style(wizard): rustfmt infrastructure/onboarding.rs

A dedicated multi-step onboarding flow at /onboard (new "Onboard" sidebar entry),
wired to the #131 target endpoints:
- Step 1 — target type: card grid of the 9 families + name.
- Step 2 — artifacts: type-aware add-a-row form (git/live-url/firmware/mobile/
  container/PLC/archive/text) with a removable list.
- Step 3 — review: summary of type + artifacts.
- Step 4 — done: creates the target, runs kind-based detection, and shows the
  applicable-scans matrix (default-on / blocked with rationale).

Server fns in infrastructure/onboarding.rs proxy to /api/v1/targets (create,
detect, applicable-scans). Compiles clean under both --features web and
--features server; fmt + clippy -D warnings pass.

Full scan-selection toggling and a "launch scan" action are follow-ups (launch
needs the unified pipeline, #133).

Closes #123, #124, #125. Refs #126, #127, #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -191,18 +191,13 @@ jobs:
       image: docker:27-cli
     steps:
       - name: Build, push and trigger orca redeploy
-        env:
-          # PAT for fetching the private tramiton-core git dependency during the
-          # image build (injected as a BuildKit secret, never baked into a layer).
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
         run: |
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
           IMAGE=registry.meghsakha.com/compliance-agent
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
+          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
-            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')

Dockerfile.agent

@@ -2,16 +2,7 @@ FROM rust:1.94-bookworm AS builder
 
 WORKDIR /app
 COPY . .
-# compliance-agent depends on the private tramiton-core git repo. Authenticate
+RUN cargo build --release -p compliance-agent
-# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
-# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*

compliance-agent/src/api/handlers/mod.rs

@@ -9,7 +9,6 @@ pub mod help_chat;
 pub mod issues;
 pub mod mcp_tokens;
 pub mod notifications;
-pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
 pub mod repos;

compliance-agent/src/api/handlers/onboarding.rs

@@ -1,350 +0,0 @@
-//! Onboarding API — CRUD for unified targets, artifact add, classification, and
-//! the scan-applicability matrix. The wizard (and future integrations) drive
-//! onboarding through these endpoints.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::{doc, oid::ObjectId, to_bson};
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
-    TargetType,
-};
-use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-use crate::classify::{classify_target, MockFirmwareDetector};
-
-use super::dto::tenant_db;
-use super::{collect_cursor_async, ApiResponse, PaginationParams};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
-/// id) from it, so clients never set internal fields.
-#[derive(Deserialize)]
-pub struct ArtifactInput {
-    pub kind: ArtifactKind,
-    pub source_ref: String,
-    #[serde(default)]
-    pub branch: Option<String>,
-    #[serde(default)]
-    pub plc_format: Option<PlcFormat>,
-}
-
-impl ArtifactInput {
-    fn build(&self) -> Artifact {
-        let s = self.source_ref.clone();
-        match self.kind {
-            ArtifactKind::GitRepo => {
-                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
-            }
-            ArtifactKind::LiveUrl => Artifact::live_url(s),
-            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
-            ArtifactKind::SourceArchive => Artifact::source_archive(s),
-            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
-            ArtifactKind::ContainerImage => Artifact::container_image(s),
-            ArtifactKind::PlcProject => {
-                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
-            }
-            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
-        }
-    }
-}
-
-#[derive(Deserialize)]
-pub struct CreateTargetRequest {
-    pub name: String,
-    pub target_type: TargetType,
-    #[serde(default)]
-    pub description: Option<String>,
-    #[serde(default)]
-    pub artifacts: Vec<ArtifactInput>,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateTargetRequest {
-    pub name: Option<String>,
-    pub target_type: Option<TargetType>,
-    pub scan_config: Option<TargetScanConfig>,
-    pub compliance_profile: Option<ComplianceProfile>,
-    pub scan_schedule: Option<String>,
-}
-
-/// One applicable-scan option, serialized for the wizard.
-#[derive(Serialize)]
-pub struct ScanOptionDto {
-    pub scan: String,
-    pub default_on: bool,
-    pub rationale: String,
-    pub required_artifact: Option<String>,
-    pub blocked_reason: Option<String>,
-}
-
-#[derive(Serialize)]
-pub struct ApplicableScansResponse {
-    pub scans: Vec<ScanOptionDto>,
-    pub pentest_supported: bool,
-}
-
-fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
-    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
-}
-
-/// GET /api/v1/targets — list onboarded targets (paginated).
-#[tracing::instrument(skip_all)]
-pub async fn list_targets(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .onboarded_targets()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-    let targets = match db
-        .onboarded_targets()
-        .find(doc! {})
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch onboarded targets: {e}");
-            Vec::new()
-        }
-    };
-    Ok(Json(ApiResponse {
-        data: targets,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-/// POST /api/v1/targets — create an onboarded target.
-#[tracing::instrument(skip_all)]
-pub async fn create_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<CreateTargetRequest>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let mut target = OnboardedTarget::new(req.name, req.target_type);
-    target.description = req.description;
-    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
-
-    let db = tenant_db(&agent, &tenant).await?;
-    let res = db
-        .onboarded_targets()
-        .insert_one(&target)
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    target.id = res.inserted_id.as_object_id();
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// GET /api/v1/targets/{id} — fetch one target.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn get_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// PATCH /api/v1/targets/{id} — update mutable fields.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn update_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateTargetRequest>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
-    if let Some(name) = req.name {
-        set.insert("name", name);
-    }
-    if let Some(tt) = req.target_type {
-        set.insert(
-            "target_type",
-            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(sc) = req.scan_config {
-        set.insert(
-            "scan_config",
-            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(cp) = req.compliance_profile {
-        set.insert(
-            "compliance_profile",
-            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(ss) = req.scan_schedule {
-        set.insert("scan_schedule", ss);
-    }
-
-    db.onboarded_targets()
-        .update_one(doc! { "_id": oid }, doc! { "$set": set })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn delete_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    db.onboarded_targets()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    // Cascade the collections keyed by repo_id == target id (best-effort).
-    let by_repo = doc! { "repo_id": &id };
-    let _ = db.findings().delete_many(by_repo.clone()).await;
-    let _ = db.scan_runs().delete_many(by_repo.clone()).await;
-    let _ = db.sbom_entries().delete_many(by_repo.clone()).await;
-    let _ = db.cve_alerts().delete_many(by_repo).await;
-    Ok(Json(serde_json::json!({ "status": "deleted" })))
-}
-
-/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn add_artifact(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(input): Json<ArtifactInput>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn applicable_scans_for_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    let scans = applicable_scans(&target)
-        .into_iter()
-        .map(|o| ScanOptionDto {
-            scan: o.scan.to_string(),
-            default_on: o.default_on,
-            rationale: o.rationale,
-            required_artifact: o.required_artifact.map(|k| k.to_string()),
-            blocked_reason: o.blocked_reason,
-        })
-        .collect();
-
-    Ok(Json(ApiResponse {
-        data: ApplicableScansResponse {
-            scans,
-            pentest_supported: supports_pentest(target.target_type),
-        },
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
-///
-/// This is the lightweight pass: it classifies from artifact kinds without
-/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
-/// ingest, with tramiton firmware analysis) is a follow-up background step.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn detect_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let mut target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // No ingested working paths here → kind-based classification only; the mock
-    // firmware detector is never invoked (no firmware working path present).
-    let empty = HashMap::new();
-    let detector = MockFirmwareDetector { detection: None };
-    let classification = classify_target(&target, &empty, &detector)
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    let classification_bson =
-        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    target.classification = Some(classification);
-
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}

compliance-agent/src/api/routes.rs

@@ -25,29 +25,6 @@ pub fn build_router() -> Router {
             "/api/v1/repositories/{id}/webhook-config",
             get(handlers::get_webhook_config),
         )
-        // Unified onboarding targets (#131).
-        .route(
-            "/api/v1/targets",
-            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
-        )
-        .route(
-            "/api/v1/targets/{id}",
-            get(handlers::onboarding::get_target)
-                .patch(handlers::onboarding::update_target)
-                .delete(handlers::onboarding::delete_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/artifacts",
-            post(handlers::onboarding::add_artifact),
-        )
-        .route(
-            "/api/v1/targets/{id}/applicable-scans",
-            get(handlers::onboarding::applicable_scans_for_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/detect",
-            post(handlers::onboarding::detect_target),
-        )
         .route("/api/v1/findings", get(handlers::list_findings))
         .route("/api/v1/findings/{id}", get(handlers::get_finding))
         .route(

compliance-agent/tests/common/mod.rs

@@ -25,9 +25,8 @@ impl TestServer {
         let mongodb_uri = std::env::var("TEST_MONGODB_URI")
             .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
 
-        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // Unique database name per test run to avoid collisions
-        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
-        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
 
         let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await

compliance-agent/tests/integration/api/mod.rs

@@ -2,6 +2,5 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
-mod onboarding;
 mod repositories;
 mod stats;

compliance-agent/tests/integration/api/onboarding.rs

@@ -1,115 +0,0 @@
-use crate::common::TestServer;
-use serde_json::json;
-
-#[tokio::test]
-async fn create_list_and_applicable_scans() {
-    let server = TestServer::start().await;
-
-    // Initially empty.
-    let resp = server.get("/api/v1/targets").await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    // Create a web-app target with a git repo + a live URL.
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({
-                "name": "acme-web",
-                "target_type": "web_app",
-                "artifacts": [
-                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
-                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
-                ]
-            }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-    assert!(!id.is_empty());
-    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
-
-    // List returns it.
-    let resp = server.get("/api/v1/targets").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 1);
-
-    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
-    let resp = server
-        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let scans = body["data"]["scans"].as_array().unwrap();
-    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
-    assert!(names.contains(&"sast"));
-    assert!(names.contains(&"dast"));
-    assert_eq!(body["data"]["pentest_supported"], true);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn detect_classifies_a_plc_target() {
-    let server = TestServer::start().await;
-
-    // A PLC project artifact is a strong kind-based signal.
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({
-                "name": "line-controller",
-                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
-                "artifacts": [
-                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
-                ]
-            }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-
-    let resp = server
-        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn add_artifact_and_delete_target() {
-    let server = TestServer::start().await;
-
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({ "name": "svc", "target_type": "backend_service" }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-
-    // Attach a git repo.
-    let resp = server
-        .post(
-            &format!("/api/v1/targets/{id}/artifacts"),
-            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
-
-    // Delete it.
-    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
-    assert_eq!(resp.status(), 200);
-    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
-    assert_eq!(resp.status(), 404);
-
-    server.cleanup().await;
-}

compliance-dashboard/src/app.rs

@@ -12,6 +12,8 @@ pub enum Route {
         OverviewPage {},
         #[route("/repositories")]
         RepositoriesPage {},
+        #[route("/onboard")]
+        OnboardingPage {},
         #[route("/findings")]
         FindingsPage {},
         #[route("/findings/:id")]

compliance-dashboard/src/components/sidebar.rs

@@ -28,6 +28,11 @@ pub fn Sidebar() -> Element {
             route: Route::RepositoriesPage {},
             icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
         },
+        NavItem {
+            label: "Onboard",
+            route: Route::OnboardingPage {},
+            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
+        },
         NavItem {
             label: "Findings",
             route: Route::FindingsPage {},

compliance-dashboard/src/infrastructure/mod.rs

@@ -10,6 +10,7 @@ pub mod issues;
 pub mod mcp;
 pub mod mcp_tokens;
 pub mod notifications;
+pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;

compliance-dashboard/src/infrastructure/onboarding.rs

@@ -0,0 +1,107 @@
+//! Server functions for the onboarding wizard — proxy to the agent's
+//! `/api/v1/targets` endpoints.
+
+use dioxus::prelude::*;
+use serde::{Deserialize, Serialize};
+
+/// One artifact the wizard collects for a target.
+#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
+pub struct ArtifactInputDto {
+    pub kind: String,
+    pub source_ref: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub branch: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plc_format: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TargetsResponse {
+    pub data: Vec<serde_json::Value>,
+    pub total: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TargetResponse {
+    pub data: serde_json::Value,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ApplicableScansData {
+    #[serde(default)]
+    pub scans: Vec<serde_json::Value>,
+    #[serde(default)]
+    pub pentest_supported: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ApplicableScansResponse {
+    pub data: ApplicableScansData,
+}
+
+/// List onboarded targets.
+#[server]
+pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get("/api/v1/targets")
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Create a target with the collected artifacts.
+#[server]
+pub async fn create_target(
+    name: String,
+    target_type: String,
+    description: Option<String>,
+    artifacts: Vec<ArtifactInputDto>,
+) -> Result<TargetResponse, ServerFnError> {
+    let body = serde_json::json!({
+        "name": name,
+        "target_type": target_type,
+        "description": description,
+        "artifacts": artifacts,
+    });
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
+        .await?
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Run kind-based classification on a target.
+#[server]
+pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/targets/{id}/detect"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}
+
+/// Fetch the scan-applicability matrix for a target.
+#[server]
+pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    resp.json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))
+}

compliance-dashboard/src/pages/mod.rs

@@ -12,6 +12,7 @@ pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
 pub mod mcp_tokens;
+pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
@@ -32,6 +33,7 @@ pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
 pub use mcp_tokens::McpTokensPage;
+pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;

compliance-dashboard/src/pages/onboarding.rs

@@ -0,0 +1,377 @@
+use dioxus::prelude::*;
+
+use crate::components::page_header::PageHeader;
+use crate::infrastructure::onboarding::{
+    create_target, detect_target, fetch_applicable_scans, ArtifactInputDto,
+};
+
+/// (value, label, one-line description) for the 9 target families.
+const TARGET_TYPES: &[(&str, &str, &str)] = &[
+    ("web_app", "Web Application", "Front end + server"),
+    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
+    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
+    ("android_app", "Android App", "APK / AAB"),
+    ("ios_app", "iOS App", "IPA"),
+    (
+        "firmware_bare_metal",
+        "Firmware — bare metal",
+        "No operating system",
+    ),
+    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
+    (
+        "embedded_linux_yocto",
+        "Embedded Linux / Yocto",
+        "BSP + image",
+    ),
+    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
+];
+
+/// (value, label) for the artifact kinds a user can attach.
+const ARTIFACT_KINDS: &[(&str, &str)] = &[
+    ("git_repo", "Git repository"),
+    ("source_archive", "Source archive (zip)"),
+    ("firmware_image", "Firmware image"),
+    ("mobile_package", "Mobile package (APK/IPA)"),
+    ("container_image", "Container image"),
+    ("live_url", "Live URL"),
+    ("plc_project", "PLC project"),
+    ("plaintext_description", "Description (text)"),
+];
+
+const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
+
+/// One row in the applicable-scans list on the success step.
+#[component]
+fn ScanRow(scan: serde_json::Value) -> Element {
+    let name = scan
+        .get("scan")
+        .and_then(|v| v.as_str())
+        .unwrap_or("?")
+        .to_string();
+    let rationale = scan
+        .get("rationale")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+    let blocked = scan
+        .get("blocked_reason")
+        .and_then(|v| v.as_str())
+        .map(String::from);
+    let default_on = scan
+        .get("default_on")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let badge_class = if blocked.is_some() {
+        "badge badge-info"
+    } else if default_on {
+        "badge badge-success"
+    } else {
+        "badge"
+    };
+    rsx! {
+        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
+            span { class: "{badge_class}", "{name}" }
+            span { style: "opacity: 0.8;", "{rationale}" }
+            if let Some(b) = blocked {
+                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
+            }
+        }
+    }
+}
+
+fn kind_label(kind: &str) -> &str {
+    ARTIFACT_KINDS
+        .iter()
+        .find(|(v, _)| *v == kind)
+        .map(|(_, l)| *l)
+        .unwrap_or(kind)
+}
+
+fn type_label(value: &str) -> &str {
+    TARGET_TYPES
+        .iter()
+        .find(|(v, _, _)| *v == value)
+        .map(|(_, l, _)| *l)
+        .unwrap_or(value)
+}
+
+#[component]
+pub fn OnboardingPage() -> Element {
+    let mut step = use_signal(|| 0usize);
+    let mut name = use_signal(String::new);
+    let mut target_type = use_signal(String::new);
+    let mut description = use_signal(String::new);
+    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
+
+    // "Add artifact" mini-form.
+    let mut new_kind = use_signal(|| "git_repo".to_string());
+    let mut new_source = use_signal(String::new);
+    let mut new_branch = use_signal(|| "main".to_string());
+
+    // Create + result state.
+    let mut creating = use_signal(|| false);
+    let mut error = use_signal(|| Option::<String>::None);
+    let mut scans = use_signal(Vec::<serde_json::Value>::new);
+    let mut suggested = use_signal(|| Option::<String>::None);
+
+    let step_now = step();
+    let can_advance_type = !name().trim().is_empty() && !target_type().trim().is_empty();
+    let has_artifacts = !artifacts().is_empty();
+
+    rsx! {
+        PageHeader {
+            title: "Onboard a target",
+            description: "Add a target, attach its artifacts, and see which scans apply.",
+        }
+
+        // Stepper.
+        div { class: "wizard-steps",
+            for (i, label) in STEP_LABELS.iter().enumerate() {
+                div {
+                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
+                    span { class: "wizard-step-dot", "{i + 1}" }
+                    span { class: "wizard-step-label", "{label}" }
+                }
+            }
+        }
+
+        if let Some(err) = error() {
+            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
+                div { class: "card-header", "Error" }
+                div { style: "padding: 12px;", "{err}" }
+            }
+        }
+
+        div { class: "card",
+            // ---- Step 0: target type + name ----
+            if step_now == 0 {
+                div { class: "card-header", "What kind of software is this?" }
+                div { style: "padding: 16px;",
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            placeholder: "acme-web",
+                            value: "{name}",
+                            oninput: move |e| name.set(e.value()),
+                        }
+                    }
+                    div {
+                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
+                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
+                            div {
+                                class: "card",
+                                style: if target_type() == value {
+                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
+                                } else {
+                                    "padding: 12px; cursor: pointer;"
+                                },
+                                onclick: move |_| target_type.set(value.to_string()),
+                                div { style: "font-weight: 600;", "{tlabel}" }
+                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
+                            }
+                        }
+                    }
+                }
+            }
+
+            // ---- Step 1: artifacts ----
+            if step_now == 1 {
+                div { class: "card-header", "Attach artifacts" }
+                div { style: "padding: 16px;",
+                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
+                        div { class: "form-group", style: "margin: 0;",
+                            label { "Kind" }
+                            select {
+                                value: "{new_kind}",
+                                oninput: move |e| new_kind.set(e.value()),
+                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
+                                    option { value: "{value}", "{klabel}" }
+                                }
+                            }
+                        }
+                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
+                            label { "Reference (URL / path / text)" }
+                            input {
+                                r#type: "text",
+                                placeholder: "https://git.example.com/acme.git",
+                                value: "{new_source}",
+                                oninput: move |e| new_source.set(e.value()),
+                            }
+                        }
+                        if new_kind() == "git_repo" {
+                            div { class: "form-group", style: "margin: 0;",
+                                label { "Branch" }
+                                input {
+                                    r#type: "text",
+                                    value: "{new_branch}",
+                                    oninput: move |e| new_branch.set(e.value()),
+                                }
+                            }
+                        }
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| {
+                                let kind = new_kind();
+                                if !new_source().trim().is_empty() {
+                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
+                                    artifacts.write().push(ArtifactInputDto {
+                                        kind,
+                                        source_ref: new_source(),
+                                        branch,
+                                        plc_format: None,
+                                    });
+                                    new_source.set(String::new());
+                                }
+                            },
+                            "+ Add"
+                        }
+                    }
+
+                    div { style: "margin-top: 16px;",
+                        if has_artifacts {
+                            for (i, a) in artifacts().iter().enumerate() {
+                                div {
+                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
+                                    span {
+                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
+                                        "{a.source_ref}"
+                                    }
+                                    button {
+                                        class: "btn btn-ghost-danger btn-sm",
+                                        onclick: move |_| { artifacts.write().remove(i); },
+                                        "Remove"
+                                    }
+                                }
+                            }
+                        } else {
+                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
+                        }
+                    }
+                }
+            }
+
+            // ---- Step 2: review + create ----
+            if step_now == 2 {
+                div { class: "card-header", "Review" }
+                div { style: "padding: 16px;",
+                    div { class: "wizard-summary",
+                        div { strong { "Name: " } "{name()}" }
+                        div { strong { "Type: " } "{type_label(&target_type())}" }
+                        div { strong { "Artifacts:" } }
+                        ul {
+                            for a in artifacts() {
+                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
+                            }
+                        }
+                    }
+                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
+                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
+                    }
+                }
+            }
+
+            // ---- Step 3: created ----
+            if step_now == 3 {
+                div { class: "card-header", "Target onboarded" }
+                div { style: "padding: 16px;",
+                    p {
+                        strong { "{name()}" }
+                        " was created."
+                        if let Some(s) = suggested() {
+                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
+                        }
+                    }
+                    h4 { style: "margin-top: 16px;", "Applicable scans" }
+                    if scans().is_empty() {
+                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
+                    } else {
+                        for s in scans() {
+                            ScanRow { scan: s }
+                        }
+                    }
+                    div { style: "margin-top: 16px;",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| {
+                                step.set(0);
+                                name.set(String::new());
+                                target_type.set(String::new());
+                                description.set(String::new());
+                                artifacts.write().clear();
+                                scans.write().clear();
+                                suggested.set(None);
+                                error.set(None);
+                            },
+                            "Onboard another"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ---- Footer navigation ----
+        if step_now < 3 {
+            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
+                button {
+                    class: "btn btn-back",
+                    disabled: step_now == 0,
+                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
+                    "Back"
+                }
+                if step_now < 2 {
+                    button {
+                        class: "btn btn-primary",
+                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
+                        onclick: move |_| step.set(step() + 1),
+                        "Next"
+                    }
+                } else {
+                    button {
+                        class: "btn btn-primary",
+                        disabled: creating(),
+                        onclick: move |_| {
+                            let n = name();
+                            let tt = target_type();
+                            let desc = description();
+                            let arts = artifacts();
+                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
+                            creating.set(true);
+                            error.set(None);
+                            spawn(async move {
+                                match create_target(n, tt, d, arts).await {
+                                    Ok(resp) => {
+                                        let id = resp
+                                            .data
+                                            .get("_id")
+                                            .and_then(|o| o.get("$oid"))
+                                            .and_then(|s| s.as_str())
+                                            .map(String::from);
+                                        if let Some(id) = id {
+                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
+                                                scans.set(sc.data.scans);
+                                            }
+                                            if let Ok(det) = detect_target(id).await {
+                                                suggested.set(
+                                                    det.data
+                                                        .get("classification")
+                                                        .and_then(|c| c.get("suggested"))
+                                                        .and_then(|s| s.as_str())
+                                                        .map(String::from),
+                                                );
+                                            }
+                                        }
+                                        step.set(3);
+                                    }
+                                    Err(e) => error.set(Some(e.to_string())),
+                                }
+                                creating.set(false);
+                            });
+                        },
+                        if creating() { "Creating..." } else { "Create target" }
+                    }
+                }
+            }
+        }
+    }
+}