fix(semgrep): extract CWE from list-form metadata (was always null)

semgrep emits metadata.cwe as a LIST (e.g. "CWE-798: Use of Hard-coded
Credentials"), but the extractor called v.as_str() on it -> always None, so SAST
findings never carried a CWE at all (silently breaking control mapping AND the
CWE-based dedup). Handle list + bare-string forms and normalise to the CWE-NNN
id. Found by the live control-triage end-to-end test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -47,6 +47,11 @@ PLC_RUNTIME_MAX_LIFETIME_SECS=180
 PLC_RUNTIME_OPENPLC_USER=openplc
 PLC_RUNTIME_OPENPLC_PASSWORD=openplc
 
+# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
+# When set, mounts the runner-facing queue + artifact endpoints behind this
+# bearer token; runners present the same token. Unset = endpoints not mounted.
+WERKBANK_RUNNER_TOKEN=
+
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001

.gitea/workflows/ci.yml

@@ -109,6 +109,8 @@ jobs:
         run: cargo clippy -p compliance-mcp -- -D warnings
       - name: Clippy (werkbank-exec)
         run: cargo clippy -p werkbank-exec -- -D warnings
+      - name: Clippy (control-map)
+        run: cargo clippy -p control-map -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -117,8 +119,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent + werkbank-exec)
-        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib
+      - name: Tests (core + agent + werkbank-exec + control-map)
+        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec -p control-map --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)

Cargo.lock

@@ -666,6 +666,7 @@ dependencies = [
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
+ "control-map",
  "dashmap",
  "dotenvy",
  "futures-core",
@@ -968,6 +969,15 @@ dependencies = [
  "charset",
 ]
 
+[[package]]
+name = "control-map"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "convert_case"
 version = "0.8.0"
@@ -5089,6 +5099,12 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -6472,6 +6488,7 @@ dependencies = [
  "getrandom 0.4.1",
  "js-sys",
  "serde_core",
+ "sha1_smol",
  "wasm-bindgen",
 ]
 

Cargo.toml

@@ -8,6 +8,7 @@ members = [
     "compliance-mcp",
     "compliance-smoke",
     "werkbank-exec",
+    "control-map",
 ]
 resolver = "2"
 
@@ -17,6 +18,7 @@ expect_used = "deny"
 
 [workspace.dependencies]
 compliance-core = { path = "compliance-core", default-features = false }
+control-map = { path = "control-map" }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
@@ -28,7 +30,7 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "co
 thiserror = "2"
 sha2 = "0.10"
 hex = "0.4"
-uuid = { version = "1", features = ["v4", "serde"] }
+uuid = { version = "1", features = ["v4", "v5", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }

compliance-agent/Cargo.toml

@@ -8,6 +8,7 @@ workspace = true
 
 [dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
+control-map = { workspace = true }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
 # Shared dynamic-execution logic (soft-PLC provisioning + ICS probing), also

compliance-agent/src/api/handlers/mod.rs

@@ -10,6 +10,7 @@ pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
 pub mod onboarding;
+pub mod oscal;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod sbom;

compliance-agent/src/api/handlers/oscal.rs

@@ -0,0 +1,89 @@
+//! OSCAL assessment endpoint.
+//!
+//! Assesses a target's findings against the breakpilot-compliance control
+//! catalog and returns a standard OSCAL assessment-results document. Ties
+//! together the ingest provider ([`OscalControlsProvider`]) and the assessment
+//! emitter (`compliance_core::models::oscal_assessment`).
+
+use axum::extract::Extension;
+use axum::http::StatusCode;
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use mongodb::bson::doc;
+use serde::Deserialize;
+
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::models::oscal_assessment::{assess, ControlLinker};
+use compliance_core::models::Finding;
+use compliance_core::tenant_ctx::TenantCtx;
+
+use super::dto::{collect_cursor_async, tenant_db, AgentExt};
+use crate::controls::OscalControlsProvider;
+
+#[derive(Debug, Deserialize)]
+pub struct AssessRequest {
+    /// The target / repo id whose findings are assessed.
+    pub target_id: String,
+    /// Frameworks to assess against; defaults to `[Cra]` when empty.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
+}
+
+/// `POST /api/v1/oscal/assess` — pull the catalog(s), load the target's findings,
+/// and emit an OSCAL assessment-results document linking findings to controls.
+pub async fn assess_target(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<AssessRequest>,
+) -> Response {
+    let cfg = &agent.config.breakpilot;
+    let Some(base_url) = cfg.base_url.clone() else {
+        return (
+            StatusCode::SERVICE_UNAVAILABLE,
+            "breakpilot base URL not configured (set BREAKPILOT_BASE_URL)",
+        )
+            .into_response();
+    };
+
+    let frameworks = if req.frameworks.is_empty() {
+        vec![ComplianceFramework::Cra]
+    } else {
+        req.frameworks.clone()
+    };
+
+    let db = match tenant_db(&agent, &tenant).await {
+        Ok(db) => db,
+        Err(code) => return code.into_response(),
+    };
+
+    let findings: Vec<Finding> = match db.findings().find(doc! { "repo_id": &req.target_id }).await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!(error = %e, "failed to load findings for OSCAL assessment");
+            return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+        }
+    };
+
+    let provider = OscalControlsProvider::new(
+        agent.http.clone(),
+        base_url,
+        cfg.token.clone(),
+        &cfg.snapshot_dir,
+    );
+    let mut controls = Vec::new();
+    for framework in &frameworks {
+        match provider.load(*framework).await {
+            Ok(document) => controls.extend(document.to_controls()),
+            Err(e) => tracing::warn!(?framework, error = %e, "OSCAL catalog load failed"),
+        }
+    }
+
+    let assessment = assess(
+        &controls,
+        &findings,
+        &ControlLinker::cra_seed(),
+        chrono::Utc::now(),
+    );
+    Json(assessment).into_response()
+}

compliance-agent/src/api/handlers/werkbank_jobs.rs

@@ -10,18 +10,20 @@
 //! so a job run by a remote runner lands the same findings an in-process run
 //! would (WB-05, the control-plane cut-over).
 
-use axum::extract::{Extension, Request};
+use axum::extract::{Extension, Path, Request};
 use axum::http::{header, StatusCode};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
 use axum::Json;
-use mongodb::bson::doc;
+use mongodb::bson::{doc, oid::ObjectId};
 use secrecy::ExposeSecret;
+use serde::{Deserialize, Serialize};
 use std::time::Duration;
 
 use compliance_core::models::werkbank::{
-    CompleteRequest, CompleteResponse, HeartbeatRequest, JobResult, LeaseRequest,
+    CompleteRequest, CompleteResponse, HeartbeatRequest, InputRef, Job, JobResult, LeaseRequest,
 };
+use compliance_core::models::ArtifactKind;
 
 use super::dto::AgentExt;
 use crate::database::Database;
@@ -122,6 +124,100 @@ pub async fn complete(
     Ok(Json(CompleteResponse { recorded }))
 }
 
+/// `GET /api/v1/werkbank/artifacts/{hash}` — serve a content-addressed blob (the
+/// program a runner needs to load). The hash is validated against traversal by
+/// [`crate::ingest::blob::read_blob`]; a runner fetches this for a job's `blob`
+/// input.
+#[tracing::instrument(skip_all, fields(hash = %hash))]
+pub async fn serve_artifact(
+    Extension(agent): AgentExt,
+    Path(hash): Path<String>,
+) -> Result<Response, StatusCode> {
+    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
+    match crate::ingest::blob::read_blob(base, &hash) {
+        Ok(bytes) => {
+            Ok(([(header::CONTENT_TYPE, "application/octet-stream")], bytes).into_response())
+        }
+        Err(_) => Err(StatusCode::NOT_FOUND),
+    }
+}
+
+/// Enqueue a `plc-provision` job for a target: extract its control-logic program,
+/// stash it as a content-addressed blob (which the runner fetches via
+/// [`serve_artifact`]), and queue the job. This is the control-plane "enqueue"
+/// half of the loop — a runner then leases it, provisions, and posts results.
+#[derive(Debug, Deserialize)]
+pub struct EnqueueRequest {
+    /// The tenant whose queue to enqueue into.
+    pub tenant: String,
+    /// The onboarded target to test.
+    pub target_id: String,
+}
+
+/// The enqueued job's id.
+#[derive(Debug, Serialize)]
+pub struct EnqueueResponse {
+    /// The new job id.
+    pub job_id: String,
+    /// Whether this call inserted it (false = already queued).
+    pub enqueued: bool,
+}
+
+#[tracing::instrument(skip_all, fields(tenant = %req.tenant, target = %req.target_id))]
+pub async fn enqueue(
+    Extension(agent): AgentExt,
+    Json(req): Json<EnqueueRequest>,
+) -> Result<Json<EnqueueResponse>, StatusCode> {
+    let db = tenant_db(&agent, &req.tenant).await?;
+    let oid = ObjectId::parse_str(&req.target_id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(internal)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    // Extract the control-logic program from the target's PLC-source artifacts
+    // (same selection as the in-process PLC scan).
+    let ctx = crate::ingest::IngestContext::from_config(&agent.config, &req.target_id);
+    let ingest_set = crate::ingest::ingest_all(&target, &ctx).map_err(internal)?;
+    let program = target
+        .artifacts
+        .iter()
+        .filter(|a| {
+            matches!(
+                a.kind,
+                ArtifactKind::PlcProject | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+            )
+        })
+        .find_map(|a| {
+            let path = ingest_set
+                .get(&a.id)
+                .and_then(|ia| ia.working_path.clone())?;
+            werkbank_exec::plc::extract_program(&path)
+        })
+        .ok_or(StatusCode::UNPROCESSABLE_ENTITY)?;
+
+    // Stash the program source so the runner can fetch it by hash.
+    let base = std::path::Path::new(&agent.config.artifact_store_base_path);
+    let hash =
+        crate::ingest::blob::store_bytes(base, program.source.as_bytes()).map_err(internal)?;
+
+    let job_id = format!("job_{}", uuid::Uuid::new_v4().simple());
+    let job = Job::plc_provision(
+        &job_id,
+        &req.tenant,
+        &req.target_id,
+        InputRef::blob(hash),
+        agent.config.plc_runtime.max_lifetime_secs,
+    );
+    let enqueued = JobQueue::new(&db)
+        .enqueue(job, chrono::Utc::now())
+        .await
+        .map_err(internal)?;
+    Ok(Json(EnqueueResponse { job_id, enqueued }))
+}
+
 /// Persist a job result's findings against its target: general findings
 /// (dedup'd by fingerprint) and DAST findings. Best-effort — a persistence hiccup
 /// is logged, not surfaced to the runner (its result is already recorded).

compliance-agent/src/api/routes.rs

@@ -6,6 +6,7 @@ use crate::api::handlers;
 pub fn build_router() -> Router {
     Router::new()
         .route("/api/v1/health", get(handlers::health))
+        .route("/api/v1/oscal/assess", post(handlers::oscal::assess_target))
         .route("/api/v1/stats/overview", get(handlers::stats_overview))
         .route(
             "/api/v1/settings/ssh-public-key",

compliance-agent/src/api/server.rs

@@ -91,6 +91,14 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
                 "/api/v1/werkbank/jobs/complete",
                 post(handlers::werkbank_jobs::complete),
             )
+            .route(
+                "/api/v1/werkbank/jobs/enqueue",
+                post(handlers::werkbank_jobs::enqueue),
+            )
+            .route(
+                "/api/v1/werkbank/artifacts/{hash}",
+                get(handlers::werkbank_jobs::serve_artifact),
+            )
             .layer(middleware::from_fn(
                 handlers::werkbank_jobs::require_runner_token,
             ))

compliance-agent/src/config.rs

@@ -1,4 +1,4 @@
-use compliance_core::config::PlcRuntimeConfig;
+use compliance_core::config::{BreakpilotConfig, PlcRuntimeConfig};
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -66,6 +66,7 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
         tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
         plc_runtime: load_plc_runtime_config(),
         werkbank_runner_token: env_secret_opt("WERKBANK_RUNNER_TOKEN"),
+        breakpilot: load_breakpilot_config(),
     })
 }
 
@@ -90,3 +91,14 @@ fn load_plc_runtime_config() -> PlcRuntimeConfig {
             .unwrap_or(d.openplc_password),
     }
 }
+
+/// Assemble the breakpilot OSCAL-catalog source from env, defaulting the snapshot
+/// directory. A missing `BREAKPILOT_BASE_URL` leaves the controls provider off.
+fn load_breakpilot_config() -> BreakpilotConfig {
+    let d = BreakpilotConfig::default();
+    BreakpilotConfig {
+        base_url: env_var_opt("BREAKPILOT_BASE_URL"),
+        token: env_secret_opt("BREAKPILOT_TOKEN"),
+        snapshot_dir: env_var_opt("BREAKPILOT_SNAPSHOT_DIR").unwrap_or(d.snapshot_dir),
+    }
+}

compliance-agent/src/controls/checker.rs

@@ -0,0 +1,114 @@
+//! The grounded control checker: judge each candidate region for a control, then
+//! keep only the verdicts that survive the grounding gate.
+//!
+//! Generic over [`ControlJudge`] so tests drive it with a deterministic stub —
+//! the whole recognize → ground path is then exercised without an LLM. With the
+//! real judge, determinism comes from temperature 0 plus the gate.
+
+use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
+use compliance_core::models::Finding;
+
+use super::judge::ControlJudge;
+
+/// Runs a [`ControlJudge`] over candidate regions and grounds the results.
+pub struct GroundedControlChecker<J> {
+    judge: J,
+}
+
+impl<J: ControlJudge> GroundedControlChecker<J> {
+    pub fn new(judge: J) -> Self {
+        Self { judge }
+    }
+
+    /// Judge every candidate region for `spec` and return the grounded findings.
+    /// A verdict that doesn't quote real code in its region is dropped by
+    /// [`ground`], so nothing fabricated reaches the caller.
+    pub async fn check(
+        &self,
+        spec: &ControlCheckSpec,
+        regions: &[CandidateRegion],
+        repo_id: &str,
+    ) -> Vec<Finding> {
+        let mut findings = Vec::new();
+        for region in regions {
+            let verdict = self.judge.judge(spec, region).await;
+            if let Some(finding) = ground(spec, region, &verdict, repo_id) {
+                findings.push(finding);
+            }
+        }
+        findings
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::control_check::LlmVerdict;
+    use compliance_core::models::finding::Severity;
+
+    /// Deterministic stub: returns a fixed verdict for every region, so the
+    /// recognize → ground composition is tested without an LLM.
+    struct StubJudge {
+        verdict: LlmVerdict,
+    }
+
+    impl ControlJudge for StubJudge {
+        async fn judge(&self, _spec: &ControlCheckSpec, _region: &CandidateRegion) -> LlmVerdict {
+            self.verdict.clone()
+        }
+    }
+
+    fn spec() -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: "cra-ai-8".into(),
+            title: "No default passwords".into(),
+            requirement: "No default credentials".into(),
+            default_cwe: Some("CWE-798".into()),
+            severity: Severity::High,
+        }
+    }
+
+    fn region(content: &str) -> CandidateRegion {
+        CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 1,
+            content: content.into(),
+        }
+    }
+
+    #[tokio::test]
+    async fn keeps_grounded_and_drops_ungrounded() {
+        let checker = GroundedControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: true,
+                snippet: "PASSWORD = \"admin\"".into(),
+                cwe: None,
+                confidence: 0.9,
+            },
+        });
+        let regions = vec![
+            region("x = 1\nPASSWORD = \"admin\"\n"), // quotes real code → grounded
+            region("totally unrelated code\n"),      // snippet absent → dropped
+        ];
+        let findings = checker.check(&spec(), &regions, "repo").await;
+        assert_eq!(findings.len(), 1);
+        assert_eq!(findings[0].control_refs, vec!["cra-ai-8".to_string()]);
+        assert_eq!(findings[0].line_number, Some(2));
+    }
+
+    #[tokio::test]
+    async fn non_violation_yields_nothing() {
+        let checker = GroundedControlChecker::new(StubJudge {
+            verdict: LlmVerdict {
+                violates: false,
+                snippet: String::new(),
+                cwe: None,
+                confidence: 0.0,
+            },
+        });
+        let findings = checker
+            .check(&spec(), &[region("PASSWORD = \"admin\"\n")], "repo")
+            .await;
+        assert!(findings.is_empty());
+    }
+}

compliance-agent/src/controls/judge.rs

@@ -0,0 +1,167 @@
+//! The "recognize" stage: judge whether a code region violates a control.
+//!
+//! Behind the [`ControlJudge`] trait so the grounded checker can be driven by a
+//! deterministic stub in tests. The real [`LlmControlJudge`] runs the model at
+//! temperature 0 with a closed prompt — it must quote the offending code VERBATIM,
+//! and everything it returns is then re-checked by the grounding gate
+//! ([`compliance_core::control_check::ground`]). The judge is allowed to be
+//! smart; it is never trusted.
+
+use std::sync::Arc;
+
+use serde::Deserialize;
+
+use compliance_core::control_check::{CandidateRegion, ControlCheckSpec, LlmVerdict};
+
+use crate::llm::LlmClient;
+
+/// Prompt/logic version — part of the verdict cache key, bump on any change here.
+pub const PROMPT_VERSION: &str = "control-judge-v1";
+
+const SYSTEM_PROMPT: &str = "You are a precise security & compliance code auditor. \
+You are given ONE compliance control (a requirement) and ONE code region. Decide \
+ONLY whether the code region VIOLATES the control. Rules: (1) Judge only the code \
+shown — never assume code that is not present. (2) If and only if it violates, copy \
+the EXACT offending code VERBATIM into `snippet`, character-for-character from the \
+region — do not paraphrase, reformat, or reconstruct it. (3) If it does not clearly \
+violate, set violates=false and leave snippet empty. (4) Prefer false over guessing. \
+Respond with STRICT JSON only, no prose: \
+{\"violates\": bool, \"snippet\": \"<verbatim code or empty>\", \"cwe\": \"CWE-NNN or null\", \"confidence\": 0.0-1.0}";
+
+/// Judges one (control, region). Async-in-trait so a stub can drive tests.
+#[allow(async_fn_in_trait)]
+pub trait ControlJudge: Send + Sync {
+    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict;
+}
+
+/// The real judge: the LLM at temperature 0 with the closed, verbatim-snippet prompt.
+pub struct LlmControlJudge {
+    llm: Arc<LlmClient>,
+}
+
+impl LlmControlJudge {
+    pub fn new(llm: Arc<LlmClient>) -> Self {
+        Self { llm }
+    }
+}
+
+impl ControlJudge for LlmControlJudge {
+    async fn judge(&self, spec: &ControlCheckSpec, region: &CandidateRegion) -> LlmVerdict {
+        let user = build_user_prompt(spec, region);
+        match self.llm.chat(SYSTEM_PROMPT, &user, Some(0.0)).await {
+            Ok(response) => parse_verdict(&response),
+            Err(e) => {
+                // Fail closed: a transient model error yields no finding, never a
+                // fabricated one.
+                tracing::warn!(control = %spec.control_id, error = %e, "control judge call failed");
+                no_violation()
+            }
+        }
+    }
+}
+
+fn build_user_prompt(spec: &ControlCheckSpec, region: &CandidateRegion) -> String {
+    format!(
+        "CONTROL {id} — {title}\nRequirement: {req}\n\nCODE ({file}, first line = {line}):\n```\n{code}\n```\n\nReturn the JSON verdict.",
+        id = spec.control_id,
+        title = spec.title,
+        req = spec.requirement,
+        file = region.file,
+        line = region.start_line,
+        code = region.content,
+    )
+}
+
+#[derive(Debug, Default, Deserialize)]
+struct RawVerdict {
+    #[serde(default)]
+    violates: bool,
+    #[serde(default)]
+    snippet: String,
+    #[serde(default)]
+    cwe: Option<String>,
+    #[serde(default)]
+    confidence: f64,
+}
+
+/// Parse the model's JSON verdict, tolerant of ```json fencing. Any parse failure
+/// degrades to a non-violation (never a fabricated finding).
+fn parse_verdict(response: &str) -> LlmVerdict {
+    let cleaned = response
+        .trim()
+        .trim_start_matches("```json")
+        .trim_start_matches("```")
+        .trim_end_matches("```")
+        .trim();
+    match serde_json::from_str::<RawVerdict>(cleaned) {
+        Ok(raw) => LlmVerdict {
+            violates: raw.violates,
+            snippet: raw.snippet,
+            cwe: raw.cwe.filter(|c| !c.trim().is_empty()),
+            confidence: raw.confidence,
+        },
+        Err(e) => {
+            tracing::debug!(error = %e, "failed to parse control verdict; treating as non-violation");
+            no_violation()
+        }
+    }
+}
+
+fn no_violation() -> LlmVerdict {
+    LlmVerdict {
+        violates: false,
+        snippet: String::new(),
+        cwe: None,
+        confidence: 0.0,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::finding::Severity;
+
+    fn spec() -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: "cra-ai-8".into(),
+            title: "No default passwords".into(),
+            requirement: "Products must not ship default credentials".into(),
+            default_cwe: Some("CWE-798".into()),
+            severity: Severity::High,
+        }
+    }
+
+    #[test]
+    fn parses_plain_and_fenced_json() {
+        let plain = r#"{"violates": true, "snippet": "PASSWORD = \"x\"", "cwe": "CWE-798", "confidence": 0.9}"#;
+        let v = parse_verdict(plain);
+        assert!(v.violates);
+        assert_eq!(v.snippet, "PASSWORD = \"x\"");
+        assert_eq!(v.cwe.as_deref(), Some("CWE-798"));
+
+        let fenced = "```json\n{\"violates\": false, \"snippet\": \"\", \"cwe\": null, \"confidence\": 0.1}\n```";
+        assert!(!parse_verdict(fenced).violates);
+    }
+
+    #[test]
+    fn garbage_and_empty_cwe_are_safe() {
+        assert!(!parse_verdict("not json at all").violates); // fail closed
+        let no_cwe =
+            parse_verdict(r#"{"violates": true, "snippet": "x", "cwe": "  ", "confidence": 0.5}"#);
+        assert!(no_cwe.cwe.is_none()); // blank CWE normalised away
+    }
+
+    #[test]
+    fn user_prompt_carries_control_and_code() {
+        let region = CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 10,
+            content: "PASSWORD = \"admin\"".into(),
+        };
+        let p = build_user_prompt(&spec(), &region);
+        assert!(p.contains("cra-ai-8"));
+        assert!(p.contains("Products must not ship default credentials"));
+        assert!(p.contains("PASSWORD = \"admin\""));
+        assert!(p.contains("src/auth.py"));
+    }
+}

compliance-agent/src/controls/mod.rs

@@ -0,0 +1,18 @@
+//! Controls corpus providers.
+//!
+//! Implementations of [`compliance_core::traits::ControlsProvider`] that supply
+//! the control corpus the mapping engine assesses findings against. Currently:
+//! [`OscalControlsProvider`], which pulls breakpilot-compliance's OSCAL catalog
+//! and snapshots it locally.
+
+mod checker;
+mod judge;
+mod oscal_provider;
+mod scan_triage;
+mod triage;
+
+pub use checker::GroundedControlChecker;
+pub use judge::{ControlJudge, LlmControlJudge, PROMPT_VERSION};
+pub use oscal_provider::OscalControlsProvider;
+pub use scan_triage::triage_repo_findings;
+pub use triage::{ControlTriage, TriageOutcome};

compliance-agent/src/controls/oscal_provider.rs

@@ -0,0 +1,233 @@
+//! Pull + snapshot [`ControlsProvider`] backed by breakpilot-compliance's OSCAL
+//! catalog export.
+//!
+//! Fetches `GET {base}/api/compliance/v1/oscal/catalog?framework=<fw>`, snapshots
+//! the exact bytes to disk (so scans are deterministic and keep working offline /
+//! on-prem), and maps the catalog into the corpus controls the mapping engine
+//! consumes. The producer owns the catalog; we own the assessment — this is the
+//! ingest half of the loop.
+
+use std::path::PathBuf;
+
+use secrecy::{ExposeSecret, SecretString};
+
+use compliance_core::error::CoreError;
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::models::oscal::OscalDocument;
+use compliance_core::traits::{Control, ControlQuery, ControlsProvider};
+
+/// A [`ControlsProvider`] that pulls the OSCAL catalog from breakpilot-compliance
+/// and snapshots it locally for deterministic / offline reuse.
+pub struct OscalControlsProvider {
+    http: reqwest::Client,
+    base_url: String,
+    token: Option<SecretString>,
+    snapshot_dir: PathBuf,
+}
+
+impl OscalControlsProvider {
+    /// Create a provider. `base_url` is the breakpilot-compliance root (e.g.
+    /// `http://backend-compliance:8002`); `snapshot_dir` is where catalog
+    /// snapshots are written so a later scan can reuse them without the network.
+    pub fn new(
+        http: reqwest::Client,
+        base_url: impl Into<String>,
+        token: Option<SecretString>,
+        snapshot_dir: impl Into<PathBuf>,
+    ) -> Self {
+        Self {
+            http,
+            base_url: base_url.into(),
+            token,
+            snapshot_dir: snapshot_dir.into(),
+        }
+    }
+
+    fn catalog_url(&self, framework: ComplianceFramework) -> String {
+        format!(
+            "{}/api/compliance/v1/oscal/catalog?framework={framework}",
+            self.base_url.trim_end_matches('/')
+        )
+    }
+
+    fn snapshot_path(&self, framework: ComplianceFramework) -> PathBuf {
+        self.snapshot_dir
+            .join(format!("oscal-catalog-{framework}.json"))
+    }
+
+    /// Fetch the raw catalog bytes for a framework over HTTP.
+    async fn fetch_raw(&self, framework: ComplianceFramework) -> Result<Vec<u8>, CoreError> {
+        let mut req = self.http.get(self.catalog_url(framework));
+        if let Some(token) = &self.token {
+            req = req.bearer_auth(token.expose_secret());
+        }
+        let resp = req
+            .send()
+            .await
+            .map_err(|e| CoreError::Http(e.to_string()))?;
+        if !resp.status().is_success() {
+            return Err(CoreError::Http(format!(
+                "catalog fetch for {framework} returned HTTP {}",
+                resp.status()
+            )));
+        }
+        resp.bytes()
+            .await
+            .map(|b| b.to_vec())
+            .map_err(|e| CoreError::Http(e.to_string()))
+    }
+
+    /// Write a catalog snapshot atomically (temp file + rename).
+    async fn write_snapshot(
+        &self,
+        framework: ComplianceFramework,
+        raw: &[u8],
+    ) -> Result<(), CoreError> {
+        tokio::fs::create_dir_all(&self.snapshot_dir).await?;
+        let path = self.snapshot_path(framework);
+        let tmp = path.with_extension("json.tmp");
+        tokio::fs::write(&tmp, raw).await?;
+        tokio::fs::rename(&tmp, &path).await?;
+        Ok(())
+    }
+
+    /// Read a previously written snapshot, if one exists.
+    async fn read_snapshot(
+        &self,
+        framework: ComplianceFramework,
+    ) -> Result<Option<OscalDocument>, CoreError> {
+        match tokio::fs::read(self.snapshot_path(framework)).await {
+            Ok(raw) => Ok(Some(serde_json::from_slice(&raw)?)),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    /// Load the catalog for a framework: fetch fresh + snapshot the exact bytes;
+    /// on network failure, fall back to the last snapshot so scans still run.
+    pub async fn load(&self, framework: ComplianceFramework) -> Result<OscalDocument, CoreError> {
+        match self.fetch_raw(framework).await {
+            Ok(raw) => {
+                let doc: OscalDocument = serde_json::from_slice(&raw)?;
+                if let Err(e) = self.write_snapshot(framework, &raw).await {
+                    tracing::warn!(%framework, error = %e, "failed to write OSCAL snapshot");
+                }
+                Ok(doc)
+            }
+            Err(fetch_err) => match self.read_snapshot(framework).await? {
+                Some(doc) => {
+                    tracing::warn!(
+                        %framework, error = %fetch_err,
+                        "OSCAL catalog fetch failed; falling back to snapshot"
+                    );
+                    Ok(doc)
+                }
+                None => Err(fetch_err),
+            },
+        }
+    }
+}
+
+/// Order controls whose title/text mention the query context first (stable), then
+/// truncate to the requested limit. Naive relevance — refined when the assessment
+/// layer lands.
+fn rank_and_truncate(mut controls: Vec<Control>, context: &str, limit: usize) -> Vec<Control> {
+    if !context.is_empty() {
+        let needle = context.to_lowercase();
+        controls.sort_by_key(|c| {
+            let hit =
+                c.title.to_lowercase().contains(&needle) || c.text.to_lowercase().contains(&needle);
+            u8::from(!hit)
+        });
+    }
+    controls.truncate(limit);
+    controls
+}
+
+impl ControlsProvider for OscalControlsProvider {
+    fn name(&self) -> &str {
+        "breakpilot-oscal"
+    }
+
+    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError> {
+        let mut out: Vec<Control> = Vec::new();
+        for &framework in query.frameworks {
+            match self.load(framework).await {
+                Ok(doc) => out.extend(doc.to_controls()),
+                Err(e) => {
+                    tracing::warn!(%framework, error = %e, "skipping framework: catalog unavailable")
+                }
+            }
+        }
+        Ok(rank_and_truncate(out, query.context, query.limit))
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    const MINI_CATALOG: &str = r#"{"catalog":{"uuid":"u","metadata":{"title":"T",
+      "version":"1.0.0","oscal-version":"1.1.2","props":[{"name":"framework","value":"cra"}]},
+      "groups":[{"id":"g","title":"G","controls":[{"id":"cra-ai-1","title":"MFA",
+      "props":[],"parts":[{"name":"statement","prose":"require mfa"}]}]}]}}"#;
+
+    fn provider(dir: &std::path::Path) -> OscalControlsProvider {
+        OscalControlsProvider::new(reqwest::Client::new(), "http://unused/", None, dir)
+    }
+
+    #[test]
+    fn builds_catalog_url_and_snapshot_path() {
+        let p = provider(std::path::Path::new("/snap"));
+        assert_eq!(
+            p.catalog_url(ComplianceFramework::Cra),
+            "http://unused/api/compliance/v1/oscal/catalog?framework=cra"
+        );
+        assert_eq!(
+            p.snapshot_path(ComplianceFramework::Cra),
+            std::path::Path::new("/snap/oscal-catalog-cra.json")
+        );
+    }
+
+    #[test]
+    fn ranks_context_hits_first_then_truncates() {
+        let mk = |id: &str, title: &str| Control {
+            id: id.into(),
+            framework: ComplianceFramework::Cra,
+            title: title.into(),
+            text: String::new(),
+            source: None,
+        };
+        let controls = vec![
+            mk("a", "logging policy"),
+            mk("b", "multi-factor auth"),
+            mk("c", "backup"),
+        ];
+        let ranked = rank_and_truncate(controls, "auth", 2);
+        assert_eq!(ranked.len(), 2);
+        assert_eq!(ranked[0].id, "b"); // the "auth" hit floats to the top
+    }
+
+    #[tokio::test]
+    async fn snapshot_round_trip_and_offline_fallback() {
+        let dir = std::env::temp_dir().join(format!("oscal-test-{}", uuid::Uuid::new_v4()));
+        let p = provider(&dir);
+        assert!(p
+            .read_snapshot(ComplianceFramework::Cra)
+            .await
+            .unwrap()
+            .is_none());
+        p.write_snapshot(ComplianceFramework::Cra, MINI_CATALOG.as_bytes())
+            .await
+            .unwrap();
+        let doc = p
+            .read_snapshot(ComplianceFramework::Cra)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(doc.to_controls().len(), 1);
+        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}

compliance-agent/src/controls/scan_triage.rs

@@ -0,0 +1,139 @@
+//! Scan-pipeline integration for control triage.
+//!
+//! After the deterministic tools have produced findings, this stamps each finding
+//! with the compliance control(s) it's evidence for and marks control-level false
+//! positives — using the ingested OSCAL catalog for control text, the
+//! `control-map` LUT for the finding→control link, and the grounded LLM judge to
+//! confirm. Skipped entirely unless breakpilot is configured.
+
+use std::collections::HashMap;
+use std::path::Path;
+use std::sync::Arc;
+
+use compliance_core::control_check::{CandidateRegion, ControlCheckSpec};
+use compliance_core::models::finding::{Finding, FindingStatus, Severity};
+use compliance_core::models::onboarding::ComplianceFramework;
+use compliance_core::AgentConfig;
+use control_map::ControlMap;
+
+use super::{ControlTriage, LlmControlJudge, OscalControlsProvider, TriageOutcome};
+use crate::llm::LlmClient;
+
+/// Lines of context to read on each side of a finding's line.
+const REGION_WINDOW: usize = 6;
+
+/// Triage every finding in `findings` against the CRA control map: stamp
+/// `control_refs` on confirmed findings and flag control false positives. Returns
+/// the number of findings tagged with at least one control.
+pub async fn triage_repo_findings(
+    config: &AgentConfig,
+    llm: Arc<LlmClient>,
+    repo_path: &Path,
+    findings: &mut [Finding],
+) -> usize {
+    let Some(base_url) = config.breakpilot.base_url.clone() else {
+        return 0; // control triage is opt-in via BREAKPILOT_BASE_URL
+    };
+    let provider = OscalControlsProvider::new(
+        reqwest::Client::new(),
+        base_url,
+        config.breakpilot.token.clone(),
+        &config.breakpilot.snapshot_dir,
+    );
+    let specs = build_specs(&provider).await;
+    if specs.is_empty() {
+        return 0;
+    }
+    let map = match ControlMap::cra() {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(error = %e, "control map failed to load; skipping control triage");
+            return 0;
+        }
+    };
+    let triage = ControlTriage::new(LlmControlJudge::new(llm), map, specs);
+
+    let mut tagged = 0;
+    for finding in findings.iter_mut() {
+        let (Some(file), Some(line)) = (finding.file_path.clone(), finding.line_number) else {
+            continue;
+        };
+        let Some(region) = fetch_region(repo_path, &file, line) else {
+            continue;
+        };
+        match triage.triage(finding, &region).await {
+            TriageOutcome::Confirmed(controls) => {
+                finding.control_refs = controls;
+                tagged += 1;
+            }
+            TriageOutcome::FalsePositive => {
+                finding.status = FindingStatus::FalsePositive;
+                finding.triage_action = Some("control_false_positive".to_string());
+            }
+            TriageOutcome::Unmapped => {}
+        }
+    }
+    tagged
+}
+
+/// Build the control requirement specs (by id) from the ingested OSCAL catalog.
+async fn build_specs(provider: &OscalControlsProvider) -> HashMap<String, ControlCheckSpec> {
+    let mut specs = HashMap::new();
+    match provider.load(ComplianceFramework::Cra).await {
+        Ok(doc) => {
+            for control in doc.to_controls() {
+                specs.insert(
+                    control.id.clone(),
+                    ControlCheckSpec {
+                        control_id: control.id,
+                        title: control.title,
+                        requirement: control.text,
+                        default_cwe: None,
+                        severity: Severity::Medium,
+                    },
+                );
+            }
+        }
+        Err(e) => tracing::warn!(error = %e, "could not load control catalog for triage"),
+    }
+    specs
+}
+
+/// Read a window of lines around `line` (1-based) from `repo_path/file`.
+fn fetch_region(repo_path: &Path, file: &str, line: u32) -> Option<CandidateRegion> {
+    let content = std::fs::read_to_string(repo_path.join(file)).ok()?;
+    let lines: Vec<&str> = content.lines().collect();
+    if lines.is_empty() {
+        return None;
+    }
+    let center = (line.saturating_sub(1) as usize).min(lines.len() - 1);
+    let start = center.saturating_sub(REGION_WINDOW);
+    let end = (center + REGION_WINDOW + 1).min(lines.len());
+    Some(CandidateRegion {
+        file: file.to_string(),
+        start_line: (start as u32) + 1,
+        content: lines[start..end].join("\n"),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fetch_region_windows_around_the_line() {
+        let dir = std::env::temp_dir().join(format!("triage-region-{}", uuid::Uuid::new_v4()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let file = "a.py";
+        std::fs::write(dir.join(file), "l1\nl2\nl3\nSECRET=1\nl5\nl6\n").unwrap();
+        let r = fetch_region(&dir, file, 4).unwrap();
+        assert!(r.content.contains("SECRET=1"));
+        assert_eq!(r.start_line, 1); // window clamps to file start
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn fetch_region_missing_file_is_none() {
+        assert!(fetch_region(Path::new("/nonexistent"), "nope.py", 1).is_none());
+    }
+}

compliance-agent/src/controls/triage.rs

@@ -0,0 +1,184 @@
+//! Triage step: confirm/refute a deterministic tool finding against the controls
+//! it maps to (via the `control-map` LUT), grounding the judgment.
+//!
+//! This is where the LLM finally enters — as a **false-positive filter over tool
+//! output**, never as the detector (the ZeroFalse / IRIS pattern). A tool
+//! (semgrep, gitleaks, syft/osv) detects deterministically; `controls_for(tool,
+//! cwe)` attaches the finding to the control(s) it's evidence for; the grounded
+//! judge then confirms or refutes each, and only judgments anchored to real code
+//! survive.
+
+use std::collections::HashMap;
+
+use compliance_core::control_check::{ground, CandidateRegion, ControlCheckSpec};
+use compliance_core::models::Finding;
+use control_map::ControlMap;
+
+use super::judge::ControlJudge;
+
+/// What triage decided for one tool finding.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum TriageOutcome {
+    /// The finding maps to no control in the LUT — keep it, untagged.
+    Unmapped,
+    /// Maps to controls and the grounded judge confirmed at least one — keep the
+    /// finding and tag it with these control ids.
+    Confirmed(Vec<String>),
+    /// Maps to controls but the judge grounded none — treat as a false positive.
+    FalsePositive,
+}
+
+/// Triages tool findings against the control map, confirming with a grounded judge.
+pub struct ControlTriage<J> {
+    judge: J,
+    map: ControlMap,
+    /// Control requirement specs (by control id), built from the ingested catalog.
+    specs: HashMap<String, ControlCheckSpec>,
+}
+
+impl<J: ControlJudge> ControlTriage<J> {
+    pub fn new(judge: J, map: ControlMap, specs: HashMap<String, ControlCheckSpec>) -> Self {
+        Self { judge, map, specs }
+    }
+
+    /// Triage one tool finding. `region` is the code around the finding, used as
+    /// the grounding evidence for the judge.
+    pub async fn triage(&self, finding: &Finding, region: &CandidateRegion) -> TriageOutcome {
+        let Some(cwe) = finding.cwe.as_deref() else {
+            return TriageOutcome::Unmapped;
+        };
+        let mapped = self.map.controls_for(&finding.scanner, cwe);
+        if mapped.is_empty() {
+            return TriageOutcome::Unmapped;
+        }
+
+        let mut confirmed = Vec::new();
+        for entry in mapped {
+            let Some(spec) = self.specs.get(&entry.control) else {
+                continue;
+            };
+            let verdict = self.judge.judge(spec, region).await;
+            // The verdict only counts if it grounds to real code in the region.
+            if ground(spec, region, &verdict, &finding.repo_id).is_some() {
+                confirmed.push(entry.control.clone());
+            }
+        }
+
+        if confirmed.is_empty() {
+            TriageOutcome::FalsePositive
+        } else {
+            TriageOutcome::Confirmed(confirmed)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::control_check::LlmVerdict;
+    use compliance_core::models::finding::Severity;
+    use compliance_core::models::scan::ScanType;
+
+    struct StubJudge {
+        verdict: LlmVerdict,
+    }
+    impl ControlJudge for StubJudge {
+        async fn judge(&self, _s: &ControlCheckSpec, _r: &CandidateRegion) -> LlmVerdict {
+            self.verdict.clone()
+        }
+    }
+
+    fn specs() -> HashMap<String, ControlCheckSpec> {
+        let mut m = HashMap::new();
+        m.insert(
+            "cra-ai-8".to_string(),
+            ControlCheckSpec {
+                control_id: "cra-ai-8".into(),
+                title: "No default passwords".into(),
+                requirement: "No default credentials".into(),
+                default_cwe: Some("CWE-798".into()),
+                severity: Severity::High,
+            },
+        );
+        m
+    }
+
+    fn semgrep_finding(cwe: &str) -> Finding {
+        let mut f = Finding::new(
+            "repo".into(),
+            "fp1".into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            "hardcoded credential".into(),
+            "desc".into(),
+            Severity::High,
+        );
+        f.cwe = Some(cwe.into());
+        f
+    }
+
+    fn region() -> CandidateRegion {
+        CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 1,
+            content: "PASSWORD = \"admin123\"\n".into(),
+        }
+    }
+
+    #[tokio::test]
+    async fn confirmed_finding_is_tagged_with_control() {
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: true,
+                    snippet: "PASSWORD = \"admin123\"".into(),
+                    cwe: None,
+                    confidence: 0.9,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs(),
+        );
+        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
+        assert_eq!(out, TriageOutcome::Confirmed(vec!["cra-ai-8".to_string()]));
+    }
+
+    #[tokio::test]
+    async fn refuted_mapped_finding_is_false_positive() {
+        // Maps to cra-ai-8, but the judge doesn't confirm (no violation) → FP.
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: false,
+                    snippet: String::new(),
+                    cwe: None,
+                    confidence: 0.1,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs(),
+        );
+        let out = triage.triage(&semgrep_finding("CWE-798"), &region()).await;
+        assert_eq!(out, TriageOutcome::FalsePositive);
+    }
+
+    #[tokio::test]
+    async fn unmapped_cwe_is_left_untagged() {
+        let triage = ControlTriage::new(
+            StubJudge {
+                verdict: LlmVerdict {
+                    violates: true,
+                    snippet: "PASSWORD = \"admin123\"".into(),
+                    cwe: None,
+                    confidence: 0.9,
+                },
+            },
+            ControlMap::cra().unwrap(),
+            specs(),
+        );
+        let out = triage
+            .triage(&semgrep_finding("CWE-99999"), &region())
+            .await;
+        assert_eq!(out, TriageOutcome::Unmapped);
+    }
+}

compliance-agent/src/ingest/blob.rs

@@ -32,6 +32,30 @@ pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
     Ok((hex::encode(hasher.finalize()), total))
 }
 
+/// Store raw bytes in the content-addressed blob store under `base`, returning
+/// the SHA-256 digest. Used to stash a small derived artifact (e.g. the extracted
+/// PLC program source) so a Werkbank runner can fetch it by hash. Idempotent.
+pub fn store_bytes(base: &Path, bytes: &[u8]) -> Result<String, AgentError> {
+    let sha = hex::encode(Sha256::digest(bytes));
+    let dir = base.join("blobs").join(&sha[0..2]);
+    fs::create_dir_all(&dir)?;
+    let dest = dir.join(&sha);
+    if !dest.exists() {
+        fs::write(&dest, bytes)?;
+    }
+    Ok(sha)
+}
+
+/// Read a blob's bytes by its SHA-256 digest. Rejects a non-hex/wrong-length hash
+/// so a request can't traverse outside the blob store.
+pub fn read_blob(base: &Path, sha: &str) -> Result<Vec<u8>, AgentError> {
+    if sha.len() != 64 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
+    }
+    let path = base.join("blobs").join(&sha[0..2]).join(sha);
+    Ok(fs::read(path)?)
+}
+
 /// Copy `src` into the content-addressed blob store under `base`, returning the
 /// stored path. Idempotent: an already-present blob is not rewritten.
 pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {

compliance-agent/src/ingest/mod.rs

@@ -6,7 +6,7 @@
 //! is also the reconciliation key against sibling products (a firmware sha256
 //! matches tramiton's `Artifact.sha256`).
 
-mod blob;
+pub(crate) mod blob;
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};

compliance-agent/src/lib.rs

@@ -4,6 +4,7 @@ pub mod agent;
 pub mod api;
 pub mod classify;
 pub mod config;
+pub mod controls;
 pub mod database;
 pub mod error;
 pub mod ingest;

compliance-agent/src/pentest/cleanup.rs

@@ -344,6 +344,7 @@ mod tests {
             tenant_registry_url: None,
             plc_runtime: compliance_core::PlcRuntimeConfig::default(),
             werkbank_runner_token: None,
+            breakpilot: compliance_core::config::BreakpilotConfig::default(),
         }
     }
 

compliance-agent/src/pipeline/orchestrator.rs

@@ -215,6 +215,21 @@ impl PipelineOrchestrator {
         .await;
         tracing::info!("[{repo_id}] Triaged: {triaged} findings passed confidence threshold");
 
+        // Stage 5b: control triage — stamp findings with the compliance control(s)
+        // they're evidence for and flag control false positives (grounded LLM over
+        // deterministic tool output). No-op unless breakpilot is configured.
+        self.update_phase(scan_run_id, "control_triage").await;
+        let tagged = crate::controls::triage_repo_findings(
+            &self.config,
+            self.llm.clone(),
+            &repo_path,
+            &mut all_findings,
+        )
+        .await;
+        if tagged > 0 {
+            tracing::info!("[{repo_id}] Control triage tagged {tagged} findings with control refs");
+        }
+
         // Dedup against existing findings and insert new ones
         let mut new_count = 0u32;
         let mut new_findings: Vec<Finding> = Vec::new();

compliance-agent/src/pipeline/semgrep.rs

@@ -82,10 +82,7 @@ impl Scanner for SemgrepScanner {
                 finding.file_path = Some(r.path);
                 finding.line_number = Some(r.start.line);
                 finding.code_snippet = Some(r.extra.lines);
-                finding.cwe = r
-                    .extra
-                    .metadata
-                    .and_then(|m| m.get("cwe").and_then(|v| v.as_str()).map(|s| s.to_string()));
+                finding.cwe = r.extra.metadata.as_ref().and_then(extract_cwe);
                 finding
             })
             .collect();
@@ -124,10 +121,34 @@ struct SemgrepExtra {
     metadata: Option<serde_json::Value>,
 }
 
+/// semgrep emits `metadata.cwe` as a list of strings like
+/// `"CWE-798: Use of Hard-coded Credentials"` (occasionally a bare string). Take
+/// the first entry and normalise it to just the `CWE-NNN` id.
+fn extract_cwe(metadata: &serde_json::Value) -> Option<String> {
+    let raw = metadata.get("cwe")?;
+    let text = match raw {
+        serde_json::Value::Array(items) => items.first()?.as_str()?,
+        serde_json::Value::String(s) => s.as_str(),
+        _ => return None,
+    };
+    let id = text.split(':').next().unwrap_or(text).trim();
+    (!id.is_empty()).then(|| id.to_string())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn extract_cwe_handles_list_and_normalises() {
+        let md = serde_json::json!({"cwe": ["CWE-798: Use of Hard-coded Credentials"]});
+        assert_eq!(extract_cwe(&md).as_deref(), Some("CWE-798"));
+        let bare = serde_json::json!({"cwe": "CWE-89"});
+        assert_eq!(extract_cwe(&bare).as_deref(), Some("CWE-89"));
+        let none = serde_json::json!({"severity": "ERROR"});
+        assert_eq!(extract_cwe(&none), None);
+    }
+
     #[test]
     fn deserialize_semgrep_output() {
         let json = r#"{

compliance-agent/tests/common/mod.rs

@@ -60,6 +60,7 @@ pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
         tenant_registry_url: None,
         plc_runtime: compliance_core::PlcRuntimeConfig::default(),
         werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
+        breakpilot: compliance_core::config::BreakpilotConfig::default(),
     }
 }
 

compliance-agent/tests/werkbank_api.rs

@@ -11,7 +11,7 @@ mod common;
 
 use std::sync::Arc;
 
-use axum::routing::post;
+use axum::routing::{get, post};
 use axum::{middleware, Extension, Router};
 
 use compliance_agent::agent::ComplianceAgent;
@@ -19,7 +19,9 @@ use compliance_agent::api::handlers::werkbank_jobs;
 use compliance_agent::database::DatabasePool;
 use compliance_agent::werkbank::JobQueue;
 use compliance_core::models::werkbank::{InputRef, Job, JobResult, JobStatus, LeasedJob};
-use compliance_core::models::{Finding, ScanType, Severity};
+use compliance_core::models::{
+    Artifact, Finding, OnboardedTarget, PlcFormat, ScanType, Severity, TargetType,
+};
 
 use common::{dev_config, TEST_RUNNER_TOKEN};
 
@@ -58,6 +60,14 @@ async fn start() -> Option<Harness> {
             "/api/v1/werkbank/jobs/complete",
             post(werkbank_jobs::complete),
         )
+        .route(
+            "/api/v1/werkbank/jobs/enqueue",
+            post(werkbank_jobs::enqueue),
+        )
+        .route(
+            "/api/v1/werkbank/artifacts/{hash}",
+            get(werkbank_jobs::serve_artifact),
+        )
         .layer(middleware::from_fn(werkbank_jobs::require_runner_token))
         .layer(Extension(Arc::new(agent)));
 
@@ -177,6 +187,65 @@ async fn lease_complete_persists_findings_against_the_target() {
     h.cleanup().await;
 }
 
+#[tokio::test]
+async fn enqueue_extracts_program_stores_a_blob_and_serves_it() {
+    let Some(h) = start().await else { return };
+    let db = h.pool.for_tenant_id(TENANT).await.unwrap();
+
+    // A PlcSps target with a single complete ST program uploaded.
+    let dir = std::env::temp_dir().join(format!("wbq-prog-{}", uuid::Uuid::new_v4()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let st = dir.join("main.st");
+    std::fs::write(
+        &st,
+        "PROGRAM Main\nEND_PROGRAM\nCONFIGURATION C\n  RESOURCE R\nEND_CONFIGURATION\n",
+    )
+    .unwrap();
+    let mut target = OnboardedTarget::new("plc".into(), TargetType::PlcSps);
+    let mut art = Artifact::plc_project("main.st", PlcFormat::StructuredText);
+    art.stored_path = Some(st.to_string_lossy().to_string());
+    target.artifacts.push(art);
+    let ins = db.onboarded_targets().insert_one(&target).await.unwrap();
+    let target_id = ins.inserted_id.as_object_id().unwrap().to_hex();
+
+    // Enqueue → a plc-provision job whose program is a content-addressed blob.
+    let resp = h
+        .post(
+            "/api/v1/werkbank/jobs/enqueue",
+            Some(TEST_RUNNER_TOKEN),
+            serde_json::json!({ "tenant": TENANT, "target_id": target_id }),
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "enqueue should succeed");
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let job_id = body["job_id"].as_str().unwrap().to_string();
+
+    let rec = JobQueue::new(&db).get(&job_id).await.unwrap().unwrap();
+    let hash = rec
+        .job
+        .inputs
+        .get("program")
+        .and_then(|i| i.blob.clone())
+        .expect("program blob");
+
+    // Serve the blob back and confirm it's the program source (what the runner
+    // would fetch).
+    let served = h
+        .client
+        .get(format!("{}/api/v1/werkbank/artifacts/{hash}", h.base_url))
+        .bearer_auth(TEST_RUNNER_TOKEN)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(served.status(), 200);
+    assert!(served.text().await.unwrap().contains("CONFIGURATION"));
+
+    h.cleanup().await;
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[tokio::test]
 async fn empty_queue_leases_nothing() {
     let Some(h) = start().await else { return };

compliance-core/src/config.rs

@@ -58,6 +58,33 @@ pub struct AgentConfig {
     /// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
     /// `None`, those endpoints are not mounted at all.
     pub werkbank_runner_token: Option<SecretString>,
+    /// Source for the OSCAL control catalog pulled from breakpilot-compliance
+    /// (drives the [`crate::traits::ControlsProvider`]). Disabled when
+    /// `base_url` is `None`.
+    pub breakpilot: BreakpilotConfig,
+}
+
+/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
+/// to snapshot it for deterministic / offline reuse.
+#[derive(Debug, Clone)]
+pub struct BreakpilotConfig {
+    /// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
+    /// the OSCAL controls provider.
+    pub base_url: Option<String>,
+    /// Optional bearer token for the catalog endpoint.
+    pub token: Option<SecretString>,
+    /// Directory for catalog snapshots.
+    pub snapshot_dir: String,
+}
+
+impl Default for BreakpilotConfig {
+    fn default() -> Self {
+        Self {
+            base_url: None,
+            token: None,
+            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
+        }
+    }
 }
 
 /// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).

compliance-core/src/control_check.rs

@@ -0,0 +1,204 @@
+//! Grounded control-driven checking.
+//!
+//! Turns a *text* control into findings via an LLM used as a **pattern-recognizer**
+//! whose output is grounded to real code — so a hallucinated finding cannot
+//! survive. Determinism is structural, not a prompt plea:
+//!
+//! 1. the LLM only ever judges *retrieved* regions — it can't invent findings in
+//!    code it never saw;
+//! 2. a verdict becomes a finding only if its quoted snippet appears **verbatim**
+//!    in the region, and the line is recomputed from that match — the model's own
+//!    line number is never trusted ([`ground`]);
+//! 3. verdicts are cached by content hash ([`cache_key`]) so re-scans reproduce.
+//!
+//! The LLM supplies cross-language / cross-stack pattern recognition; this module
+//! supplies the determinism.
+
+use sha2::{Digest, Sha256};
+
+use crate::models::finding::{Finding, Severity};
+use crate::models::scan::ScanType;
+
+/// A control rendered as a check the LLM judges code against.
+#[derive(Debug, Clone)]
+pub struct ControlCheckSpec {
+    /// Stable control id, e.g. `"cra-ai-8"`.
+    pub control_id: String,
+    /// Short control title (used in the finding title).
+    pub title: String,
+    /// The requirement text the LLM judges against (control objective/statement).
+    pub requirement: String,
+    /// CWE to fall back to when the model doesn't supply one.
+    pub default_cwe: Option<String>,
+    /// Severity for findings raised from this control.
+    pub severity: Severity,
+}
+
+/// A retrieved code region the LLM judges — never the whole repo.
+#[derive(Debug, Clone)]
+pub struct CandidateRegion {
+    /// Repo-relative path.
+    pub file: String,
+    /// 1-based line number of the region's first line in `file`.
+    pub start_line: u32,
+    /// The region's source text.
+    pub content: String,
+}
+
+/// The LLM's structured verdict for one (control, region). `snippet` is the
+/// verbatim code the model claims proves the violation — it is the anchor the
+/// grounding gate checks.
+#[derive(Debug, Clone)]
+pub struct LlmVerdict {
+    pub violates: bool,
+    pub snippet: String,
+    pub cwe: Option<String>,
+    pub confidence: f64,
+}
+
+/// The grounding gate. A verdict becomes a [`Finding`] only if it claims a
+/// violation AND its quoted `snippet` appears verbatim in `region.content`; the
+/// finding's line is computed from the match, so a fabricated or mis-located
+/// snippet is dropped. Pure — no LLM, no I/O.
+pub fn ground(
+    spec: &ControlCheckSpec,
+    region: &CandidateRegion,
+    verdict: &LlmVerdict,
+    repo_id: &str,
+) -> Option<Finding> {
+    if !verdict.violates {
+        return None;
+    }
+    let snippet = verdict.snippet.trim();
+    if snippet.is_empty() {
+        return None;
+    }
+    // Grounding: the quoted snippet must literally exist in the retrieved region.
+    let pos = region.content.find(snippet)?;
+    // Recompute the real line from the match — never trust the model's number.
+    let newlines_before = region.content[..pos].matches('\n').count();
+    let line = region.start_line + newlines_before as u32;
+
+    let mut finding = Finding::new(
+        repo_id.to_string(),
+        control_finding_fingerprint(&spec.control_id, &region.file, snippet),
+        "control-check".to_string(),
+        ScanType::CodeReview,
+        format!("{}: {}", spec.control_id, spec.title),
+        format!(
+            "Control {} appears violated ({}) at {}:{line}",
+            spec.control_id, spec.requirement, region.file
+        ),
+        spec.severity.clone(),
+    );
+    finding.cwe = verdict.cwe.clone().or_else(|| spec.default_cwe.clone());
+    finding.file_path = Some(region.file.clone());
+    finding.line_number = Some(line);
+    finding.code_snippet = Some(snippet.to_string());
+    finding.confidence = Some(verdict.confidence);
+    // Carry the control reference on the finding.
+    finding.control_refs = vec![spec.control_id.clone()];
+    Some(finding)
+}
+
+/// Deterministic cache key for a (control, region, model, prompt-version) verdict
+/// so identical inputs reproduce the same verdict without another LLM call.
+pub fn cache_key(
+    control_id: &str,
+    region_content: &str,
+    model: &str,
+    prompt_version: &str,
+) -> String {
+    hash_parts(&[control_id, region_content, model, prompt_version])
+}
+
+fn control_finding_fingerprint(control_id: &str, file: &str, snippet: &str) -> String {
+    hash_parts(&[control_id, file, snippet])
+}
+
+fn hash_parts(parts: &[&str]) -> String {
+    let mut hasher = Sha256::new();
+    for part in parts {
+        hasher.update(part.as_bytes());
+        hasher.update([0u8]); // domain separator between parts
+    }
+    hex::encode(hasher.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn spec() -> ControlCheckSpec {
+        ControlCheckSpec {
+            control_id: "cra-ai-8".into(),
+            title: "No default passwords".into(),
+            requirement: "Products must not ship default credentials".into(),
+            default_cwe: Some("CWE-798".into()),
+            severity: Severity::High,
+        }
+    }
+
+    fn region() -> CandidateRegion {
+        CandidateRegion {
+            file: "src/auth.py".into(),
+            start_line: 10,
+            content: "def login():\n    PASSWORD = \"admin123\"\n    return PASSWORD\n".into(),
+        }
+    }
+
+    #[test]
+    fn grounds_real_snippet_with_recomputed_line() {
+        let v = LlmVerdict {
+            violates: true,
+            snippet: "PASSWORD = \"admin123\"".into(),
+            cwe: None,
+            confidence: 0.9,
+        };
+        let f = ground(&spec(), &region(), &v, "repo").expect("should ground");
+        assert_eq!(f.line_number, Some(11)); // 2nd line of a region starting at 10
+        assert_eq!(f.cwe.as_deref(), Some("CWE-798")); // fell back to the spec default
+        assert_eq!(f.control_refs, vec!["cra-ai-8".to_string()]); // control ref carried
+        assert_eq!(f.file_path.as_deref(), Some("src/auth.py"));
+        assert_eq!(f.code_snippet.as_deref(), Some("PASSWORD = \"admin123\""));
+    }
+
+    #[test]
+    fn drops_fabricated_snippet_not_in_region() {
+        let v = LlmVerdict {
+            violates: true,
+            snippet: "SECRET = \"totally-made-up\"".into(),
+            cwe: None,
+            confidence: 0.99,
+        };
+        assert!(ground(&spec(), &region(), &v, "repo").is_none());
+    }
+
+    #[test]
+    fn drops_non_violation_and_empty_snippet() {
+        let no = LlmVerdict {
+            violates: false,
+            snippet: "PASSWORD = \"admin123\"".into(),
+            cwe: None,
+            confidence: 0.9,
+        };
+        assert!(ground(&spec(), &region(), &no, "repo").is_none());
+        let empty = LlmVerdict {
+            violates: true,
+            snippet: "   ".into(),
+            cwe: None,
+            confidence: 0.9,
+        };
+        assert!(ground(&spec(), &region(), &empty, "repo").is_none());
+    }
+
+    #[test]
+    fn cache_key_and_fingerprint_are_deterministic() {
+        assert_eq!(cache_key("c", "x", "m", "v"), cache_key("c", "x", "m", "v"));
+        assert_ne!(cache_key("c", "x", "m", "v"), cache_key("c", "y", "m", "v"));
+        assert_eq!(
+            control_finding_fingerprint("c", "f", "s"),
+            control_finding_fingerprint("c", "f", "s")
+        );
+    }
+}

compliance-core/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod config;
+pub mod control_check;
 pub mod db;
 pub mod error;
 pub mod models;

compliance-core/src/models/finding.rs

@@ -76,6 +76,10 @@ pub struct Finding {
     pub triage_rationale: Option<String>,
     /// Developer feedback on finding quality
     pub developer_feedback: Option<String>,
+    /// Compliance control ids this finding is evidence for (stamped by control
+    /// triage against the `control-map` LUT). Empty when unmapped.
+    #[serde(default)]
+    pub control_refs: Vec<String>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
     pub created_at: DateTime<Utc>,
     #[serde(with = "super::serde_helpers::bson_datetime")]
@@ -118,6 +122,7 @@ impl Finding {
             triage_action: None,
             triage_rationale: None,
             developer_feedback: None,
+            control_refs: Vec::new(),
             created_at: now,
             updated_at: now,
         }

compliance-core/src/models/mod.rs

@@ -10,6 +10,8 @@ pub mod mcp;
 pub mod mcp_token;
 pub mod notification;
 pub mod onboarding;
+pub mod oscal;
+pub mod oscal_assessment;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
@@ -39,6 +41,8 @@ pub use onboarding::{
     GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
     TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
 };
+pub use oscal::OscalDocument;
+pub use oscal_assessment::{assess, AssessmentResultsDoc, ControlLinker};
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
     PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,

compliance-core/src/models/oscal.rs

@@ -0,0 +1,250 @@
+//! OSCAL 1.1 catalog types + mapping into the controls corpus.
+//!
+//! Deserialises the OSCAL catalog served by breakpilot-compliance
+//! (`GET /api/compliance/v1/oscal/catalog`) and maps its controls into the
+//! framework-agnostic [`crate::traits::Control`] that the mapping engine consumes.
+//! Only the fields we use are modelled; unknown OSCAL fields are ignored so the
+//! producer can add detail without breaking us.
+//!
+//! Scope boundary: this is the *catalog* (domain content). Assessment objectives
+//! and scanner routing live in our assessment layer, not here — see
+//! [`crate::traits::ControlsProvider`].
+
+use serde::Deserialize;
+
+use crate::models::onboarding::ComplianceFramework;
+use crate::traits::Control as CorpusControl;
+
+/// A parsed OSCAL catalog document (`{"catalog": {...}}`).
+#[derive(Debug, Clone, Deserialize)]
+pub struct OscalDocument {
+    pub catalog: Catalog,
+}
+
+/// An OSCAL catalog: metadata + a tree of control groups.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Catalog {
+    pub uuid: String,
+    pub metadata: Metadata,
+    #[serde(default)]
+    pub groups: Vec<Group>,
+    #[serde(rename = "back-matter", default)]
+    pub back_matter: Option<BackMatter>,
+}
+
+/// Catalog metadata (title/version + provenance props).
+#[derive(Debug, Clone, Deserialize)]
+pub struct Metadata {
+    pub title: String,
+    pub version: String,
+    #[serde(rename = "oscal-version")]
+    pub oscal_version: String,
+    #[serde(default)]
+    pub props: Vec<Prop>,
+}
+
+/// A name/value property, optionally namespaced.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Prop {
+    pub name: String,
+    pub value: String,
+    #[serde(default)]
+    pub ns: Option<String>,
+}
+
+/// A control group (may nest sub-groups and controls).
+#[derive(Debug, Clone, Deserialize)]
+pub struct Group {
+    #[serde(default)]
+    pub id: String,
+    #[serde(default)]
+    pub title: String,
+    #[serde(default)]
+    pub controls: Vec<Control>,
+    #[serde(default)]
+    pub groups: Vec<Group>,
+}
+
+/// An OSCAL control (may nest enhancement controls).
+#[derive(Debug, Clone, Deserialize)]
+pub struct Control {
+    pub id: String,
+    #[serde(default)]
+    pub title: String,
+    #[serde(default)]
+    pub props: Vec<Prop>,
+    #[serde(default)]
+    pub parts: Vec<Part>,
+    #[serde(default)]
+    pub links: Vec<Link>,
+    #[serde(default)]
+    pub controls: Vec<Control>,
+}
+
+/// A control part (e.g. the `statement`), may nest sub-parts.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Part {
+    #[serde(default)]
+    pub name: String,
+    #[serde(default)]
+    pub prose: Option<String>,
+    #[serde(default)]
+    pub parts: Vec<Part>,
+}
+
+/// A link, e.g. a `reference` to a back-matter resource.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Link {
+    pub href: String,
+    #[serde(default)]
+    pub rel: Option<String>,
+}
+
+/// Back-matter holding referenced resources (e.g. the CRA measures).
+#[derive(Debug, Clone, Deserialize)]
+pub struct BackMatter {
+    #[serde(default)]
+    pub resources: Vec<Resource>,
+}
+
+/// A back-matter resource referenced by control links.
+#[derive(Debug, Clone, Deserialize)]
+pub struct Resource {
+    pub uuid: String,
+    #[serde(default)]
+    pub title: Option<String>,
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
+impl Metadata {
+    /// First prop value with the given name.
+    pub fn prop(&self, name: &str) -> Option<&str> {
+        self.props
+            .iter()
+            .find(|p| p.name == name)
+            .map(|p| p.value.as_str())
+    }
+}
+
+impl Control {
+    /// First prop value with the given name.
+    pub fn prop(&self, name: &str) -> Option<&str> {
+        self.props
+            .iter()
+            .find(|p| p.name == name)
+            .map(|p| p.value.as_str())
+    }
+
+    /// The control's `statement` prose, if present.
+    pub fn statement(&self) -> Option<&str> {
+        self.parts
+            .iter()
+            .find(|p| p.name == "statement")
+            .and_then(|p| p.prose.as_deref())
+    }
+}
+
+impl OscalDocument {
+    /// The framework this catalog declares (`metadata.props[name="framework"]`).
+    pub fn framework(&self) -> Option<ComplianceFramework> {
+        framework_from_str(self.catalog.metadata.prop("framework")?)
+    }
+
+    /// The catalog `content-hash` prop — consumers pin this to snapshot/detect drift.
+    pub fn content_hash(&self) -> Option<&str> {
+        self.catalog.metadata.prop("content-hash")
+    }
+
+    /// Flatten the catalog into the corpus controls the mapping engine consumes.
+    pub fn to_controls(&self) -> Vec<CorpusControl> {
+        let framework = self.framework().unwrap_or(ComplianceFramework::Cra);
+        let source_label = self.catalog.metadata.title.as_str();
+        let mut out = Vec::new();
+        for group in &self.catalog.groups {
+            collect_group(group, framework, source_label, &mut out);
+        }
+        out
+    }
+}
+
+/// Map an OSCAL framework token (e.g. `"cra"`) to [`ComplianceFramework`] via its
+/// serde snake_case representation.
+fn framework_from_str(raw: &str) -> Option<ComplianceFramework> {
+    serde_json::from_value(serde_json::Value::String(raw.to_string())).ok()
+}
+
+fn collect_group(
+    group: &Group,
+    framework: ComplianceFramework,
+    source_label: &str,
+    out: &mut Vec<CorpusControl>,
+) {
+    for control in &group.controls {
+        collect_control(control, framework, source_label, out);
+    }
+    for sub in &group.groups {
+        collect_group(sub, framework, source_label, out);
+    }
+}
+
+fn collect_control(
+    control: &Control,
+    framework: ComplianceFramework,
+    source_label: &str,
+    out: &mut Vec<CorpusControl>,
+) {
+    let source = match control.prop("annex-anchor") {
+        Some(anchor) => Some(format!("{source_label} · {anchor}")),
+        None => Some(source_label.to_string()),
+    };
+    out.push(CorpusControl {
+        id: control.id.clone(),
+        framework,
+        title: control.title.clone(),
+        text: control.statement().unwrap_or_default().to_string(),
+        source,
+    });
+    for enhancement in &control.controls {
+        collect_control(enhancement, framework, source_label, out);
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    const CATALOG: &str = include_str!("../../tests/data/cra_catalog.json");
+
+    fn parse() -> OscalDocument {
+        serde_json::from_str(CATALOG).unwrap()
+    }
+
+    #[test]
+    fn parses_full_catalog() {
+        let doc = parse();
+        assert_eq!(doc.catalog.metadata.oscal_version, "1.1.2");
+        assert!(!doc.catalog.groups.is_empty());
+        assert!(doc.catalog.back_matter.is_some());
+    }
+
+    #[test]
+    fn maps_all_controls_to_corpus() {
+        let doc = parse();
+        let controls = doc.to_controls();
+        assert_eq!(controls.len(), 40);
+        assert_eq!(doc.framework(), Some(ComplianceFramework::Cra));
+
+        let c8 = controls.iter().find(|c| c.id == "cra-ai-8").unwrap();
+        assert_eq!(c8.framework, ComplianceFramework::Cra);
+        assert!(!c8.title.is_empty());
+        assert!(!c8.text.is_empty(), "statement prose should map into text");
+        assert!(c8.source.as_deref().unwrap_or_default().contains("Annex I"));
+    }
+
+    #[test]
+    fn exposes_content_hash_for_snapshotting() {
+        assert_eq!(parse().content_hash().map(str::len), Some(64));
+    }
+}

compliance-core/src/models/oscal_assessment.rs

@@ -0,0 +1,402 @@
+//! OSCAL 1.1 assessment-results — assess our findings against catalog controls.
+//!
+//! The catalog (domain content) comes from the producer; the **assessment** is
+//! ours. This links compliance [`Finding`]s to catalog control-ids and emits a
+//! standard OSCAL assessment-results document: an observation per linked finding,
+//! and a per-control finding with a `not-satisfied` status. `reviewed-controls`
+//! records the full catalog set we considered.
+//!
+//! Deterministic: stable `uuid5` ids; the caller supplies the assessment
+//! timestamp. Pure — no DB, no network.
+
+use std::collections::HashMap;
+
+use chrono::{DateTime, Utc};
+use serde::Serialize;
+use uuid::Uuid;
+
+use crate::models::finding::Finding;
+use crate::traits::Control;
+
+const OSCAL_VERSION: &str = "1.1.2";
+/// Same namespace as the catalog exporter, so ids are stable and correlatable.
+const NAMESPACE: Uuid = Uuid::from_bytes([
+    0x6f, 0x1e, 0x7c, 0x2a, 0x3b, 0x4d, 0x5e, 0x6f, 0x8a, 0x9b, 0x0c, 0x1d, 0x2e, 0x3f, 0x4a, 0x5b,
+]);
+
+fn det_uuid(name: &str) -> String {
+    Uuid::new_v5(&NAMESPACE, name.as_bytes()).to_string()
+}
+
+/// Links findings to the catalog control-ids they provide evidence for.
+pub struct ControlLinker {
+    cwe_to_controls: HashMap<u32, Vec<String>>,
+}
+
+impl ControlLinker {
+    /// Build a linker from an explicit CWE → control-id map.
+    pub fn new(cwe_to_controls: HashMap<u32, Vec<String>>) -> Self {
+        Self { cwe_to_controls }
+    }
+
+    /// Seed of CWE → CRA Annex I control mappings (mirrors breakpilot's
+    /// `_CWE_TO_REQ`; extend as scanner coverage grows).
+    pub fn cra_seed() -> Self {
+        let pairs: &[(u32, &str)] = &[
+            (798, "cra-ai-8"),
+            (259, "cra-ai-8"),
+            (1392, "cra-ai-8"),
+            (327, "cra-ai-13"),
+            (326, "cra-ai-13"),
+            (319, "cra-ai-15"),
+            (311, "cra-ai-15"),
+            (89, "cra-ai-20"),
+            (79, "cra-ai-20"),
+            (78, "cra-ai-20"),
+            (22, "cra-ai-20"),
+        ];
+        let mut map: HashMap<u32, Vec<String>> = HashMap::new();
+        for (cwe, id) in pairs {
+            map.entry(*cwe).or_default().push((*id).to_string());
+        }
+        Self::new(map)
+    }
+
+    /// Parse a CWE token such as `"CWE-798"` or `"798"` into its number.
+    fn parse_cwe(raw: &str) -> Option<u32> {
+        raw.trim_start_matches(|c: char| !c.is_ascii_digit())
+            .split(|c: char| !c.is_ascii_digit())
+            .next()
+            .filter(|s| !s.is_empty())
+            .and_then(|s| s.parse().ok())
+    }
+
+    /// The control-ids a finding provides evidence for (via its CWE).
+    pub fn controls_for(&self, finding: &Finding) -> Vec<String> {
+        finding
+            .cwe
+            .as_deref()
+            .and_then(Self::parse_cwe)
+            .and_then(|cwe| self.cwe_to_controls.get(&cwe))
+            .cloned()
+            .unwrap_or_default()
+    }
+}
+
+/// Assess `findings` against `controls`: link findings to control-ids and build a
+/// standard OSCAL assessment-results document. `at` is the assessment timestamp.
+pub fn assess(
+    controls: &[Control],
+    findings: &[Finding],
+    linker: &ControlLinker,
+    at: DateTime<Utc>,
+) -> AssessmentResultsDoc {
+    let ts = at.to_rfc3339();
+
+    let mut observations = Vec::new();
+    let mut obs_by_control: HashMap<String, Vec<String>> = HashMap::new();
+    for finding in findings {
+        let targets = linker.controls_for(finding);
+        if targets.is_empty() {
+            continue;
+        }
+        let obs_uuid = det_uuid(&format!("obs:{}", finding.fingerprint));
+        let location = match (&finding.file_path, finding.line_number) {
+            (Some(f), Some(l)) => Some(format!("{f}:{l}")),
+            (Some(f), None) => Some(f.clone()),
+            _ => None,
+        };
+        observations.push(Observation {
+            uuid: obs_uuid.clone(),
+            description: finding.title.clone(),
+            methods: vec!["TEST".to_string()],
+            collected: ts.clone(),
+            relevant_evidence: vec![RelevantEvidence {
+                href: location.map(|l| format!("file://{l}")),
+                description: format!("[{}] {}", finding.scanner, finding.title),
+            }],
+        });
+        for control_id in targets {
+            obs_by_control
+                .entry(control_id)
+                .or_default()
+                .push(obs_uuid.clone());
+        }
+    }
+
+    let titles: HashMap<&str, &str> = controls
+        .iter()
+        .map(|c| (c.id.as_str(), c.title.as_str()))
+        .collect();
+    let mut hit_controls: Vec<&String> = obs_by_control.keys().collect();
+    hit_controls.sort();
+    let ar_findings: Vec<ArFinding> = hit_controls
+        .into_iter()
+        .map(|control_id| {
+            let title = titles.get(control_id.as_str()).copied().unwrap_or("");
+            ArFinding {
+                uuid: det_uuid(&format!("finding:{control_id}")),
+                title: format!("Findings affect {control_id}: {title}"),
+                target: FindingTarget {
+                    target_type: "statement-id".to_string(),
+                    target_id: format!("{control_id}_smt"),
+                    status: TargetStatus {
+                        state: "not-satisfied".to_string(),
+                    },
+                },
+                related_observations: obs_by_control[control_id]
+                    .iter()
+                    .map(|u| RelatedObservation {
+                        observation_uuid: u.clone(),
+                    })
+                    .collect(),
+            }
+        })
+        .collect();
+
+    let include_controls = controls
+        .iter()
+        .map(|c| SelectControlById {
+            control_id: c.id.clone(),
+        })
+        .collect();
+
+    let result = ArResult {
+        uuid: det_uuid("result:cra"),
+        title: "Automated code-compliance assessment".to_string(),
+        description: format!(
+            "{} finding-linked observation(s) across {} reviewed control(s)",
+            observations.len(),
+            controls.len()
+        ),
+        start: ts.clone(),
+        reviewed_controls: ReviewedControls {
+            control_selections: vec![ControlSelection { include_controls }],
+        },
+        observations,
+        findings: ar_findings,
+    };
+
+    AssessmentResultsDoc {
+        assessment_results: AssessmentResults {
+            uuid: det_uuid("assessment-results:cra"),
+            metadata: ArMetadata {
+                title: "Compliance scanner — OSCAL assessment results".to_string(),
+                last_modified: ts,
+                version: "1.0.0".to_string(),
+                oscal_version: OSCAL_VERSION.to_string(),
+            },
+            import_ap: ImportAp {
+                href: "#cra-annex-i".to_string(),
+            },
+            results: vec![result],
+        },
+    }
+}
+
+// ── OSCAL assessment-results document (serialise) ────────────────────────────
+
+/// The root OSCAL assessment-results document.
+#[derive(Debug, Clone, Serialize)]
+pub struct AssessmentResultsDoc {
+    #[serde(rename = "assessment-results")]
+    pub assessment_results: AssessmentResults,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct AssessmentResults {
+    pub uuid: String,
+    pub metadata: ArMetadata,
+    #[serde(rename = "import-ap")]
+    pub import_ap: ImportAp,
+    pub results: Vec<ArResult>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArMetadata {
+    pub title: String,
+    #[serde(rename = "last-modified")]
+    pub last_modified: String,
+    pub version: String,
+    #[serde(rename = "oscal-version")]
+    pub oscal_version: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ImportAp {
+    pub href: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArResult {
+    pub uuid: String,
+    pub title: String,
+    pub description: String,
+    pub start: String,
+    #[serde(rename = "reviewed-controls")]
+    pub reviewed_controls: ReviewedControls,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub observations: Vec<Observation>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub findings: Vec<ArFinding>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ReviewedControls {
+    #[serde(rename = "control-selections")]
+    pub control_selections: Vec<ControlSelection>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ControlSelection {
+    #[serde(rename = "include-controls", skip_serializing_if = "Vec::is_empty")]
+    pub include_controls: Vec<SelectControlById>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SelectControlById {
+    #[serde(rename = "control-id")]
+    pub control_id: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Observation {
+    pub uuid: String,
+    pub description: String,
+    pub methods: Vec<String>,
+    pub collected: String,
+    #[serde(rename = "relevant-evidence", skip_serializing_if = "Vec::is_empty")]
+    pub relevant_evidence: Vec<RelevantEvidence>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct RelevantEvidence {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub href: Option<String>,
+    pub description: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ArFinding {
+    pub uuid: String,
+    pub title: String,
+    pub target: FindingTarget,
+    #[serde(rename = "related-observations", skip_serializing_if = "Vec::is_empty")]
+    pub related_observations: Vec<RelatedObservation>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct FindingTarget {
+    #[serde(rename = "type")]
+    pub target_type: String,
+    #[serde(rename = "target-id")]
+    pub target_id: String,
+    pub status: TargetStatus,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct TargetStatus {
+    pub state: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct RelatedObservation {
+    #[serde(rename = "observation-uuid")]
+    pub observation_uuid: String,
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use crate::models::finding::Severity;
+    use crate::models::onboarding::ComplianceFramework;
+    use crate::models::scan::ScanType;
+
+    fn control(id: &str, title: &str) -> Control {
+        Control {
+            id: id.into(),
+            framework: ComplianceFramework::Cra,
+            title: title.into(),
+            text: String::new(),
+            source: None,
+        }
+    }
+
+    fn finding(fp: &str, cwe: Option<&str>) -> Finding {
+        let mut f = Finding::new(
+            "repo".into(),
+            fp.into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            "hardcoded credential".into(),
+            "desc".into(),
+            Severity::High,
+        );
+        f.cwe = cwe.map(Into::into);
+        f.file_path = Some("src/auth.rs".into());
+        f.line_number = Some(42);
+        f
+    }
+
+    fn at() -> DateTime<Utc> {
+        DateTime::parse_from_rfc3339("2026-07-20T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc)
+    }
+
+    #[test]
+    fn links_cwe_finding_to_control_not_satisfied() {
+        let controls = vec![
+            control("cra-ai-8", "No default passwords"),
+            control("cra-ai-13", "Crypto"),
+        ];
+        let findings = vec![finding("f1", Some("CWE-798"))];
+        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
+        let r = &doc.assessment_results.results[0];
+        assert_eq!(r.observations.len(), 1);
+        assert_eq!(r.findings.len(), 1);
+        assert_eq!(r.findings[0].target.target_id, "cra-ai-8_smt");
+        assert_eq!(r.findings[0].target.status.state, "not-satisfied");
+        assert_eq!(r.findings[0].related_observations.len(), 1);
+        assert_eq!(
+            r.reviewed_controls.control_selections[0]
+                .include_controls
+                .len(),
+            2
+        );
+    }
+
+    #[test]
+    fn unlinked_finding_yields_no_control_finding() {
+        let controls = vec![control("cra-ai-8", "x")];
+        let findings = vec![finding("f1", Some("CWE-99999"))];
+        let doc = assess(&controls, &findings, &ControlLinker::cra_seed(), at());
+        let r = &doc.assessment_results.results[0];
+        assert!(r.observations.is_empty());
+        assert!(r.findings.is_empty());
+    }
+
+    #[test]
+    fn output_is_deterministic_and_valid_oscal() {
+        let controls = vec![control("cra-ai-8", "x")];
+        let findings = vec![finding("f1", Some("798"))];
+        let a = serde_json::to_string(&assess(
+            &controls,
+            &findings,
+            &ControlLinker::cra_seed(),
+            at(),
+        ))
+        .unwrap();
+        let b = serde_json::to_string(&assess(
+            &controls,
+            &findings,
+            &ControlLinker::cra_seed(),
+            at(),
+        ))
+        .unwrap();
+        assert_eq!(a, b);
+        assert!(a.contains("\"oscal-version\":\"1.1.2\""));
+        assert!(a.contains("\"not-satisfied\""));
+    }
+}

control-map/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "control-map"
+version = "0.1.0"
+edition = "2021"
+
+[lints]
+workspace = true
+
+[dependencies]
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }

control-map/data/cra_control_map.json

@@ -0,0 +1,399 @@
+{
+  "version": "1.0",
+  "framework": "cra",
+  "controls": [
+    {
+      "control": "cra-ai-1",
+      "title": "Secure-by-Default-Konfiguration",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-2",
+      "title": "Minimale Angriffsflaeche",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-3",
+      "title": "Sichere Systemarchitektur",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-4",
+      "title": "Least-Privilege-Prinzip",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-5",
+      "title": "Manipulationsschutz",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-6",
+      "title": "Integritaetspruefung",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-7",
+      "title": "Starke Authentifizierung",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-8",
+      "title": "Keine Default-Passwoerter",
+      "scans": [
+        {
+          "tool": "gitleaks",
+          "scan_type": "secret_detection",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-798",
+            "CWE-259"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-9",
+      "title": "Sicheres Credential-Management",
+      "scans": [
+        {
+          "tool": "gitleaks",
+          "scan_type": "secret_detection",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-798",
+            "CWE-522"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-10",
+      "title": "Sitzungsmanagement",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-11",
+      "title": "Brute-Force-Schutz",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-12",
+      "title": "Rollenbasierte Autorisierung",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-13",
+      "title": "Verschluesselung sensibler Daten",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-327",
+            "CWE-326"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-14",
+      "title": "Speicher-Schutz (Data at Rest)",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-15",
+      "title": "Transport-Schutz (Data in Transit)",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-319",
+            "CWE-311"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-16",
+      "title": "Sicheres Schluesselmanagement",
+      "scans": [
+        {
+          "tool": "gitleaks",
+          "scan_type": "secret_detection",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-798",
+            "CWE-321"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-17",
+      "title": "Datenminimierung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-18",
+      "title": "Strukturierter SSDLC",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-19",
+      "title": "Systematische Code Reviews",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-20",
+      "title": "Automatisierte Sicherheitstests",
+      "scans": [
+        {
+          "tool": "semgrep",
+          "scan_type": "sast",
+          "cwe": [
+            "CWE-89",
+            "CWE-78",
+            "CWE-79",
+            "CWE-22"
+          ],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-21",
+      "title": "Supply-Chain-Security",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-22",
+      "title": "Dependency-Monitoring",
+      "scans": [
+        {
+          "tool": "osv",
+          "scan_type": "cve",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "syft",
+          "scan_type": "sbom",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-23",
+      "title": "Software Bill of Materials (SBOM)",
+      "scans": [
+        {
+          "tool": "syft",
+          "scan_type": "sbom",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-24",
+      "title": "Security-Logging",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-25",
+      "title": "Ereignis-Monitoring",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-26",
+      "title": "Anomalie-Erkennung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-27",
+      "title": "Log-Integritaet und -Aufbewahrung",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-28",
+      "title": "Sichere Update-Mechanismen",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-29",
+      "title": "Update-Authentizitaet",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-30",
+      "title": "Update-Integritaet",
+      "scans": [],
+      "note": "code-checkable but no off-the-shelf tool digs it out — author a detector (custom semgrep rule / check)",
+      "status": "needs_tooling"
+    },
+    {
+      "control": "cra-ai-31",
+      "title": "Lifecycle-Support",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-32",
+      "title": "Schwachstellen-Identifikation",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-33",
+      "title": "SBOM-Pflege und Analyse",
+      "scans": [
+        {
+          "tool": "syft",
+          "scan_type": "sbom",
+          "cwe": [],
+          "rules": []
+        },
+        {
+          "tool": "osv",
+          "scan_type": "cve",
+          "cwe": [],
+          "rules": []
+        }
+      ],
+      "note": null,
+      "status": "covered"
+    },
+    {
+      "control": "cra-ai-34",
+      "title": "Risikobasierte Priorisierung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-35",
+      "title": "Coordinated Vulnerability Disclosure",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-36",
+      "title": "Incident-Response-Prozess",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-37",
+      "title": "Fruehwarnung (24h)",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-38",
+      "title": "Detaillierter Vorfallsbericht (72h)",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-39",
+      "title": "Patch-Bereitstellung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    },
+    {
+      "control": "cra-ai-40",
+      "title": "Dokumentation und Nachbereitung",
+      "scans": [],
+      "note": "process / document control — outside static-scan scope",
+      "status": "not_code_checkable"
+    }
+  ]
+}

control-map/src/lib.rs

@@ -0,0 +1,163 @@
+//! `control-map` — the deterministic control → scan lookup table (LUT).
+//!
+//! The "transcribing" layer: it maps each compliance control to the static-scan
+//! step(s) that check it, or marks it as needing custom tooling, or as not
+//! code-checkable at all. The map is **authored and human-reviewed** — no LLM
+//! decides coverage. The LLM only enters later, downstream, to triage/ground the
+//! *tool's* findings (that lives in the agent, not here).
+//!
+//! This crate is intentionally tiny and standalone: types + an embedded JSON LUT
+//! + query helpers.
+
+use serde::{Deserialize, Serialize};
+
+/// Coverage bucket for a control under static (SAST-family) scanning.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Coverage {
+    /// An existing tool's scan surfaces findings for this control.
+    Covered,
+    /// Code-checkable, but no existing tool digs it out — we must write tooling.
+    NeedsTooling,
+    /// Process / document control — out of static-scan scope.
+    NotCodeCheckable,
+}
+
+/// One tool binding: a scan step that (at least partially) checks a control.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ScanBinding {
+    /// Tool name, e.g. `"semgrep"`, `"gitleaks"`, `"syft"`, `"osv"`.
+    pub tool: String,
+    /// Scan family, e.g. `"sast"`, `"secret_detection"`, `"sbom"`, `"cve"`.
+    pub scan_type: String,
+    /// CWEs whose findings map to this control (used to attach findings back).
+    #[serde(default)]
+    pub cwe: Vec<String>,
+    /// Optional specific rule ids this control keys on.
+    #[serde(default)]
+    pub rules: Vec<String>,
+}
+
+/// One control's entry in the LUT.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlEntry {
+    /// Control id, e.g. `"cra-ai-8"`.
+    pub control: String,
+    /// Human-readable title (for the reviewable view).
+    #[serde(default)]
+    pub title: String,
+    /// Coverage bucket.
+    pub status: Coverage,
+    /// Tool bindings (empty unless `status == Covered`).
+    #[serde(default)]
+    pub scans: Vec<ScanBinding>,
+    /// Reviewer note — why it needs tooling / isn't code-checkable.
+    #[serde(default)]
+    pub note: Option<String>,
+}
+
+/// The control → scan lookup table for one framework.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ControlMap {
+    pub version: String,
+    pub framework: String,
+    pub controls: Vec<ControlEntry>,
+}
+
+const CRA_MAP_JSON: &str = include_str!("../data/cra_control_map.json");
+
+impl ControlMap {
+    /// Load the built-in CRA control map (the embedded, authored LUT).
+    pub fn cra() -> Result<Self, MapError> {
+        Ok(serde_json::from_str(CRA_MAP_JSON)?)
+    }
+
+    /// The coverage entry for a control id, if present.
+    pub fn coverage(&self, control_id: &str) -> Option<&ControlEntry> {
+        self.controls.iter().find(|c| c.control == control_id)
+    }
+
+    /// Controls whose bindings include the given `tool` + `cwe` — used to attach a
+    /// raw tool finding back to the control(s) it's evidence for.
+    pub fn controls_for(&self, tool: &str, cwe: &str) -> Vec<&ControlEntry> {
+        self.controls
+            .iter()
+            .filter(|c| {
+                c.scans
+                    .iter()
+                    .any(|s| s.tool == tool && s.cwe.iter().any(|w| w == cwe))
+            })
+            .collect()
+    }
+
+    /// Count of controls in each coverage bucket.
+    pub fn summary(&self) -> CoverageSummary {
+        let mut s = CoverageSummary::default();
+        for c in &self.controls {
+            match c.status {
+                Coverage::Covered => s.covered += 1,
+                Coverage::NeedsTooling => s.needs_tooling += 1,
+                Coverage::NotCodeCheckable => s.not_code_checkable += 1,
+            }
+        }
+        s
+    }
+}
+
+/// Coverage bucket counts.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct CoverageSummary {
+    pub covered: usize,
+    pub needs_tooling: usize,
+    pub not_code_checkable: usize,
+}
+
+impl CoverageSummary {
+    pub fn total(&self) -> usize {
+        self.covered + self.needs_tooling + self.not_code_checkable
+    }
+}
+
+/// Errors loading a control map.
+#[derive(Debug, thiserror::Error)]
+pub enum MapError {
+    #[error("failed to parse control map: {0}")]
+    Parse(#[from] serde_json::Error),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cra_map_loads_all_40_controls() {
+        let map = ControlMap::cra().expect("CRA map should parse");
+        assert_eq!(map.framework, "cra");
+        assert_eq!(map.controls.len(), 40);
+        assert_eq!(map.summary().total(), 40);
+    }
+
+    #[test]
+    fn hardcoded_password_control_is_tool_covered() {
+        let map = ControlMap::cra().unwrap();
+        let c = map.coverage("cra-ai-8").expect("cra-ai-8 present");
+        assert_eq!(c.status, Coverage::Covered);
+        assert!(c.scans.iter().any(|s| s.tool == "semgrep"));
+        assert!(c.scans.iter().any(|s| s.tool == "gitleaks"));
+    }
+
+    #[test]
+    fn finding_attaches_back_to_control_via_tool_and_cwe() {
+        let map = ControlMap::cra().unwrap();
+        let hits = map.controls_for("semgrep", "CWE-798");
+        assert!(hits.iter().any(|c| c.control == "cra-ai-8"));
+    }
+
+    #[test]
+    fn every_bucket_is_represented() {
+        let s = ControlMap::cra().unwrap().summary();
+        assert!(s.covered > 0);
+        assert!(s.needs_tooling > 0);
+        assert!(s.not_code_checkable > 0);
+    }
+}