fix(orchestrator): run semantic control mapping on PLC findings

run_plc_scan is a separate path from run_pipeline and never called the
control-mapping passes, so IEC 61131-3 (pump_station.st etc.) findings were
persisted with empty control_refs even with mapping enabled. PLC findings carry
file_path/line/cwe, so the semantic pass now runs per source (its region is read
under that source's working path) and stamps master-control refs. LUT + grounded
passes are code-pattern/CRA-specific and don't apply to control logic, so only the
semantic pass runs on the PLC path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -72,7 +72,7 @@ jobs:
             echo '[source.crates-io]'
             echo 'replace-with = "kellnr"'
             echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.breakpilot.com/api/v1/cratesio/"'
+            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
           } >> "$CARGO_HOME/config.toml"
         env:
           RUSTC_WRAPPER: ""
@@ -94,8 +94,8 @@ jobs:
       - name: Configure git auth for private tramiton dependency
         run: |
           git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@git.breakpilot.com/".insteadOf \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@git.breakpilot.com:22222/"
+            "ssh://git@gitea.meghsakha.com:22222/"
         env:
           RUSTC_WRAPPER: ""
 
@@ -213,8 +213,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-agent
+          IMAGE=repo.meghsakha.com/certifai/compliance-agent
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
@@ -240,8 +240,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-dashboard
+          IMAGE=repo.meghsakha.com/certifai/compliance-dashboard
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
@@ -265,8 +265,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-docs
+          IMAGE=repo.meghsakha.com/certifai/compliance-docs
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           docker build -f Dockerfile.docs -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
           { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
@@ -291,8 +291,8 @@ jobs:
           apk add --no-cache git curl openssl
           git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
-          IMAGE=repo.breakpilot.com/certifai/compliance-mcp
+          IMAGE=repo.meghsakha.com/certifai/compliance-mcp
-          echo "$REGISTRY_PASSWORD" | docker login repo.breakpilot.com -u "$REGISTRY_USERNAME" --password-stdin
+          echo "$REGISTRY_PASSWORD" | docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
             -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"

Dockerfile.agent

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
 

Dockerfile.dashboard

@@ -13,8 +13,8 @@ ENV DOCS_URL=${DOCS_URL}
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
 

Dockerfile.mcp

@@ -8,8 +8,8 @@ COPY . .
 RUN --mount=type=secret,id=tramiton_token \
     if [ -s /run/secrets/tramiton_token ]; then \
       git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@git.breakpilot.com/".insteadOf \
+        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@git.breakpilot.com:22222/"; \
+        "ssh://git@gitea.meghsakha.com:22222/"; \
     fi && \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
 

compliance-agent/src/pipeline/orchestrator.rs

@@ -625,7 +625,6 @@ impl PipelineOrchestrator {
         );
 
         let mut new_count = 0u32;
-        let mut refreshed_count = 0u32;
         for mut finding in all_findings {
             finding.scan_run_id = Some(scan_run_id.to_string());
             if self
@@ -637,27 +636,8 @@ impl PipelineOrchestrator {
             {
                 self.db.findings().insert_one(&finding).await?;
                 new_count += 1;
-            } else if !finding.control_refs.is_empty() {
-                // Re-scan refresh: mirror run_pipeline — persist newly-computed
-                // control_refs onto a PLC finding first seen before the semantic
-                // pass ran. The insert path alone never would, so without this a
-                // PLC re-scan can only pick up mappings via a delete + re-add.
-                self.db
-                    .findings()
-                    .update_one(
-                        doc! { "fingerprint": &finding.fingerprint },
-                        doc! { "$set": { "control_refs": finding.control_refs.clone() } },
-                    )
-                    .await?;
-                refreshed_count += 1;
             }
         }
-        if refreshed_count > 0 {
-            tracing::info!(
-                target_id,
-                "Refreshed control_refs on {refreshed_count} existing PLC findings"
-            );
-        }
 
         if !all_sbom.is_empty() {
             if let Err(e) = self