fix(orchestrator): refresh control_refs on existing findings during re-scan

The dedup loop only inserted first-seen findings; re-scans skipped existing
fingerprints entirely, so control_refs (re)computed by the mapping passes were
discarded. A finding first seen before control mapping was enabled/tuned would
therefore never gain its control mappings without being deleted + re-added.

Now: existing findings whose re-scan produced non-empty control_refs get updated
in place ($set control_refs). Guarded on non-empty so a run where mapping didn't
run (breakpilot unreachable) can't wipe existing refs. New findings unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -72,7 +72,7 @@ jobs:
             echo '[source.crates-io]'
             echo 'replace-with = "kellnr"'
             echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.breakpilot.com/api/v1/cratesio/"'
+            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
           } >> "$CARGO_HOME/config.toml"
         env:
           RUSTC_WRAPPER: ""
@@ -94,8 +94,8 @@ jobs:
       - name: Configure git auth for private tramiton dependency
         run: |
           git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@git.breakpilot.com/".insteadOf \
-            "ssh://git@git.breakpilot.com:22222/"
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            "ssh://git@gitea.meghsakha.com:22222/"
         env:
           RUSTC_WRAPPER: ""
 
@@ -213,8 +213,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-agent
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-agent
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
@@ -240,8 +240,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-dashboard
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-dashboard
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
@@ -265,8 +265,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-docs
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-docs
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
@@ -291,8 +291,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-mcp
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          IMAGE=repo.meghsakha.com/certifai/compliance-mcp
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"

Dockerfile.agent

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 

Dockerfile.dashboard

@@ -13,8 +13,8 @@ ENV DOCS_URL=${DOCS_URL}
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 

Dockerfile.mcp

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 

compliance-agent/src/pipeline/orchestrator.rs

@@ -586,21 +586,7 @@ impl PipelineOrchestrator {
             let Some(path) = ingest_set.get(&a.id).and_then(|ia| ia.working_path.clone()) else {
                 continue;
             };
-            let mut source_findings = crate::pipeline::plc::analyze_tree(&path, target_id);
-            // Control mapping for the PLC path (run_plc_scan is separate from
-            // run_pipeline, which does its own mapping). PLC findings carry
-            // file_path/line/cwe, so the semantic pass reads each region under this
-            // source's `path` and stamps master-control refs. The LUT + grounded
-            // surface passes are code-pattern / CRA-specific and don't apply to
-            // IEC 61131-3 control logic, so only the semantic pass runs here.
-            crate::controls::semantic_stamp_findings(
-                &self.config,
-                self.llm.clone(),
-                &path,
-                &mut source_findings,
-            )
-            .await;
-            all_findings.extend(source_findings);
+            all_findings.extend(crate::pipeline::plc::analyze_tree(&path, target_id));
             // Control-application SBOM: CODESYS libraries + runtime from a
             // `.projectarchive` (uploaded, or committed in the working tree).
             let archive = a
@@ -625,7 +611,6 @@ impl PipelineOrchestrator {
         );
 
         let mut new_count = 0u32;
-        let mut refreshed_count = 0u32;
         for mut finding in all_findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
             if self
@@ -637,27 +622,8 @@ impl PipelineOrchestrator {
             {
                 self.db.findings().insert_one(&finding).await?;
                 new_count += 1;
-            } else if !finding.control_refs.is_empty() {
-                // Re-scan refresh: mirror run_pipeline — persist newly-computed
-                // control_refs onto a PLC finding first seen before the semantic
-                // pass ran. The insert path alone never would, so without this a
-                // PLC re-scan can only pick up mappings via a delete + re-add.
-                self.db
-                    .findings()
-                    .update_one(
-                        doc! { "fingerprint": &finding.fingerprint },
-                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
-                    )
-                    .await?;
-                refreshed_count += 1;
             }
         }
-        if refreshed_count > 0 {
-            tracing::info!(
-                target_id,
-                "Refreshed control_refs on {refreshed_count} existing PLC findings"
-            );
-        }
 
         if !all_sbom.is_empty() {
             if let Err(e) = self