .include_controls
-            .is_empty());
-        let props: Vec<(&str, &str)> = r.observations[0]
-            .props
-            .iter()
-            .map(|p| (p.name.as_str(), p.value.as_str()))
-            .collect();
-        assert!(props.contains(&("mapping", "unmapped")));
-        assert!(props.contains(&("cwe", "CWE-319")));
     }
 
     #[test]
-    fn false_positive_is_excluded() {
+    fn output_is_deterministic_and_valid_oscal() {
-        let mut f = finding("f1", Some("CWE-798"), &["cra-ai-8"]);
+        let controls = vec![control("cra-ai-8", "x")];
-        f.status = FindingStatus::FalsePositive;
+        let findings = vec![finding("f1", Some("798"))];
-        let doc = assess(&[f], at());
+        let a = serde_json::to_string(&assess(
-        assert!(doc.assessment_results.results[0].observations.is_empty());
+            &controls,
-    }
+            &findings,
-
+            &ControlLinker::cra_seed(),
-    #[test]
+            at(),
-    fn deterministic_and_valid_oscal() {
+        ))
-        let mk = || {
+        .unwrap();
-            vec![
+        let b = serde_json::to_string(&assess(
-                finding("f1", Some("CWE-798"), &["cra-ai-8"]),
+            &controls,
-                finding("f2", Some("CWE-319"), &[]),
+            &findings,
-            ]
+            &ControlLinker::cra_seed(),
-        };
+            at(),
-        let a = serde_json::to_string(&assess(&mk(), at())).unwrap();
+        ))
-        let b = serde_json::to_string(&assess(&mk(), at())).unwrap();
+        .unwrap();
         assert_eq!(a, b);
         assert!(a.contains("\"oscal-version\":\"1.1.2\""));
         assert!(a.contains("\"not-satisfied\""));
-        assert!(a.contains("\"mapping\""));
     }
 }

compliance-mcp/src/server.rs

@@ -4,7 +4,7 @@ use rmcp::{
 
 use crate::auth::current_tenant_id;
 use crate::database::{Database, DatabasePool};
-use crate::tools::{dast, findings, oscal, pentest, sbom};
+use crate::tools::{dast, findings, pentest, sbom};
 
 pub struct ComplianceMcpServer {
     pool: DatabasePool,
@@ -68,17 +68,6 @@ impl ComplianceMcpServer {
         findings::findings_summary(&db, params).await
     }
 
-    #[tool(
-        description = "Emit an OSCAL 1.1 assessment-results document for a repo's findings (mapped findings target their compliance controls; unmapped findings are reported as-is)"
-    )]
-    async fn oscal_assessment(
-        &self,
-        Parameters(params): Parameters<oscal::OscalAssessmentParams>,
-    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        oscal::oscal_assessment(&db, params).await
-    }
-
     // ── SBOM ──────────────────────────────────────────────
 
     #[tool(

compliance-mcp/src/tools/mod.rs

@@ -1,5 +1,4 @@
 pub mod dast;
 pub mod findings;
-pub mod oscal;
 pub mod pentest;
 pub mod sbom;

compliance-mcp/src/tools/oscal.rs

@@ -1,51 +0,0 @@
-//! OSCAL assessment MCP tool.
-//!
-//! Emits a standard OSCAL assessment-results document for a repo's findings —
-//! what breakpilot's scanner MCP client pulls. Mapped findings target their
-//! compliance controls (via the stamped `control_refs`); unmapped findings are
-//! reported as-is, so nothing is lost.
-
-use mongodb::bson::doc;
-use rmcp::{model::*, ErrorData as McpError};
-use schemars::JsonSchema;
-use serde::Deserialize;
-
-use compliance_core::models::oscal_assessment::assess;
-use compliance_core::models::Finding;
-
-use crate::database::Database;
-
-#[derive(Debug, Deserialize, JsonSchema)]
-pub struct OscalAssessmentParams {
-    /// Repository / target id to assess.
-    pub repo_id: String,
-}
-
-pub async fn oscal_assessment(
-    db: &Database,
-    params: OscalAssessmentParams,
-) -> Result<CallToolResult, McpError> {
-    let mut cursor = db
-        .findings()
-        .find(doc! { "repo_id": &params.repo_id })
-        .await
-        .map_err(|e| McpError::internal_error(format!("DB error: {e}"), None))?;
-
-    let mut findings: Vec<Finding> = Vec::new();
-    while cursor
-        .advance()
-        .await
-        .map_err(|e| McpError::internal_error(format!("cursor error: {e}"), None))?
-    {
-        findings.push(
-            cursor
-                .deserialize_current()
-                .map_err(|e| McpError::internal_error(format!("deserialize error: {e}"), None))?,
-        );
-    }
-
-    let document = assess(&findings, chrono::Utc::now());
-    let json = serde_json::to_string_pretty(&document)
-        .map_err(|e| McpError::internal_error(format!("json error: {e}"), None))?;
-    Ok(CallToolResult::success(vec![Content::text(json)]))
-}

control-map/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "control-map"
-version = "0.1.0"
-edition = "2021"
-
-[lints]
-workspace = true
-
-[dependencies]
-serde = { workspace = true }
-serde_json = { workspace = true }
-thiserror = { workspace = true }

control-map/data/cra_control_map.json

@@ -1,399 +0,0 @@
-{
-  "version": "1.0",
-  "framework": "cra",
-  "controls": [
-    {
-      "control": "cra-ai-1",
-      "title": "Secure-by-Default-Konfiguration",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-2",
-      "title": "Minimale Angriffsflaeche",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-3",
-      "title": "Sichere Systemarchitektur",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-4",
-      "title": "Least-Privilege-Prinzip",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-5",
-      "title": "Manipulationsschutz",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-6",
-      "title": "Integritaetspruefung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-7",
-      "title": "Starke Authentifizierung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-8",
-      "title": "Keine Default-Passwoerter",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-259"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-9",
-      "title": "Sicheres Credential-Management",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-522"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-10",
-      "title": "Sitzungsmanagement",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-11",
-      "title": "Brute-Force-Schutz",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-12",
-      "title": "Rollenbasierte Autorisierung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-13",
-      "title": "Verschluesselung sensibler Daten",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-327",
-            "CWE-326"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-14",
-      "title": "Speicher-Schutz (Data at Rest)",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-15",
-      "title": "Transport-Schutz (Data in Transit)",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-319",
-            "CWE-311"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-16",
-      "title": "Sicheres Schluesselmanagement",
-      "scans": [
-        {
-          "tool": "gitleaks",
-          "scan_type": "secret_detection",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-798",
-            "CWE-321"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-17",
-      "title": "Datenminimierung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-18",
-      "title": "Strukturierter SSDLC",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-19",
-      "title": "Systematische Code Reviews",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-20",
-      "title": "Automatisierte Sicherheitstests",
-      "scans": [
-        {
-          "tool": "semgrep",
-          "scan_type": "sast",
-          "cwe": [
-            "CWE-89",
-            "CWE-78",
-            "CWE-79",
-            "CWE-22"
-          ],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-21",
-      "title": "Supply-Chain-Security",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-22",
-      "title": "Dependency-Monitoring",
-      "scans": [
-        {
-          "tool": "osv",
-          "scan_type": "cve",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-23",
-      "title": "Software Bill of Materials (SBOM)",
-      "scans": [
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-24",
-      "title": "Security-Logging",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-25",
-      "title": "Ereignis-Monitoring",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-26",
-      "title": "Anomalie-Erkennung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-27",
-      "title": "Log-Integritaet und -Aufbewahrung",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-28",
-      "title": "Sichere Update-Mechanismen",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-29",
-      "title": "Update-Authentizitaet",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-30",
-      "title": "Update-Integritaet",
-      "scans": [],
-      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
-      "status": "needs_tooling"
-    },
-    {
-      "control": "cra-ai-31",
-      "title": "Lifecycle-Support",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-32",
-      "title": "Schwachstellen-Identifikation",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-33",
-      "title": "SBOM-Pflege und Analyse",
-      "scans": [
-        {
-          "tool": "syft",
-          "scan_type": "sbom",
-          "cwe": [],
-          "rules": []
-        },
-        {
-          "tool": "osv",
-          "scan_type": "cve",
-          "cwe": [],
-          "rules": []
-        }
-      ],
-      "note": null,
-      "status": "covered"
-    },
-    {
-      "control": "cra-ai-34",
-      "title": "Risikobasierte Priorisierung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-35",
-      "title": "Coordinated Vulnerability Disclosure",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-36",
-      "title": "Incident-Response-Prozess",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-37",
-      "title": "Fruehwarnung (24h)",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-38",
-      "title": "Detaillierter Vorfallsbericht (72h)",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-39",
-      "title": "Patch-Bereitstellung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    },
-    {
-      "control": "cra-ai-40",
-      "title": "Dokumentation und Nachbereitung",
-      "scans": [],
-      "note": "process / document control — outside static-scan scope",
-      "status": "not_code_checkable"
-    }
-  ]
-}

control-map/src/lib.rs

@@ -1,163 +0,0 @@
-//! `control-map` — the deterministic control → scan lookup table (LUT).
-//!
-//! The "transcribing" layer: it maps each compliance control to the static-scan
-//! step(s) that check it, or marks it as needing custom tooling, or as not
-//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
-//! decides coverage. The LLM only enters later, downstream, to triage/ground the
-//! *tool's* findings (that lives in the agent, not here).
-//!
-//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
-//! + query helpers.
-
-use serde::{Deserialize, Serialize};
-
-/// Coverage bucket for a control under static (SAST-family) scanning.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Coverage {
-    /// An existing tool's scan surfaces findings for this control.
-    Covered,
-    /// Code-checkable, but no existing tool digs it out — we must write tooling.
-    NeedsTooling,
-    /// Process / document control — out of static-scan scope.
-    NotCodeCheckable,
-}
-
-/// One tool binding: a scan step that (at least partially) checks a control.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ScanBinding {
-    /// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
-    pub tool: String,
-    /// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
-    pub scan_type: String,
-    /// CWEs whose findings map to this control (used to attach findings back).
-    #[serde(default)]
-    pub cwe: Vec<String>,
-    /// Optional specific rule ids this control keys on.
-    #[serde(default)]
-    pub rules: Vec<String>,
-}
-
-/// One control's entry in the LUT.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlEntry {
-    /// Control id, e.g. `"cra-ai-8"`.
-    pub control: String,
-    /// Human-readable title (for the reviewable view).
-    #[serde(default)]
-    pub title: String,
-    /// Coverage bucket.
-    pub status: Coverage,
-    /// Tool bindings (empty unless `status == Covered`).
-    #[serde(default)]
-    pub scans: Vec<ScanBinding>,
-    /// Reviewer note — why it needs tooling / isn't code-checkable.
-    #[serde(default)]
-    pub note: Option<String>,
-}
-
-/// The control → scan lookup table for one framework.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ControlMap {
-    pub version: String,
-    pub framework: String,
-    pub controls: Vec<ControlEntry>,
-}
-
-const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
-
-impl ControlMap {
-    /// Load the built-in CRA control map (the embedded, authored LUT).
-    pub fn cra() -> Result<Self, MapError> {
-        Ok(serde_json::from_str(CRA_MAP_JSON)?)
-    }
-
-    /// The coverage entry for a control id, if present.
-    pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
-        self.controls.iter().find(|c| c.control == control_id)
-    }
-
-    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
-    /// raw tool finding back to the control(s) it's evidence for.
-    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
-        self.controls
-            .iter()
-            .filter(|c| {
-                c.scans
-                    .iter()
-                    .any(|s| s.tool == tool && s.cwe.iter().any(|w| w == cwe))
-            })
-            .collect()
-    }
-
-    /// Count of controls in each coverage bucket.
-    pub fn summary(&self) -> CoverageSummary {
-        let mut s = CoverageSummary::default();
-        for c in &self.controls {
-            match c.status {
-                Coverage::Covered => s.covered += 1,
-                Coverage::NeedsTooling => s.needs_tooling += 1,
-                Coverage::NotCodeCheckable => s.not_code_checkable += 1,
-            }
-        }
-        s
-    }
-}
-
-/// Coverage bucket counts.
-#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
-pub struct CoverageSummary {
-    pub covered: usize,
-    pub needs_tooling: usize,
-    pub not_code_checkable: usize,
-}
-
-impl CoverageSummary {
-    pub fn total(&self) -> usize {
-        self.covered + self.needs_tooling + self.not_code_checkable
-    }
-}
-
-/// Errors loading a control map.
-#[derive(Debug, thiserror::Error)]
-pub enum MapError {
-    #[error("failed to parse control map: {0}")]
-    Parse(#[from] serde_json::Error),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn cra_map_loads_all_40_controls() {
-        let map = ControlMap::cra().expect("CRA map should parse");
-        assert_eq!(map.framework, "cra");
-        assert_eq!(map.controls.len(), 40);
-        assert_eq!(map.summary().total(), 40);
-    }
-
-    #[test]
-    fn hardcoded_password_control_is_tool_covered() {
-        let map = ControlMap::cra().unwrap();
-        let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
-        assert_eq!(c.status, Coverage::Covered);
-        assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
-        assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
-    }
-
-    #[test]
-    fn finding_attaches_back_to_control_via_tool_and_cwe() {
-        let map = ControlMap::cra().unwrap();
-        let hits = map.controls_for("semgrep", "CWE-798");
-        assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
-    }
-
-    #[test]
-    fn every_bucket_is_represented() {
-        let s = ControlMap::cra().unwrap().summary();
-        assert!(s.covered > 0);
-        assert!(s.needs_tooling > 0);
-        assert!(s.not_code_checkable > 0);
-    }
-}