feat(m7.3): scheduler pulls tenants from registry, env as fallback

Replaces the M7.2-C static `SCHEDULER_TENANT_IDS` env enumeration with a live query to the tenant-registry at every tick. New tenants get picked up without an agent restart; the env stays as the fallback when the registry is unreachable so the scheduler is never silenced by a registry outage. Resolution order 1. agent.config.tenant_registry_url → GET <url>/v1/tenants - 5s timeout (kept short — we'd rather fall back than block the tick) - Frozen and Archived tenants filtered out (the M7.1 status gate would 402/410 them anyway, no point scanning their repos) - Accepts either {"id"} or {"tenant_id"} for forward compatibility with whatever shape the registry settles on 2. SCHEDULER_TENANT_IDS env (comma-separated) — fallback when the registry URL is unset OR the fetch fails OR the parsed response is empty. Each failure mode logs a warn with the url so operators see the problem. 3. DEFAULT_SCHEDULER_TENANT_ID ("dev") — last-ditch fallback so a bare `cargo run` against a clean Mongo still scans the dev tenant. Why each tick instead of caching - Tick frequency is every few hours (scan_schedule default "0 0 */6 * * *"). The registry call is at most 4 times a day per agent — cheap. - Caching introduces a staleness window for newly provisioned tenants. The whole point of registry integration is to pick them up fast. Startup log - Includes "tenant source=tenant-registry" or "env" so operators can tell at a glance which mode the scheduler is in. Test plan - cargo fmt --all clean - cargo clippy -p compliance-agent -- -D warnings clean - cargo test -p compliance-agent --lib — 232 pass (+3 new): * filter_active_keeps_running_skips_frozen_archived * deserialize_registry_response_accepts_id_or_tenant_id (covers the {"id"|"tenant_id"} alias) * tenants_from_env_resolution (single test covering unset → default, csv → splits, "" → default — collapsed to one to avoid env-var test races) Production - Set TENANT_REGISTRY_URL in orca-infra alongside KEYCLOAK_URL when the registry is ready to serve. Until then, scheduler keeps using SCHEDULER_TENANT_IDS — no operator action needed. - Future M7.4 cleanup: once tenant-registry adoption is universal, delete SCHEDULER_TENANT_IDS env support entirely. Stacked on #95 (admin endpoints) since that PR added tenant_registry_url to AgentConfig. Once #95 lands this auto- retargets to main. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-30 17:24:18 +02:00
84 changed files with 1746 additions and 6871 deletions
@@ -7,17 +7,4 @@ ignore = [
    # not a realistic attack surface here. Revisit when mongodb bumps hickory.
    "RUSTSEC-2026-0118", # NSEC3 loop, no fix available upstream
    "RUSTSEC-2026-0119", # O(n²) name compression, fixed in hickory-proto >=0.26.1
-
-    # rmcp 0.16.0 — DNS rebinding in Streamable HTTP server transport (missing
-    # Host header validation). Patched in rmcp >= 1.4.0, which is a major API
-    # version jump from our pin; rmcp shipped 0.x → 1.x → 2.x in three months
-    # and the migration touches every tool handler + the auth middleware we
-    # just landed in #92. Threat model in our deployment: the MCP server is
-    # exposed at a public hostname (comp-mcp-dev.meghsakha.com) behind orca's
-    # TLS-terminating ingress with per-tenant bearer auth — the attack model
-    # (browser DNS-rebinding into localhost MCP server) doesn't directly apply.
-    # Defense-in-depth Host-header check is still a worthwhile follow-up.
-    # FOLLOW-UP: bump rmcp to 2.x in a dedicated PR (M7.3 follow-up, sized
-    # multi-hour due to API surface change).
-    "RUSTSEC-2026-0189",
 ]
@@ -9,33 +9,15 @@ on:
 env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
-  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
-  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
-  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
-  # and HETZNER_S3_SECRET_KEY.
+  # sccache caches compilation artifacts within a job so that compiling
+  # both --features server and --features web shares common crate work.
  RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_BUCKET: breakpilot-sccache
-  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
-  SCCACHE_REGION: auto
-  SCCACHE_S3_USE_SSL: "true"
-  SCCACHE_S3_KEY_PREFIX: compliance-scanner
-  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
-  # compliance-agent depends on tramiton-core via git; use the system git so the
-  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
-  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
-  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
-  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
-  CARGO_NET_RETRY: "10"
-  CARGO_HTTP_MULTIPLEXING: "false"
+  SCCACHE_DIR: /tmp/sccache

-# Cancel superseded PR runs, but NEVER cancel main-branch runs — those build and
-# deploy per-service images, and cancelling one merge's deploy when the next
-# merge lands leaves a service un-deployed (as happened between two back-to-back
-# merges). So cancel-in-progress only for pull_request events.
+# Cancel in-progress runs for the same branch/PR
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true

 jobs:
  # ---------------------------------------------------------------------------
@@ -54,44 +36,16 @@ jobs:
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
-      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
-      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
-      # replacement only applies to crates.io-sourced crates.
-      - name: Use Kellnr crates.io mirror
-        run: |
-          : "${CARGO_HOME:=/usr/local/cargo}"
-          mkdir -p "$CARGO_HOME"
-          {
-            echo '[source.crates-io]'
-            echo 'replace-with = "kellnr"'
-            echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
-          } >> "$CARGO_HOME/config.toml"
-        env:
-          RUSTC_WRAPPER: ""
      - name: Install tools
        run: |
          rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
          chmod +x /usr/local/bin/sccache
          cargo install cargo-audit --locked
        env:
          RUSTC_WRAPPER: ""

-      # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
-      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
-      # with read:repository, owned by a user with access to sharang/tramiton).
-      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
-      - name: Configure git auth for private tramiton dependency
-        run: |
-          git config --global \
-            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
-            "ssh://git@gitea.meghsakha.com:22222/"
-        env:
-          RUSTC_WRAPPER: ""
-
      # Format (no compilation needed)
      - name: Format
        run: cargo fmt --all --check
@@ -194,18 +148,13 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
-        env:
-          # PAT for fetching the private tramiton-core git dependency during the
-          # image build (injected as a BuildKit secret, never baked into a layer).
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-agent
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
-            -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          docker build -f Dockerfile.agent -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy agent"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -220,16 +169,13 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
-        env:
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-dashboard
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
-            -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          docker build -f Dockerfile.dashboard -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy dashboard"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -265,16 +211,13 @@ jobs:
      image: docker:27-cli
    steps:
      - name: Build, push and trigger orca redeploy
-        env:
-          TRAMITON_FETCH_TOKEN: ${{ secrets.TRAMITON_FETCH_TOKEN }}
        run: |
          apk add --no-cache git curl openssl
          git init && git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}" && git checkout FETCH_HEAD
          IMAGE=registry.meghsakha.com/compliance-mcp
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login registry.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
-          DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN \
-            -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
+          docker build -f Dockerfile.mcp -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
          docker push "$IMAGE:latest" && docker push "$IMAGE:${GITHUB_SHA}"
          PAYLOAD=$(printf '{"ref":"refs/heads/main","repository":{"full_name":"sharang/compliance-scanner-agent"},"head_commit":{"id":"%s","message":"deploy mcp"}}' "${GITHUB_SHA}")
          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "${{ secrets.ORCA_WEBHOOK_SECRET }}" | awk '{print $2}')
@@ -676,7 +676,6 @@ dependencies = [
 "jsonwebtoken",
 "mongodb",
 "octocrab",
- "rand 0.9.2",
 "regex",
 "reqwest",
 "secrecy",
@@ -692,9 +691,6 @@ dependencies = [
 "tower-http",
 "tracing",
 "tracing-subscriber",
- "tramiton-core",
- "tramiton-repro",
- "tramiton-sbom",
 "urlencoding",
 "uuid",
 "walkdir",
@@ -822,15 +818,12 @@ dependencies = [
 "bson",
 "chrono",
 "compliance-core",
- "dashmap",
 "dotenvy",
- "hex",
 "mongodb",
 "rmcp",
 "schemars 1.2.1",
 "serde",
 "serde_json",
- "sha2",
 "thiserror 2.0.18",
 "tokio",
 "tower-http",
@@ -1121,9 +1114,9 @@ dependencies = [

 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.20"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
 "crossbeam-utils",
 ]
@@ -2103,7 +2096,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3698,7 +3691,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3769,15 +3762,6 @@ dependencies = [
 "syn",
 ]

-[[package]]
-name = "object"
-version = "0.36.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "octocrab"
 version = "0.44.1"
@@ -4209,7 +4193,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit 0.23.10+spec-1.0.0",
+ "toml_edit",
 ]

 [[package]]
@@ -4294,9 +4278,9 @@ dependencies = [

 [[package]]
 name = "quinn-proto"
-version = "0.11.15"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
 "bytes",
 "getrandom 0.3.4",
@@ -4679,7 +4663,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.4.15",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

 [[package]]
@@ -4692,7 +4676,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5008,15 +4992,6 @@ dependencies = [
 "syn",
 ]

-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5570,10 +5545,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.1",
 "once_cell",
 "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5831,27 +5806,6 @@ dependencies = [
 "tokio",
 ]

-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
-[[package]]
-name = "toml_datetime"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5861,20 +5815,6 @@ dependencies = [
 "serde_core",
 ]

-[[package]]
-name = "toml_edit"
-version = "0.22.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap 2.13.0",
- "serde",
- "serde_spanned",
- "toml_datetime 0.6.11",
- "toml_write",
- "winnow",
-]
-
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5882,7 +5822,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
 "indexmap 2.13.0",
- "toml_datetime 0.7.5+spec-1.1.0",
+ "toml_datetime",
 "toml_parser",
 "winnow",
 ]
@@ -5896,12 +5836,6 @@ dependencies = [
 "winnow",
 ]

-[[package]]
-name = "toml_write"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
-
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6148,46 +6082,6 @@ dependencies = [
 "wasm-bindgen",
 ]

-[[package]]
-name = "tramiton-core"
-version = "0.4.1"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
-dependencies = [
- "serde",
- "tempfile",
- "thiserror 1.0.69",
- "toml",
- "walkdir",
-]
-
-[[package]]
-name = "tramiton-repro"
-version = "0.4.1"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
-dependencies = [
- "serde",
- "serde_json",
- "sha2",
- "tempfile",
- "thiserror 1.0.69",
- "toml",
- "tramiton-core",
- "walkdir",
-]
-
-[[package]]
-name = "tramiton-sbom"
-version = "0.4.1"
-source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba"
-dependencies = [
- "object",
- "serde",
- "serde_json",
- "sha2",
- "tramiton-core",
- "tramiton-repro",
-]
-
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"
@@ -6746,7 +6640,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -34,5 +34,3 @@ zip = { version = "2", features = ["aes-crypto", "deflate"] }
 dashmap = "6"
 tokio-stream = { version = "0.1", features = ["sync"] }
 aes-gcm = "0.10"
-rand = "0.9"
-base64 = "0.22"
@@ -2,22 +2,7 @@ FROM rust:1.94-bookworm AS builder

 WORKDIR /app
 COPY . .
-# compliance-agent depends on the private tramiton-core git repo. Authenticate
-# the fetch with a PAT passed as a BuildKit secret (never baked into a layer).
-# Build with: DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=TRAMITON_FETCH_TOKEN ...
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-agent
-
-# A throwaway stage that packs a real nix store (store paths + the validity DB)
-# into a compressed bootstrap tarball. Only the tarball is copied into the final
-# image, so we don't carry a raw /nix copy layer.
-FROM nixos/nix:latest AS nixseed
-RUN tar -C / -czf /nix-bootstrap.tar.gz nix
+RUN cargo build --release -p compliance-agent

 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 git curl python3 python3-pip npm golang-go php-cli && rm -rf /var/lib/apt/lists/*
@@ -46,30 +31,7 @@ RUN pip3 install --break-system-packages semgrep
 # Install ruff for Python linting
 RUN pip3 install --break-system-packages ruff

-# Real nix for the tramiton reproducible-build firmware SBOM.
-#
-# nix-portable's proot fallback can't run here: user namespaces are blocked by
-# the container's default seccomp/apparmor profile, and orca exposes no way to
-# relax it. So ship a *real* nix and disable its build sandbox
-# (`sandbox = false`) — a plain gcc/make firmware build needs no user namespace,
-# so it runs fine under the locked-down profile with no proot involved.
-#
-# The store is shipped as a bootstrap tarball and seeded onto /nix at first
-# start (see docker/agent-entrypoint.sh), so a persistent /nix volume survives
-# redeploys. A missing/broken nix just falls back to the analysis-only SBOM.
-COPY --from=nixseed /nix-bootstrap.tar.gz /opt/nix-bootstrap.tar.gz
-ENV PATH="/nix/var/nix/profiles/default/bin:${PATH}"
-RUN mkdir -p /etc/nix && printf '%s\n' \
-      'experimental-features = nix-command flakes' \
-      'sandbox = false' \
-      'build-users-group =' \
-      'substituters = https://cache.nixos.org' \
-      'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
-      > /etc/nix/nix.conf
-
 COPY --from=builder /app/target/release/compliance-agent /usr/local/bin/compliance-agent
-COPY docker/agent-entrypoint.sh /usr/local/bin/agent-entrypoint.sh
-RUN chmod +x /usr/local/bin/agent-entrypoint.sh

 # Copy documentation for the help chat assistant
 COPY --from=builder /app/README.md /app/README.md
@@ -81,6 +43,5 @@ RUN mkdir -p /data/compliance-scanner/ssh

 EXPOSE 3001 3002

-# Seeds /nix (fresh volume) from the bootstrap tarball, then runs the agent.
-ENTRYPOINT ["/usr/local/bin/agent-entrypoint.sh"]
+ENTRYPOINT ["compliance-agent"]

@@ -7,16 +7,7 @@ ARG DOCS_URL=/docs
 WORKDIR /app
 COPY . .
 ENV DOCS_URL=${DOCS_URL}
-# compliance-agent (a workspace member) depends on the private tramiton-core git
-# repo, so the workspace resolve needs it even to build the dashboard.
-# Authenticate the fetch with a PAT passed as a BuildKit secret.
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true dx build --release --package compliance-dashboard
+RUN dx build --release --package compliance-dashboard

 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
@@ -2,16 +2,7 @@ FROM rust:1.94-bookworm AS builder

 WORKDIR /app
 COPY . .
-# compliance-agent (a workspace member) depends on the private tramiton-core git
-# repo, so the workspace resolve needs it even to build the mcp binary.
-# Authenticate the fetch with a PAT passed as a BuildKit secret.
-RUN --mount=type=secret,id=tramiton_token \
-    if [ -s /run/secrets/tramiton_token ]; then \
-      git config --global \
-        url."https://sharang:$(cat /run/secrets/tramiton_token)@gitea.meghsakha.com/".insteadOf \
-        "ssh://git@gitea.meghsakha.com:22222/"; \
-    fi && \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p compliance-mcp
+RUN cargo build --release -p compliance-mcp

 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
@@ -10,16 +10,6 @@ workspace = true
 compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
-# Native firmware build/target detection for bare-metal & RTOS artifacts.
-# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
-# available to the onboarding classifier. NOTE: CI must be able to fetch this
-# private repo (see the git-auth step in .gitea/workflows/ci.yml).
-tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
-# tramiton-repro drives the reproducible build (NixBackend seal_and_build) that
-# yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback.
-tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
-# tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA).
-tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -52,7 +42,6 @@ tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
 futures-core = "0.3"
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
-rand = { workspace = true }

 [dev-dependencies]
 compliance-core = { workspace = true, features = ["mongodb", "axum"] }
@@ -63,22 +63,7 @@ impl ComplianceAgent {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run_target(repo_id, trigger).await
-    }
-
-    /// Alias for [`Self::run_scan`] — every scan runs the unified onboarded-target
-    /// pipeline. Kept as a distinct name for the `/targets/{id}/scan` endpoint's
-    /// intent.
-    pub async fn run_target_scan(
-        &self,
-        tenant_id: &str,
-        target_id: &str,
-        trigger: compliance_core::models::ScanTrigger,
-    ) -> Result<(), crate::error::AgentError> {
-        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-        let orchestrator =
-            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-        orchestrator.run_target(target_id, trigger).await
+        orchestrator.run(repo_id, trigger).await
    }

    /// Run a PR review: scan the diff and post review comments.
@@ -91,19 +76,16 @@ impl ComplianceAgent {
        head_sha: &str,
    ) -> Result<(), crate::error::AgentError> {
        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-        let oid = mongodb::bson::oid::ObjectId::parse_str(repo_id)
-            .map_err(|e| crate::error::AgentError::Other(e.to_string()))?;
-        let target = db
-            .onboarded_targets()
-            .find_one(mongodb::bson::doc! { "_id": oid })
+        let repo = db
+            .repositories()
+            .find_one(mongodb::bson::doc! {
+                "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id)
+                    .map_err(|e| crate::error::AgentError::Other(e.to_string()))?
+            })
            .await?
            .ok_or_else(|| {
-                crate::error::AgentError::Other(format!("Target {repo_id} not found"))
+                crate::error::AgentError::Other(format!("Repository {repo_id} not found"))
            })?;
-        let code = target.code_artifact().ok_or_else(|| {
-            crate::error::AgentError::Other(format!("Target {repo_id} has no code artifact"))
-        })?;
-        let repo = crate::pipeline::repo_view::RepoView::from_target(&target, code);

        let orchestrator =
            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
@@ -146,7 +146,7 @@ pub async fn build_embeddings(
    let agent_clone = (*agent).clone();
    tokio::spawn(async move {
        let repo = match db
-            .onboarded_targets()
+            .repositories()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
            .await
        {
@@ -194,22 +194,14 @@ pub async fn build_embeddings(
                }
            };

-        let code = match repo.code_artifact() {
-            Some(c) => c,
-            None => {
-                tracing::error!("Target {repo_id} has no code artifact for embedding build");
-                return;
-            }
-        };
-        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
        let creds = crate::pipeline::git::RepoCredentials {
            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: view.auth_token.clone(),
-            auth_username: view.auth_username.clone(),
+            auth_token: repo.auth_token.clone(),
+            auth_username: repo.auth_username.clone(),
        };
        let git_ops =
            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
+        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
            Ok(p) => p,
            Err(e) => {
                tracing::error!("Failed to clone repo for embedding build: {e}");
@@ -255,7 +255,7 @@ pub async fn get_file_content(

    // Look up the repository to get repo name
    let repo = db
-        .onboarded_targets()
+        .repositories()
        .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
@@ -317,7 +317,7 @@ pub async fn trigger_build(
    let agent_clone = (*agent).clone();
    tokio::spawn(async move {
        let repo = match db
-            .onboarded_targets()
+            .repositories()
            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
            .await
        {
@@ -328,22 +328,14 @@ pub async fn trigger_build(
            }
        };

-        let code = match repo.code_artifact() {
-            Some(c) => c,
-            None => {
-                tracing::error!("Target {repo_id} has no code artifact for graph build");
-                return;
-            }
-        };
-        let view = crate::pipeline::repo_view::RepoView::from_target(&repo, code);
        let creds = crate::pipeline::git::RepoCredentials {
            ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
-            auth_token: view.auth_token.clone(),
-            auth_username: view.auth_username.clone(),
+            auth_token: repo.auth_token.clone(),
+            auth_username: repo.auth_username.clone(),
        };
        let git_ops =
            crate::pipeline::git::GitOps::new(&agent_clone.config.git_clone_base_path, creds);
-        let repo_path = match git_ops.clone_or_fetch(&view.git_url, &view.name) {
+        let repo_path = match git_ops.clone_or_fetch(&repo.git_url, &repo.name) {
            Ok(p) => p,
            Err(e) => {
                tracing::error!("Failed to clone repo for graph build: {e}");
@@ -10,18 +10,6 @@ pub async fn health() -> Json<serde_json::Value> {
    Json(serde_json::json!({ "status": "ok" }))
 }

-/// GET /api/v1/settings/ssh-public-key — the agent's SSH deploy public key,
-/// for adding as a read-only deploy key on private git targets.
-#[tracing::instrument(skip_all)]
-pub async fn get_ssh_public_key(
-    axum::extract::Extension(agent): AgentExt,
-) -> Result<Json<serde_json::Value>, axum::http::StatusCode> {
-    let public_path = format!("{}.pub", agent.config.ssh_key_path);
-    let public_key =
-        std::fs::read_to_string(&public_path).map_err(|_| axum::http::StatusCode::NOT_FOUND)?;
-    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
-}
-
 #[tracing::instrument(skip_all)]
 pub async fn stats_overview(
    axum::extract::Extension(agent): AgentExt,
@@ -31,7 +19,7 @@ pub async fn stats_overview(
    let db = &db;

    let total_repositories = db
-        .onboarded_targets()
+        .repositories()
        .count_documents(doc! {})
        .await
        .unwrap_or(0);
@@ -1,186 +0,0 @@
-//! `/api/v1/mcp-tokens` — per-tenant API tokens for the MCP server.
-//!
-//! These are opaque static bearers issued via the dashboard (or a
-//! direct curl with a KC JWT) and copied into LLM clients (Claude
-//! Desktop / Cursor / ChatGPT). The MCP server hashes incoming bearers
-//! and looks them up in the cross-tenant `<prefix>__admin.mcp_tokens`
-//! collection to derive the tenant_id for routing.
-//!
-//! The raw token is shown to the caller exactly once at creation; the
-//! database only ever stores the SHA-256 hash. Revocation is a soft
-//! delete (sets `revoked: true`) so the audit log keeps the record.
-
-use axum::extract::{Extension, Path};
-use axum::http::StatusCode;
-use axum::Json;
-use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
-use compliance_core::models::{McpToken, McpTokenView};
-use compliance_core::tenant_ctx::TenantCtx;
-use mongodb::bson::doc;
-use rand::RngCore;
-use sha2::{Digest, Sha256};
-
-use super::dto::{AgentExt, ApiResponse};
-
-/// Mongo collection name inside the admin DB.
-const COLLECTION: &str = "mcp_tokens";
-
-/// Token prefix the MCP server expects on every bearer.
-const TOKEN_PREFIX: &str = "mcpt_";
-
-/// Bytes of randomness behind each token. 32 → ~256 bits.
-/// Encoded as URL-safe base64 without padding → 43 chars.
-/// Combined with `mcpt_` → 48-char tokens.
-const TOKEN_RAND_BYTES: usize = 32;
-
-#[derive(serde::Deserialize)]
-pub struct CreateMcpTokenRequest {
-    pub name: String,
-}
-
-/// Returned exactly once at creation. The `token` field is gone from
-/// the listing endpoint — the user must save it now.
-#[derive(serde::Serialize)]
-pub struct CreateMcpTokenResponse {
-    pub token: String,
-    pub view: McpTokenView,
-}
-
-/// `POST /api/v1/mcp-tokens` — mint a new token for the caller's tenant.
-#[tracing::instrument(skip_all)]
-pub async fn create_mcp_token(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<CreateMcpTokenRequest>,
-) -> Result<Json<CreateMcpTokenResponse>, StatusCode> {
-    if req.name.trim().is_empty() {
-        return Err(StatusCode::BAD_REQUEST);
-    }
-    let raw = generate_token();
-    let token_hash = sha256_hex(&raw);
-    let token_prefix: String = raw.chars().take(12).collect();
-
-    let mut token = McpToken {
-        id: None,
-        token_hash,
-        token_prefix,
-        tenant_id: tenant.0.tenant_id.clone(),
-        name: req.name.trim().to_string(),
-        created_by: tenant.0.user_id.clone(),
-        created_at: chrono::Utc::now(),
-        last_used_at: None,
-        revoked: false,
-    };
-
-    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
-    let res = col.insert_one(&token).await.map_err(|e| {
-        tracing::error!("Failed to insert MCP token: {e}");
-        StatusCode::INTERNAL_SERVER_ERROR
-    })?;
-    token.id = res.inserted_id.as_object_id();
-
-    Ok(Json(CreateMcpTokenResponse {
-        view: McpTokenView::from(&token),
-        token: raw,
-    }))
-}
-
-/// `GET /api/v1/mcp-tokens` — list tokens for the caller's tenant.
-/// Hash is never returned; only metadata + the 12-char prefix so the
-/// user can identify which row is which.
-#[tracing::instrument(skip_all)]
-pub async fn list_mcp_tokens(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-) -> Result<Json<ApiResponse<Vec<McpTokenView>>>, StatusCode> {
-    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
-    let mut cursor = col
-        .find(doc! { "tenant_id": &tenant.0.tenant_id })
-        .sort(doc! { "created_at": -1 })
-        .await
-        .map_err(|e| {
-            tracing::error!("Failed to list MCP tokens: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-    let mut out = Vec::new();
-    while cursor.advance().await.map_err(|e| {
-        tracing::warn!("MCP tokens cursor advance failed: {e}");
-        StatusCode::INTERNAL_SERVER_ERROR
-    })? {
-        match cursor.deserialize_current() {
-            Ok(t) => out.push(McpTokenView::from(&t)),
-            Err(e) => tracing::warn!("Failed to deserialize MCP token: {e}"),
-        }
-    }
-    Ok(Json(ApiResponse {
-        data: out,
-        total: None,
-        page: None,
-    }))
-}
-
-/// `DELETE /api/v1/mcp-tokens/{id}` — revoke (soft delete).
-/// Scoped to the caller's tenant: a user can't revoke another tenant's
-/// token even if they guess its id.
-#[tracing::instrument(skip_all, fields(id = %id))]
-pub async fn revoke_mcp_token(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
-    let result = col
-        .update_one(
-            doc! { "_id": oid, "tenant_id": &tenant.0.tenant_id },
-            doc! { "$set": { "revoked": true } },
-        )
-        .await
-        .map_err(|e| {
-            tracing::error!("Failed to revoke MCP token: {e}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        })?;
-    if result.matched_count == 0 {
-        return Err(StatusCode::NOT_FOUND);
-    }
-    Ok(Json(serde_json::json!({ "status": "revoked" })))
-}
-
-/// 32 bytes random → URL-safe base64 → 43 chars, no padding.
-/// Prefixed with `mcpt_` so the MCP server can sniff the format
-/// before bothering with the DB lookup.
-fn generate_token() -> String {
-    let mut bytes = [0u8; TOKEN_RAND_BYTES];
-    rand::rng().fill_bytes(&mut bytes);
-    format!("{TOKEN_PREFIX}{}", URL_SAFE_NO_PAD.encode(bytes))
-}
-
-fn sha256_hex(s: &str) -> String {
-    let mut h = Sha256::new();
-    h.update(s.as_bytes());
-    hex::encode(h.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn generated_tokens_are_unique_and_prefixed() {
-        let a = generate_token();
-        let b = generate_token();
-        assert_ne!(a, b);
-        assert!(a.starts_with(TOKEN_PREFIX));
-        assert!(b.starts_with(TOKEN_PREFIX));
-        // 5 + 43 = 48 chars
-        assert_eq!(a.len(), 5 + 43);
-    }
-
-    #[test]
-    fn sha256_is_stable_and_64_hex() {
-        let h = sha256_hex("mcpt_abc");
-        assert_eq!(h.len(), 64);
-        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
-        assert_eq!(sha256_hex("mcpt_abc"), h);
-    }
-}
@@ -7,11 +7,10 @@ pub mod graph;
 pub mod health;
 pub mod help_chat;
 pub mod issues;
-pub mod mcp_tokens;
 pub mod notifications;
-pub mod onboarding;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;
+pub mod repos;
 pub mod sbom;
 pub mod scans;

@@ -20,5 +19,6 @@ pub use dto::*;
 pub use findings::*;
 pub use health::*;
 pub use issues::*;
+pub use repos::*;
 pub use sbom::*;
 pub use scans::*;
@@ -1,504 +0,0 @@
-//! Onboarding API — CRUD for unified targets, artifact add, classification, and
-//! the scan-applicability matrix. The wizard (and future integrations) drive
-//! onboarding through these endpoints.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use axum::extract::{Extension, Path, Query};
-use axum::http::StatusCode;
-use axum::Json;
-use mongodb::bson::{doc, oid::ObjectId, to_bson};
-use serde::{Deserialize, Serialize};
-
-use compliance_core::models::{
-    Artifact, ArtifactKind, ComplianceProfile, OnboardedTarget, PlcFormat, TargetScanConfig,
-    TargetType,
-};
-use compliance_core::scan_matrix::{applicable_scans, supports_pentest};
-use compliance_core::tenant_ctx::TenantCtx;
-
-use crate::agent::ComplianceAgent;
-use crate::classify::{classify_target, MockFirmwareDetector};
-
-use super::dto::tenant_db;
-use super::{collect_cursor_async, ApiResponse, PaginationParams};
-
-type AgentExt = Extension<Arc<ComplianceAgent>>;
-
-/// A client-supplied artifact spec. The server builds the [`Artifact`] (and its
-/// id) from it, so clients never set internal fields.
-#[derive(Deserialize)]
-pub struct ArtifactInput {
-    pub kind: ArtifactKind,
-    pub source_ref: String,
-    #[serde(default)]
-    pub branch: Option<String>,
-    #[serde(default)]
-    pub plc_format: Option<PlcFormat>,
-}
-
-impl ArtifactInput {
-    fn build(&self) -> Artifact {
-        let s = self.source_ref.clone();
-        match self.kind {
-            ArtifactKind::GitRepo => {
-                Artifact::git_repo(s, self.branch.clone().unwrap_or_else(|| "main".to_string()))
-            }
-            ArtifactKind::LiveUrl => Artifact::live_url(s),
-            ArtifactKind::FirmwareImage => Artifact::firmware_image(s),
-            ArtifactKind::SourceArchive => Artifact::source_archive(s),
-            ArtifactKind::MobilePackage => Artifact::mobile_package(s),
-            ArtifactKind::ContainerImage => Artifact::container_image(s),
-            ArtifactKind::PlcProject => {
-                Artifact::plc_project(s, self.plc_format.unwrap_or(PlcFormat::PlcopenXml))
-            }
-            ArtifactKind::PlaintextDescription => Artifact::plaintext(s),
-        }
-    }
-}
-
-#[derive(Deserialize)]
-pub struct CreateTargetRequest {
-    pub name: String,
-    pub target_type: TargetType,
-    #[serde(default)]
-    pub description: Option<String>,
-    #[serde(default)]
-    pub artifacts: Vec<ArtifactInput>,
-}
-
-#[derive(Deserialize)]
-pub struct UpdateTargetRequest {
-    pub name: Option<String>,
-    pub target_type: Option<TargetType>,
-    pub scan_config: Option<TargetScanConfig>,
-    pub compliance_profile: Option<ComplianceProfile>,
-    pub scan_schedule: Option<String>,
-    /// Replace the target's artifacts wholesale (used by the dashboard editor).
-    #[serde(default)]
-    pub artifacts: Option<Vec<ArtifactInput>>,
-}
-
-/// One applicable-scan option, serialized for the wizard.
-#[derive(Serialize)]
-pub struct ScanOptionDto {
-    pub scan: String,
-    pub default_on: bool,
-    pub rationale: String,
-    pub required_artifact: Option<String>,
-    pub blocked_reason: Option<String>,
-}
-
-#[derive(Serialize)]
-pub struct ApplicableScansResponse {
-    pub scans: Vec<ScanOptionDto>,
-    pub pentest_supported: bool,
-}
-
-fn parse_oid(id: &str) -> Result<ObjectId, StatusCode> {
-    ObjectId::parse_str(id).map_err(|_| StatusCode::BAD_REQUEST)
-}
-
-/// GET /api/v1/targets — list onboarded targets (paginated).
-#[tracing::instrument(skip_all)]
-pub async fn list_targets(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Query(params): Query<PaginationParams>,
-) -> Result<Json<ApiResponse<Vec<OnboardedTarget>>>, StatusCode> {
-    let db = tenant_db(&agent, &tenant).await?;
-    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = db
-        .onboarded_targets()
-        .count_documents(doc! {})
-        .await
-        .unwrap_or(0);
-    let targets = match db
-        .onboarded_targets()
-        .find(doc! {})
-        .skip(skip)
-        .limit(params.limit)
-        .await
-    {
-        Ok(cursor) => collect_cursor_async(cursor).await,
-        Err(e) => {
-            tracing::warn!("Failed to fetch onboarded targets: {e}");
-            Vec::new()
-        }
-    };
-    Ok(Json(ApiResponse {
-        data: targets,
-        total: Some(total),
-        page: Some(params.page),
-    }))
-}
-
-/// POST /api/v1/targets — create an onboarded target.
-#[tracing::instrument(skip_all)]
-pub async fn create_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Json(req): Json<CreateTargetRequest>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let mut target = OnboardedTarget::new(req.name, req.target_type);
-    target.description = req.description;
-    target.artifacts = req.artifacts.iter().map(ArtifactInput::build).collect();
-
-    let db = tenant_db(&agent, &tenant).await?;
-    let res = db
-        .onboarded_targets()
-        .insert_one(&target)
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    target.id = res.inserted_id.as_object_id();
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// GET /api/v1/targets/{id} — fetch one target.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn get_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// PATCH /api/v1/targets/{id} — update mutable fields.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn update_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(req): Json<UpdateTargetRequest>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-
-    let mut set = doc! { "updated_at": mongodb::bson::DateTime::now() };
-    if let Some(name) = req.name {
-        set.insert("name", name);
-    }
-    if let Some(tt) = req.target_type {
-        set.insert(
-            "target_type",
-            to_bson(&tt).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(sc) = req.scan_config {
-        set.insert(
-            "scan_config",
-            to_bson(&sc).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(cp) = req.compliance_profile {
-        set.insert(
-            "compliance_profile",
-            to_bson(&cp).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-    if let Some(ss) = req.scan_schedule {
-        set.insert("scan_schedule", ss);
-    }
-    if let Some(arts) = req.artifacts {
-        let built: Vec<Artifact> = arts.iter().map(ArtifactInput::build).collect();
-        set.insert(
-            "artifacts",
-            to_bson(&built).map_err(|_| StatusCode::BAD_REQUEST)?,
-        );
-    }
-
-    db.onboarded_targets()
-        .update_one(doc! { "_id": oid }, doc! { "$set": set })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// DELETE /api/v1/targets/{id} — remove the target and its findings/scans.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn delete_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    db.onboarded_targets()
-        .delete_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    // Cascade all data keyed by repo_id == target id (best-effort).
-    let db = &db;
-    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .tracker_issues()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
-    let _ = db
-        .impact_analyses()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .code_embeddings()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-    let _ = db
-        .embedding_builds()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    // DAST targets linked to this target, and all their downstream data.
-    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(dt)) = cursor.next().await {
-            let dast_target_id = dt.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !dast_target_id.is_empty() {
-                cascade_delete_dast_target(db, &dast_target_id).await;
-            }
-        }
-    }
-
-    // Pentest sessions linked directly to this target (not via a DAST target).
-    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
-        use futures_util::StreamExt;
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "repo_id": &id })
-        .await;
-
-    Ok(Json(serde_json::json!({ "status": "deleted" })))
-}
-
-/// Delete a DAST target and everything downstream of it (pentest sessions +
-/// their attack chains / messages / findings, DAST scan runs + findings).
-async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
-    use futures_util::StreamExt;
-    if let Ok(mut cursor) = db
-        .pentest_sessions()
-        .find(doc! { "target_id": target_id })
-        .await
-    {
-        while let Some(Ok(session)) = cursor.next().await {
-            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
-            if !session_id.is_empty() {
-                let _ = db
-                    .attack_chain_nodes()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .pentest_messages()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-                let _ = db
-                    .dast_findings()
-                    .delete_many(doc! { "session_id": &session_id })
-                    .await;
-            }
-        }
-    }
-    let _ = db
-        .pentest_sessions()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-    let _ = db
-        .dast_findings()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-    let _ = db
-        .dast_scan_runs()
-        .delete_many(doc! { "target_id": target_id })
-        .await;
-    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
-        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
-    }
-}
-
-/// POST /api/v1/targets/{id}/artifacts — attach an artifact (by reference).
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn add_artifact(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-    Json(input): Json<ArtifactInput>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let artifact = to_bson(&input.build()).map_err(|_| StatusCode::BAD_REQUEST)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$push": { "artifacts": artifact }, "$set": { "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    get_target(Extension(agent), tenant, Path(id)).await
-}
-
-/// GET /api/v1/targets/{id}/applicable-scans — the scan-applicability matrix.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn applicable_scans_for_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<ApplicableScansResponse>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    let scans = applicable_scans(&target)
-        .into_iter()
-        .map(|o| ScanOptionDto {
-            scan: o.scan.to_string(),
-            default_on: o.default_on,
-            rationale: o.rationale,
-            required_artifact: o.required_artifact.map(|k| k.to_string()),
-            blocked_reason: o.blocked_reason,
-        })
-        .collect();
-
-    Ok(Json(ApiResponse {
-        data: ApplicableScansResponse {
-            scans,
-            pentest_supported: supports_pentest(target.target_type),
-        },
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/targets/{id}/detect — classify the target from its artifacts.
-///
-/// This is the lightweight pass: it classifies from artifact kinds without
-/// ingesting (cloning) sources, so it returns immediately. Deep detection (after
-/// ingest, with tramiton firmware analysis) is a follow-up background step.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn detect_target(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<ApiResponse<OnboardedTarget>>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    let mut target = db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .ok_or(StatusCode::NOT_FOUND)?;
-
-    // No ingested working paths here → kind-based classification only; the mock
-    // firmware detector is never invoked (no firmware working path present).
-    let empty = HashMap::new();
-    let detector = MockFirmwareDetector { detection: None };
-    let classification = classify_target(&target, &empty, &detector)
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-
-    let classification_bson =
-        to_bson(&classification).map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    db.onboarded_targets()
-        .update_one(
-            doc! { "_id": oid },
-            doc! { "$set": { "classification": classification_bson, "updated_at": mongodb::bson::DateTime::now() } },
-        )
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
-    target.classification = Some(classification);
-
-    Ok(Json(ApiResponse {
-        data: target,
-        total: None,
-        page: None,
-    }))
-}
-
-/// POST /api/v1/targets/{id}/scan — trigger a scan for the target.
-///
-/// Dispatches to the unified pipeline when `UNIFIED_PIPELINE` is set (else the
-/// legacy path). Runs in the background and returns immediately.
-#[tracing::instrument(skip_all, fields(target_id = %id))]
-pub async fn trigger_target_scan(
-    Extension(agent): AgentExt,
-    tenant: TenantCtx,
-    Path(id): Path<String>,
-) -> Result<Json<serde_json::Value>, StatusCode> {
-    let oid = parse_oid(&id)?;
-    let db = tenant_db(&agent, &tenant).await?;
-    // 404 if the target doesn't exist for this tenant.
-    if db
-        .onboarded_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
-        .is_none()
-    {
-        return Err(StatusCode::NOT_FOUND);
-    }
-
-    let agent_clone = (*agent).clone();
-    let tenant_id = tenant.0.tenant_id.clone();
-    tokio::spawn(async move {
-        // Always the unified target pipeline — this endpoint is about an
-        // onboarded target by construction, independent of the global
-        // `unified_pipeline` transition flag used by the legacy paths.
-        if let Err(e) = agent_clone
-            .run_target_scan(
-                &tenant_id,
-                &id,
-                compliance_core::models::ScanTrigger::Manual,
-            )
-            .await
-        {
-            tracing::error!("Manual target scan failed for {id}: {e}");
-        }
-    });
-    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
-}
@@ -113,14 +113,14 @@ pub async fn create_session(
        session.config = Some(config.clone());
        session.repo_id = target.repo_id.clone();

-        // Resolve repo_id (target id) from git_repo_url if provided
+        // Resolve repo_id from git_repo_url if provided
        if let Some(ref git_url) = config.git_repo_url {
-            if let Ok(Some(target)) = db
-                .onboarded_targets()
-                .find_one(doc! { "artifacts.source_ref": git_url })
+            if let Ok(Some(repo)) = db
+                .repositories()
+                .find_one(doc! { "git_url": git_url })
                .await
            {
-                session.repo_id = target.id.map(|oid| oid.to_hex());
+                session.repo_id = repo.id.map(|oid| oid.to_hex());
            }
        }

@@ -380,20 +380,17 @@ pub async fn lookup_repo(
 ) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
    let db = tenant_db(&agent, &tenant).await?;
    let repo = db
-        .onboarded_targets()
-        .find_one(doc! { "artifacts.source_ref": &params.url })
+        .repositories()
+        .find_one(doc! { "git_url": &params.url })
        .await
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

    let data = match repo {
-        Some(r) => {
-            let git = r.code_artifact().and_then(|c| c.git.as_ref());
-            serde_json::json!({
-                "name": r.name,
-                "default_branch": git.map(|g| g.default_branch.clone()),
-                "last_scanned_commit": git.and_then(|g| g.last_scanned_commit.clone()),
-            })
-        }
+        Some(r) => serde_json::json!({
+            "name": r.name,
+            "default_branch": r.default_branch,
+            "last_scanned_commit": r.last_scanned_commit,
+        }),
        None => serde_json::Value::Null,
    };

@@ -0,0 +1,339 @@
+use axum::extract::{Extension, Path, Query};
+use axum::http::StatusCode;
+use axum::Json;
+use mongodb::bson::doc;
+
+use super::dto::*;
+use compliance_core::models::*;
+use compliance_core::tenant_ctx::TenantCtx;
+
+#[tracing::instrument(skip_all)]
+pub async fn list_repositories(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Query(params): Query<PaginationParams>,
+) -> ApiResult<Vec<TrackedRepository>> {
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
+    let skip = (params.page.saturating_sub(1)) * params.limit as u64;
+    let total = db
+        .repositories()
+        .count_documents(doc! {})
+        .await
+        .unwrap_or(0);
+
+    let repos = match db
+        .repositories()
+        .find(doc! {})
+        .skip(skip)
+        .limit(params.limit)
+        .await
+    {
+        Ok(cursor) => collect_cursor_async(cursor).await,
+        Err(e) => {
+            tracing::warn!("Failed to fetch repositories: {e}");
+            Vec::new()
+        }
+    };
+
+    Ok(Json(ApiResponse {
+        data: repos,
+        total: Some(total),
+        page: Some(params.page),
+    }))
+}
+
+#[tracing::instrument(skip_all)]
+pub async fn add_repository(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<AddRepositoryRequest>,
+) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
+    // Validate repository access before saving
+    let creds = crate::pipeline::git::RepoCredentials {
+        ssh_key_path: Some(agent.config.ssh_key_path.clone()),
+        auth_token: req.auth_token.clone(),
+        auth_username: req.auth_username.clone(),
+    };
+
+    if let Err(e) = crate::pipeline::git::GitOps::test_access(&req.git_url, &creds) {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            format!("Cannot access repository: {e}"),
+        ));
+    }
+
+    let mut repo = TrackedRepository::new(req.name, req.git_url);
+    repo.default_branch = req.default_branch;
+    repo.auth_token = req.auth_token;
+    repo.auth_username = req.auth_username;
+    repo.tracker_type = req.tracker_type;
+    repo.tracker_owner = req.tracker_owner;
+    repo.tracker_repo = req.tracker_repo;
+    repo.tracker_token = req.tracker_token;
+    repo.scan_schedule = req.scan_schedule;
+
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
+    db.repositories().insert_one(&repo).await.map_err(|_| {
+        (
+            StatusCode::CONFLICT,
+            "Repository already exists".to_string(),
+        )
+    })?;
+
+    Ok(Json(ApiResponse {
+        data: repo,
+        total: None,
+        page: None,
+    }))
+}
+
+#[tracing::instrument(skip_all, fields(repo_id = %id))]
+pub async fn update_repository(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+    Json(req): Json<UpdateRepositoryRequest>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
+
+    let mut set_doc = doc! { "updated_at": mongodb::bson::DateTime::now() };
+
+    if let Some(name) = &req.name {
+        set_doc.insert("name", name);
+    }
+    if let Some(branch) = &req.default_branch {
+        set_doc.insert("default_branch", branch);
+    }
+    if let Some(token) = &req.auth_token {
+        set_doc.insert("auth_token", token);
+    }
+    if let Some(username) = &req.auth_username {
+        set_doc.insert("auth_username", username);
+    }
+    if let Some(tracker_type) = &req.tracker_type {
+        set_doc.insert("tracker_type", tracker_type.to_string());
+    }
+    if let Some(owner) = &req.tracker_owner {
+        set_doc.insert("tracker_owner", owner);
+    }
+    if let Some(repo) = &req.tracker_repo {
+        set_doc.insert("tracker_repo", repo);
+    }
+    if let Some(token) = &req.tracker_token {
+        set_doc.insert("tracker_token", token);
+    }
+    if let Some(schedule) = &req.scan_schedule {
+        set_doc.insert("scan_schedule", schedule);
+    }
+
+    let result = db
+        .repositories()
+        .update_one(doc! { "_id": oid }, doc! { "$set": set_doc })
+        .await
+        .map_err(|e| {
+            tracing::warn!("Failed to update repository: {e}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    if result.matched_count == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    Ok(Json(serde_json::json!({ "status": "updated" })))
+}
+
+#[tracing::instrument(skip_all)]
+pub async fn get_ssh_public_key(
+    Extension(agent): AgentExt,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let public_path = format!("{}.pub", agent.config.ssh_key_path);
+    let public_key = std::fs::read_to_string(&public_path).map_err(|_| StatusCode::NOT_FOUND)?;
+    Ok(Json(serde_json::json!({ "public_key": public_key.trim() })))
+}
+
+#[tracing::instrument(skip_all, fields(repo_id = %id))]
+pub async fn trigger_scan(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let agent_clone = (*agent).clone();
+    let tenant_id = tenant.0.tenant_id.clone();
+    tokio::spawn(async move {
+        if let Err(e) = agent_clone
+            .run_scan(&tenant_id, &id, ScanTrigger::Manual)
+            .await
+        {
+            tracing::error!("Manual scan failed for {id}: {e}");
+        }
+    });
+
+    Ok(Json(serde_json::json!({ "status": "scan_triggered" })))
+}
+
+/// Return the webhook secret for a repository (used by dashboard to display it)
+pub async fn get_webhook_config(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let repo = db
+        .repositories()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+        .ok_or(StatusCode::NOT_FOUND)?;
+
+    let tracker_type = repo
+        .tracker_type
+        .as_ref()
+        .map(|t| t.to_string())
+        .unwrap_or_else(|| "gitea".to_string());
+
+    Ok(Json(serde_json::json!({
+        "webhook_secret": repo.webhook_secret,
+        "tracker_type": tracker_type,
+    })))
+}
+
+#[tracing::instrument(skip_all, fields(repo_id = %id))]
+pub async fn delete_repository(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
+
+    // Delete the repository
+    let result = db
+        .repositories()
+        .delete_one(doc! { "_id": oid })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    if result.deleted_count == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    // Cascade delete all related data
+    let _ = db.findings().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.sbom_entries().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.scan_runs().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.cve_alerts().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db
+        .tracker_issues()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db.graph_nodes().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.graph_edges().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db.graph_builds().delete_many(doc! { "repo_id": &id }).await;
+    let _ = db
+        .impact_analyses()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db
+        .code_embeddings()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+    let _ = db
+        .embedding_builds()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+
+    // Cascade delete DAST targets linked to this repo, and all their downstream data
+    // (scan runs, findings, pentest sessions, attack chains, messages)
+    if let Ok(mut cursor) = db.dast_targets().find(doc! { "repo_id": &id }).await {
+        use futures_util::StreamExt;
+        while let Some(Ok(target)) = cursor.next().await {
+            let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !target_id.is_empty() {
+                cascade_delete_dast_target(db, &target_id).await;
+            }
+        }
+    }
+
+    // Also delete pentest sessions linked directly to this repo (not via target)
+    if let Ok(mut cursor) = db.pentest_sessions().find(doc! { "repo_id": &id }).await {
+        use futures_util::StreamExt;
+        while let Some(Ok(session)) = cursor.next().await {
+            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !session_id.is_empty() {
+                let _ = db
+                    .attack_chain_nodes()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .pentest_messages()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                // Delete DAST findings produced by this session
+                let _ = db
+                    .dast_findings()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+            }
+        }
+    }
+    let _ = db
+        .pentest_sessions()
+        .delete_many(doc! { "repo_id": &id })
+        .await;
+
+    Ok(Json(serde_json::json!({ "status": "deleted" })))
+}
+
+/// Cascade-delete a DAST target and all its downstream data.
+async fn cascade_delete_dast_target(db: &crate::database::Database, target_id: &str) {
+    // Delete pentest sessions for this target (and their attack chains + messages)
+    if let Ok(mut cursor) = db
+        .pentest_sessions()
+        .find(doc! { "target_id": target_id })
+        .await
+    {
+        use futures_util::StreamExt;
+        while let Some(Ok(session)) = cursor.next().await {
+            let session_id = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+            if !session_id.is_empty() {
+                let _ = db
+                    .attack_chain_nodes()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .pentest_messages()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+                let _ = db
+                    .dast_findings()
+                    .delete_many(doc! { "session_id": &session_id })
+                    .await;
+            }
+        }
+    }
+    let _ = db
+        .pentest_sessions()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+
+    // Delete DAST scan runs and their findings
+    let _ = db
+        .dast_findings()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+    let _ = db
+        .dast_scan_runs()
+        .delete_many(doc! { "target_id": target_id })
+        .await;
+
+    // Delete the target itself
+    if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(target_id) {
+        let _ = db.dast_targets().delete_one(doc! { "_id": oid }).await;
+    }
+}
@@ -282,7 +282,7 @@ pub async fn license_summary(
            }
        })
        .collect();
-    summaries.sort_by_key(|s| std::cmp::Reverse(s.count));
+    summaries.sort_by(|a, b| b.count.cmp(&a.count));

    Ok(Json(ApiResponse {
        data: summaries,
@@ -11,32 +11,19 @@ pub fn build_router() -> Router {
            "/api/v1/settings/ssh-public-key",
            get(handlers::get_ssh_public_key),
        )
-        // Unified onboarding targets (#131).
+        .route("/api/v1/repositories", get(handlers::list_repositories))
+        .route("/api/v1/repositories", post(handlers::add_repository))
        .route(
-            "/api/v1/targets",
-            get(handlers::onboarding::list_targets).post(handlers::onboarding::create_target),
+            "/api/v1/repositories/{id}/scan",
+            post(handlers::trigger_scan),
        )
        .route(
-            "/api/v1/targets/{id}",
-            get(handlers::onboarding::get_target)
-                .patch(handlers::onboarding::update_target)
-                .delete(handlers::onboarding::delete_target),
+            "/api/v1/repositories/{id}",
+            delete(handlers::delete_repository).patch(handlers::update_repository),
        )
        .route(
-            "/api/v1/targets/{id}/artifacts",
-            post(handlers::onboarding::add_artifact),
-        )
-        .route(
-            "/api/v1/targets/{id}/applicable-scans",
-            get(handlers::onboarding::applicable_scans_for_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/detect",
-            post(handlers::onboarding::detect_target),
-        )
-        .route(
-            "/api/v1/targets/{id}/scan",
-            post(handlers::onboarding::trigger_target_scan),
+            "/api/v1/repositories/{id}/webhook-config",
+            get(handlers::get_webhook_config),
        )
        .route("/api/v1/findings", get(handlers::list_findings))
        .route("/api/v1/findings/{id}", get(handlers::get_finding))
@@ -59,15 +46,6 @@ pub fn build_router() -> Router {
        .route("/api/v1/sbom/diff", get(handlers::sbom_diff))
        .route("/api/v1/issues", get(handlers::list_issues))
        .route("/api/v1/scan-runs", get(handlers::list_scan_runs))
-        // MCP token management (per-tenant API tokens for the MCP server)
-        .route(
-            "/api/v1/mcp-tokens",
-            get(handlers::mcp_tokens::list_mcp_tokens).post(handlers::mcp_tokens::create_mcp_token),
-        )
-        .route(
-            "/api/v1/mcp-tokens/{id}",
-            delete(handlers::mcp_tokens::revoke_mcp_token),
-        )
        // Graph API endpoints
        .route("/api/v1/graph/{repo_id}", get(handlers::graph::get_graph))
        .route(
@@ -1,217 +0,0 @@
-//! Firmware classification via tramiton.
-//!
-//! tramiton is the company's firmware build/repro engine; we do not re-implement
-//! its detection. We depend on `tramiton-core` directly (same-company IP) and run
-//! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
-//! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
-//! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
-//! tramiton sources nor a real firmware tree.
-
-use std::path::Path;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{DetectedFact, TargetType};
-use compliance_core::traits::ClassifierVerdict;
-
-/// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
-/// Kept small and tramiton-independent so the classifier and the test mock don't
-/// need to construct a full tramiton plan.
-#[derive(Debug, Clone, Default)]
-pub struct FirmwareDetection {
-    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
-    pub provider: String,
-    /// Detection confidence: `low` | `medium` | `high`.
-    pub confidence: String,
-    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
-    pub build_system: String,
-    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
-    pub framework: Option<String>,
-    /// Target board / MCU / arch.
-    pub target: FirmwareTarget,
-    /// Unresolved gaps in the plan.
-    pub gaps: Vec<String>,
-}
-
-/// The detected firmware target (board / MCU / arch).
-#[derive(Debug, Clone, Default)]
-pub struct FirmwareTarget {
-    /// Board name.
-    pub board: Option<String>,
-    /// MCU part.
-    pub mcu: Option<String>,
-    /// Architecture.
-    pub arch: Option<String>,
-}
-
-/// A source of tramiton firmware detection.
-#[allow(async_fn_in_trait)]
-pub trait FirmwareDetector: Send + Sync {
-    /// Run detection over a path, returning a firmware detection if tramiton
-    /// could form a build plan.
-    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
-}
-
-/// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
-/// so it runs on a blocking thread to avoid stalling the async runtime. A path
-/// with no recognizable build system yields `Ok(None)`.
-pub struct TramitonNative;
-
-impl FirmwareDetector for TramitonNative {
-    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
-        let path = path.to_path_buf();
-        let plan = tokio::task::spawn_blocking(move || {
-            let repo = tramiton_core::Repo::new(&path);
-            tramiton_core::provider::analyze(&repo)
-        })
-        .await
-        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
-        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
-        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
-    }
-}
-
-/// Map tramiton's `BuildPlan` onto our minimal detection summary.
-fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
-    FirmwareDetection {
-        provider: bp.provider.clone(),
-        confidence: bp.confidence.to_string(),
-        build_system: bp.build_system.label().to_string(),
-        framework: bp.framework.clone(),
-        target: FirmwareTarget {
-            board: bp.target.board.clone(),
-            mcu: bp.target.mcu.clone(),
-            arch: bp.target.arch.clone(),
-        },
-        gaps: bp.gaps.clone(),
-    }
-}
-
-/// Map a firmware detection to a target type. Framework/build-system signals
-/// distinguish RTOS from bare-metal from Yocto.
-pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
-    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
-    let build_system = det.build_system.to_lowercase();
-    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
-
-    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
-    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
-        TargetType::EmbeddedLinuxYocto
-    } else if RTOS.iter().any(|k| signal.contains(k)) {
-        TargetType::FirmwareRtos
-    } else {
-        TargetType::FirmwareBareMetal
-    }
-}
-
-/// Map tramiton's confidence label to a `[0,1]` score.
-fn confidence_score(label: &str) -> f32 {
-    match label.to_lowercase().as_str() {
-        "high" => 0.9,
-        "medium" => 0.6,
-        "low" => 0.3,
-        _ => 0.4,
-    }
-}
-
-/// Turn a firmware detection into a classifier verdict, carrying the MCU / board
-/// / build-system as facts.
-pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
-    let target_type = detection_to_target_type(det);
-    let mut facts = vec![DetectedFact::new(
-        "build_system",
-        det.build_system.clone(),
-        "tramiton",
-    )];
-    if let Some(fw) = &det.framework {
-        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
-    }
-    if let Some(mcu) = &det.target.mcu {
-        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
-    }
-    if let Some(board) = &det.target.board {
-        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
-    }
-    if let Some(arch) = &det.target.arch {
-        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
-    }
-    ClassifierVerdict {
-        target_type,
-        confidence: confidence_score(&det.confidence),
-        facts,
-        rationale: format!(
-            "tramiton detected build system '{}'{}",
-            det.build_system,
-            det.framework
-                .as_ref()
-                .map(|f| format!(" (framework {f})"))
-                .unwrap_or_default()
-        ),
-    }
-}
-
-/// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
-pub struct MockFirmwareDetector {
-    /// The detection to return (or `None` for "no detection").
-    pub detection: Option<FirmwareDetection>,
-}
-
-impl FirmwareDetector for MockFirmwareDetector {
-    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
-        Ok(self.detection.clone())
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
-        FirmwareDetection {
-            provider: build_system.to_string(),
-            confidence: "high".to_string(),
-            build_system: build_system.to_string(),
-            framework: framework.map(|s| s.to_string()),
-            target: FirmwareTarget {
-                mcu: Some("stm32f429".to_string()),
-                ..Default::default()
-            },
-            gaps: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn zephyr_maps_to_rtos() {
-        assert_eq!(
-            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
-            TargetType::FirmwareRtos
-        );
-    }
-
-    #[test]
-    fn bare_cmake_maps_to_bare_metal() {
-        assert_eq!(
-            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
-            TargetType::FirmwareBareMetal
-        );
-    }
-
-    #[test]
-    fn bitbake_maps_to_yocto() {
-        assert_eq!(
-            detection_to_target_type(&detection("bitbake", None)),
-            TargetType::EmbeddedLinuxYocto
-        );
-    }
-
-    #[test]
-    fn verdict_carries_mcu_fact_and_confidence() {
-        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
-        assert_eq!(v.target_type, TargetType::FirmwareRtos);
-        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
-        assert!(v
-            .facts
-            .iter()
-            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
-    }
-}
@@ -1,357 +0,0 @@
-//! Heuristic target-type classification from artifact kinds and source markers.
-//!
-//! Complements the tramiton firmware detector: this handles web / backend /
-//! mobile / desktop / PLC by sniffing manifest files and file extensions in the
-//! ingested code trees, plus strong priors from the artifact kinds themselves
-//! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
-
-use std::collections::HashSet;
-use std::fs;
-use std::path::Path;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
-use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-
-/// Max directory depth scanned for marker files.
-const SCAN_DEPTH: usize = 2;
-
-/// Markers collected from a code tree.
-#[derive(Default)]
-struct Markers {
-    files: HashSet<String>,
-    dirs: HashSet<String>,
-    exts: HashSet<String>,
-}
-
-impl Markers {
-    fn has_file(&self, name: &str) -> bool {
-        self.files.contains(name)
-    }
-    fn has_ext(&self, ext: &str) -> bool {
-        self.exts.contains(ext)
-    }
-    fn any_dir_ends_with(&self, suffix: &str) -> bool {
-        self.dirs.iter().any(|d| d.ends_with(suffix))
-    }
-}
-
-/// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
-fn collect_markers(root: &Path) -> Markers {
-    let mut m = Markers::default();
-    scan_dir(root, 0, &mut m);
-    m
-}
-
-fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
-    let Ok(entries) = fs::read_dir(dir) else {
-        return;
-    };
-    for entry in entries.flatten() {
-        let path = entry.path();
-        let name = entry.file_name().to_string_lossy().to_lowercase();
-        if path.is_dir() {
-            m.dirs.insert(name);
-            if depth < SCAN_DEPTH {
-                scan_dir(&path, depth + 1, m);
-            }
-        } else {
-            if let Some(ext) = path.extension() {
-                m.exts.insert(ext.to_string_lossy().to_lowercase());
-            }
-            m.files.insert(name);
-        }
-    }
-}
-
-/// Whether a `package.json` at `root` looks like a front-end app.
-fn package_json_is_frontend(root: &Path) -> bool {
-    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
-        return false;
-    };
-    let c = content.to_lowercase();
-    ["react", "next", "vue", "@angular", "svelte", "vite"]
-        .iter()
-        .any(|f| c.contains(f))
-}
-
-/// The heuristic classifier: artifact-kind priors + source-tree markers.
-pub struct HeuristicClassifier;
-
-impl HeuristicClassifier {
-    /// Verdicts from the artifact kinds alone (no filesystem needed).
-    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
-        let mut out = Vec::new();
-        for a in input.artifacts {
-            let lower = a.source_ref.to_lowercase();
-            match a.kind {
-                ArtifactKind::PlcProject => out.push(verdict(
-                    TargetType::PlcSps,
-                    0.85,
-                    "PLC project artifact",
-                    vec![],
-                )),
-                ArtifactKind::MobilePackage => {
-                    let (tt, why) = if lower.ends_with(".ipa") {
-                        (TargetType::IosApp, "iOS package (.ipa)")
-                    } else {
-                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
-                    };
-                    out.push(verdict(tt, 0.85, why, vec![]));
-                }
-                ArtifactKind::ContainerImage => out.push(verdict(
-                    TargetType::BackendService,
-                    0.4,
-                    "container image",
-                    vec![],
-                )),
-                ArtifactKind::FirmwareImage => out.push(verdict(
-                    TargetType::FirmwareBareMetal,
-                    0.35,
-                    "firmware image (pending tramiton detection)",
-                    vec![],
-                )),
-                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
-                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
-                }
-                _ => {}
-            }
-        }
-        out
-    }
-
-    /// Verdicts from scanning the ingested code trees for manifest markers.
-    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
-        let mut out = Vec::new();
-        for a in input.artifacts {
-            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
-                continue;
-            }
-            let Some(path) = input.working_paths.get(&a.id) else {
-                continue;
-            };
-            let m = collect_markers(path);
-
-            // Mobile (checked first — strongest signal).
-            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
-                out.push(verdict(
-                    TargetType::AndroidApp,
-                    0.8,
-                    "Android manifest / gradle",
-                    facts_lang("kotlin/java"),
-                ));
-            }
-            if m.any_dir_ends_with(".xcodeproj")
-                || m.has_file("info.plist")
-                || m.has_file("podfile")
-                || m.has_ext("ipa")
-            {
-                out.push(verdict(
-                    TargetType::IosApp,
-                    0.8,
-                    "Xcode project / Info.plist",
-                    facts_lang("swift/objc"),
-                ));
-            }
-            // Desktop.
-            if m.has_ext("sln")
-                || m.has_ext("csproj")
-                || m.has_ext("vcxproj")
-                || m.has_ext("desktop")
-            {
-                out.push(verdict(
-                    TargetType::DesktopApp,
-                    0.7,
-                    "desktop project files",
-                    facts_lang("dotnet/native"),
-                ));
-            }
-            // PLC.
-            if m.has_ext("st") {
-                out.push(verdict(
-                    TargetType::PlcSps,
-                    0.8,
-                    "Structured Text sources",
-                    facts_lang("iec-61131-3"),
-                ));
-            }
-            // Web vs backend from package.json.
-            if m.has_file("package.json") {
-                if package_json_is_frontend(path) {
-                    out.push(verdict(
-                        TargetType::WebApp,
-                        0.65,
-                        "package.json with a front-end framework",
-                        facts_lang("javascript"),
-                    ));
-                } else {
-                    out.push(verdict(
-                        TargetType::BackendService,
-                        0.55,
-                        "package.json (no front-end framework)",
-                        facts_lang("javascript"),
-                    ));
-                }
-            }
-            // Backend languages.
-            for (file, lang) in [
-                ("cargo.toml", "rust"),
-                ("go.mod", "go"),
-                ("pom.xml", "java"),
-                ("requirements.txt", "python"),
-                ("pyproject.toml", "python"),
-            ] {
-                if m.has_file(file) {
-                    out.push(verdict(
-                        TargetType::BackendService,
-                        0.6,
-                        "backend build manifest",
-                        facts_lang(lang),
-                    ));
-                }
-            }
-            // Container-only.
-            if m.has_file("dockerfile") && out.is_empty() {
-                out.push(verdict(
-                    TargetType::BackendService,
-                    0.4,
-                    "Dockerfile",
-                    facts_lang("container"),
-                ));
-            }
-        }
-        out
-    }
-}
-
-impl TargetClassifier for HeuristicClassifier {
-    fn name(&self) -> &str {
-        "heuristic"
-    }
-
-    async fn classify(
-        &self,
-        input: &ClassificationInput<'_>,
-    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
-        let mut out = self.kind_priors(input);
-        out.extend(self.source_verdicts(input));
-        Ok(out)
-    }
-}
-
-fn verdict(
-    target_type: TargetType,
-    confidence: f32,
-    rationale: &str,
-    facts: Vec<DetectedFact>,
-) -> ClassifierVerdict {
-    ClassifierVerdict {
-        target_type,
-        confidence,
-        facts,
-        rationale: rationale.to_string(),
-    }
-}
-
-fn facts_lang(lang: &str) -> Vec<DetectedFact> {
-    vec![DetectedFact::new("language", lang, "heuristic")]
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Artifact;
-    use std::collections::HashMap;
-    use std::path::PathBuf;
-
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
-        let scratch = Scratch::new();
-        setup(&scratch.0);
-        let artifact = Artifact::git_repo("https://git/x", "main");
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let artifacts = vec![artifact];
-        let input = ClassificationInput {
-            artifacts: &artifacts,
-            working_paths: &wp,
-            description: None,
-        };
-        HeuristicClassifier
-            .classify(&input)
-            .await
-            .expect("classify")
-    }
-
-    #[tokio::test]
-    async fn frontend_package_json_is_webapp() {
-        let v = classify_tree(|root| {
-            fs::write(
-                root.join("package.json"),
-                r#"{"dependencies":{"react":"18"}}"#,
-            )
-            .unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
-    }
-
-    #[tokio::test]
-    async fn cargo_toml_is_backend() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
-        })
-        .await;
-        assert!(v
-            .iter()
-            .any(|x| x.target_type == TargetType::BackendService));
-    }
-
-    #[tokio::test]
-    async fn android_manifest_is_android() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
-    }
-
-    #[tokio::test]
-    async fn structured_text_is_plc() {
-        let v = classify_tree(|root| {
-            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
-        })
-        .await;
-        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
-    }
-
-    #[tokio::test]
-    async fn ipa_artifact_prior_is_ios() {
-        let artifacts = vec![Artifact::mobile_package("app.ipa")];
-        let wp = HashMap::new();
-        let input = ClassificationInput {
-            artifacts: &artifacts,
-            working_paths: &wp,
-            description: None,
-        };
-        let v = HeuristicClassifier
-            .classify(&input)
-            .await
-            .expect("classify");
-        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
-    }
-}
@@ -1,226 +0,0 @@
-//! Target classification.
-//!
-//! Runs the classifier registry over a target's artifacts and their ingested
-//! working paths, then merges and ranks the verdicts into a [`Classification`].
-//! The registry is the heuristic classifier (artifact kinds + source markers)
-//! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
-
-mod firmware;
-mod language;
-
-pub use firmware::{
-    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
-};
-pub use language::HeuristicClassifier;
-
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-use compliance_core::error::CoreError;
-use compliance_core::models::{
-    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
-};
-use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-
-use firmware::detection_to_verdict;
-
-/// Classify a target from its artifacts and their ingested working paths, using
-/// the heuristic classifier plus the tramiton firmware detector. Verdicts are
-/// merged (max confidence per target type) and ranked into a [`Classification`].
-pub async fn classify_target<D: FirmwareDetector>(
-    target: &OnboardedTarget,
-    working_paths: &HashMap<String, PathBuf>,
-    firmware_detector: &D,
-) -> Result<Classification, CoreError> {
-    let input = ClassificationInput {
-        artifacts: &target.artifacts,
-        working_paths,
-        description: target.description.as_deref(),
-    };
-
-    let mut verdicts = Vec::new();
-    let mut detected_by = Vec::new();
-
-    let heuristic = HeuristicClassifier.classify(&input).await?;
-    if !heuristic.is_empty() {
-        detected_by.push("heuristic".to_string());
-    }
-    verdicts.extend(heuristic);
-
-    // Tramiton firmware detection over firmware / code working paths.
-    let mut tramiton_used = false;
-    for artifact in &target.artifacts {
-        if !matches!(
-            artifact.kind,
-            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
-        ) {
-            continue;
-        }
-        let Some(path) = working_paths.get(&artifact.id) else {
-            continue;
-        };
-        if let Some(detection) = firmware_detector.detect(path).await? {
-            verdicts.push(detection_to_verdict(&detection));
-            tramiton_used = true;
-        }
-    }
-    if tramiton_used {
-        detected_by.push("tramiton".to_string());
-    }
-
-    Ok(rank(verdicts, detected_by, target.target_type))
-}
-
-/// Merge verdicts by target type (keeping the max confidence and its rationale),
-/// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
-/// Falls back to the declared type when no verdict is produced.
-fn rank(
-    verdicts: Vec<ClassifierVerdict>,
-    detected_by: Vec<String>,
-    fallback: TargetType,
-) -> Classification {
-    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
-    let mut facts: Vec<DetectedFact> = Vec::new();
-    for verdict in verdicts {
-        for fact in verdict.facts {
-            if !facts
-                .iter()
-                .any(|e| e.key == fact.key && e.value == fact.value)
-            {
-                facts.push(fact);
-            }
-        }
-        let entry = best
-            .entry(verdict.target_type)
-            .or_insert((0.0, String::new()));
-        if verdict.confidence > entry.0 {
-            *entry = (verdict.confidence, verdict.rationale);
-        }
-    }
-
-    let mut candidates: Vec<TargetTypeCandidate> = best
-        .into_iter()
-        .map(
-            |(target_type, (confidence, rationale))| TargetTypeCandidate {
-                target_type,
-                confidence,
-                rationale,
-            },
-        )
-        .collect();
-    // Descending confidence; ties broken by type name for deterministic ordering.
-    candidates.sort_by(|a, b| {
-        b.confidence
-            .partial_cmp(&a.confidence)
-            .unwrap_or(std::cmp::Ordering::Equal)
-            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
-    });
-
-    let suggested = candidates
-        .first()
-        .map(|c| c.target_type)
-        .unwrap_or(fallback);
-
-    Classification {
-        suggested,
-        candidates,
-        facts,
-        detected_by,
-        detected_at: chrono::Utc::now(),
-        confirmed: false,
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::Artifact;
-    use std::fs;
-    use std::path::Path;
-
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    fn no_firmware() -> MockFirmwareDetector {
-        MockFirmwareDetector { detection: None }
-    }
-
-    #[tokio::test]
-    async fn backend_repo_classifies_as_backend() {
-        let scratch = Scratch::new();
-        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
-
-        let artifact = Artifact::git_repo("https://git/x", "main");
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
-        target.artifacts.push(artifact);
-
-        let c = classify_target(&target, &wp, &no_firmware())
-            .await
-            .expect("classify");
-        assert_eq!(c.suggested, TargetType::BackendService);
-        assert!(c.detected_by.contains(&"heuristic".to_string()));
-        assert!(!c.confirmed);
-    }
-
-    #[tokio::test]
-    async fn firmware_detector_verdict_ranks_top() {
-        let scratch = Scratch::new();
-        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
-
-        let artifact =
-            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
-        let mut wp = HashMap::new();
-        wp.insert(artifact.id.clone(), scratch.0.clone());
-        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
-        target.artifacts.push(artifact);
-
-        let detector = MockFirmwareDetector {
-            detection: Some(FirmwareDetection {
-                provider: "zephyr".to_string(),
-                confidence: "high".to_string(),
-                build_system: "zephyr".to_string(),
-                framework: Some("zephyr".to_string()),
-                target: FirmwareTarget {
-                    mcu: Some("nrf52840".to_string()),
-                    ..Default::default()
-                },
-                gaps: vec![],
-            }),
-        };
-
-        let c = classify_target(&target, &wp, &detector)
-            .await
-            .expect("classify");
-        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
-        assert_eq!(c.suggested, TargetType::FirmwareRtos);
-        assert!(c.detected_by.contains(&"tramiton".to_string()));
-        assert!(c.facts.iter().any(|f| f.key == "mcu"));
-    }
-
-    #[tokio::test]
-    async fn no_signal_falls_back_to_declared_type() {
-        let scratch = Scratch::new();
-        let _ = Path::new(&scratch.0);
-        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
-        let wp = HashMap::new();
-        let c = classify_target(&target, &wp, &no_firmware())
-            .await
-            .expect("classify");
-        assert_eq!(c.suggested, TargetType::DesktopApp);
-        assert!(c.candidates.is_empty());
-    }
-}
@@ -45,8 +45,6 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
            .unwrap_or_else(|| "0 0 * * * *".to_string()),
        git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
            .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
-        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
-            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
        ssh_key_path: env_var_opt("SSH_KEY_PATH")
            .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
        keycloak_url: env_var_opt("KEYCLOAK_URL"),
@@ -141,25 +141,6 @@ impl DatabasePool {
        &self.client
    }

-    /// Cross-tenant admin database used by features that intentionally
-    /// span tenants (today: MCP bearer tokens — each token row carries
-    /// a `tenant_id` and the MCP server reads them to route requests).
-    ///
-    /// The name `<db_prefix>__admin` (double underscore) is reserved —
-    /// the sanitizer never produces it for a normal tenant DB because
-    /// the natural format is `<db_prefix>_<sanitized_tenant_id>` (one
-    /// underscore) and tenant_ids would have to start with `_admin` to
-    /// collide. New tenant provisioning should reject such ids.
-    pub fn admin_db(&self) -> mongodb::Database {
-        self.client.database(&self.admin_db_name())
-    }
-
-    /// Name of the admin database — public so tests / operators can
-    /// drop it via the raw client.
-    pub fn admin_db_name(&self) -> String {
-        format!("{}__admin", self.db_prefix)
-    }
-
    /// List every Mongo database currently belonging to this pool,
    /// identified by the `<db_prefix>_` prefix. The result is the raw
    /// database names — opening one for offboarding/cleanup goes
@@ -179,23 +160,6 @@ impl DatabasePool {
            .collect())
    }

-    /// Tenant ids for every provisioned tenant database, derived by stripping
-    /// the `<prefix>_` from the database names. Skips the admin database
-    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
-    /// at the cluster level and cannot be recovered here — in practice tenant
-    /// ids are UUIDs and never hit that path. Used by the migration CLI's
-    /// `--all` mode.
-    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
-        let prefix = format!("{}_", self.db_prefix);
-        Ok(self
-            .list_tenant_db_names()
-            .await?
-            .into_iter()
-            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
-            .filter(|id| !id.starts_with('_'))
-            .collect())
-    }
-
    /// Drop the database for a specific tenant. Used by GDPR delete
    /// and tenant offboarding. Idempotent — dropping a non-existent
    /// database is a no-op at the driver level.
@@ -249,6 +213,16 @@ impl Database {
    }

    pub async fn ensure_indexes(&self) -> Result<(), AgentError> {
+        // repositories: unique git_url
+        self.repositories()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "git_url": 1 })
+                    .options(IndexOptions::builder().unique(true).build())
+                    .build(),
+            )
+            .await?;
+
        // findings: unique fingerprint
        self.findings()
            .create_index(
@@ -435,40 +409,14 @@ impl Database {
            )
            .await?;

-        // onboarded_targets: multikey on artifact source ref (webhook + dedupe
-        // lookup). Non-unique — "one git URL per tenant" is enforced in the
-        // create handler, since a unique multikey index on an array field has
-        // null-collision caveats.
-        self.onboarded_targets()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "artifacts.source_ref": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // onboarded_targets: multikey on artifact kind
-        self.onboarded_targets()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "artifacts.kind": 1 })
-                    .build(),
-            )
-            .await?;
-
-        // onboarded_targets: target_type filter
-        self.onboarded_targets()
-            .create_index(
-                IndexModel::builder()
-                    .keys(doc! { "target_type": 1 })
-                    .build(),
-            )
-            .await?;
-
        tracing::info!("Database indexes ensured");
        Ok(())
    }

+    pub fn repositories(&self) -> Collection<TrackedRepository> {
+        self.inner.collection("repositories")
+    }
+
    pub fn findings(&self) -> Collection<Finding> {
        self.inner.collection("findings")
    }
@@ -517,20 +465,6 @@ impl Database {
        self.inner.collection("dast_targets")
    }

-    /// The unified onboarding targets that replace `repositories` and
-    /// `dast_targets`. Ids are preserved from the legacy collections during
-    /// migration so downstream `repo_id` / `target_id` references keep resolving.
-    pub fn onboarded_targets(&self) -> Collection<OnboardedTarget> {
-        self.inner.collection("onboarded_targets")
-    }
-
-    /// A typed handle to an arbitrary collection by name. For bookkeeping
-    /// collections without a dedicated model (e.g. `schema_migrations`,
-    /// `onboarding_migration_log`).
-    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
-        self.inner.collection(name)
-    }
-
    pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
        self.inner.collection("dast_scan_runs")
    }
@@ -1,154 +0,0 @@
-//! Content-addressed blob storage and archive extraction for ingest.
-//!
-//! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
-//! digest; per-run working directories live under `<base>/work/`.
-
-use std::fs::{self, File};
-use std::io::{self, Read};
-use std::path::{Path, PathBuf};
-
-use sha2::{Digest, Sha256};
-
-use crate::error::AgentError;
-
-/// Read buffer size for streaming hashes/copies (64 KiB).
-const BUF_LEN: usize = 64 * 1024;
-
-/// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
-/// byte length. Streams so large firmware images never load fully into memory.
-pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
-    let mut file = File::open(path)?;
-    let mut hasher = Sha256::new();
-    let mut buf = [0u8; BUF_LEN];
-    let mut total: u64 = 0;
-    loop {
-        let n = file.read(&mut buf)?;
-        if n == 0 {
-            break;
-        }
-        hasher.update(&buf[..n]);
-        total += n as u64;
-    }
-    Ok((hex::encode(hasher.finalize()), total))
-}
-
-/// Copy `src` into the content-addressed blob store under `base`, returning the
-/// stored path. Idempotent: an already-present blob is not rewritten.
-pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
-    if sha.len() < 2 {
-        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
-    }
-    let dir = base.join("blobs").join(&sha[0..2]);
-    fs::create_dir_all(&dir)?;
-    let dest = dir.join(sha);
-    if !dest.exists() {
-        fs::copy(src, &dest)?;
-    }
-    Ok(dest)
-}
-
-/// Extract a zip archive into `dest` (created if needed). `enclosed_name`
-/// sanitizes each entry path, so this is safe against zip-slip traversal.
-pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
-    let file = File::open(archive)?;
-    let mut zip =
-        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
-    fs::create_dir_all(dest)?;
-    for i in 0..zip.len() {
-        let mut entry = zip
-            .by_index(i)
-            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
-        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
-        let Some(rel) = entry.enclosed_name() else {
-            continue;
-        };
-        let out = dest.join(rel);
-        if entry.is_dir() {
-            fs::create_dir_all(&out)?;
-        } else {
-            if let Some(parent) = out.parent() {
-                fs::create_dir_all(parent)?;
-            }
-            let mut outfile = File::create(&out)?;
-            io::copy(&mut entry, &mut outfile)?;
-        }
-    }
-    Ok(())
-}
-
-/// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
-pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
-    base.join("work").join(target_id).join(artifact_id)
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    /// A unique scratch directory, removed on drop.
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
-            fs::create_dir_all(&p).expect("mkdir scratch");
-            Self(p)
-        }
-        fn path(&self) -> &Path {
-            &self.0
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = fs::remove_dir_all(&self.0);
-        }
-    }
-
-    #[test]
-    fn hash_is_stable_and_reports_size() {
-        let dir = Scratch::new();
-        let f = dir.path().join("a.bin");
-        fs::write(&f, b"hello world").expect("write");
-        let (sha, size) = hash_file(&f).expect("hash");
-        assert_eq!(size, 11);
-        // Known SHA-256 of "hello world".
-        assert_eq!(
-            sha,
-            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
-        );
-    }
-
-    #[test]
-    fn store_is_content_addressed_and_idempotent() {
-        let base = Scratch::new();
-        let src = base.path().join("src.bin");
-        fs::write(&src, b"payload").expect("write");
-        let (sha, _) = hash_file(&src).expect("hash");
-        let p1 = store_file(base.path(), &src, &sha).expect("store");
-        let p2 = store_file(base.path(), &src, &sha).expect("store again");
-        assert_eq!(p1, p2);
-        assert!(p1.ends_with(&sha));
-        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
-        assert_eq!(fs::read(&p1).expect("read"), b"payload");
-    }
-
-    #[test]
-    fn extract_zip_writes_entries() {
-        let base = Scratch::new();
-        let archive = base.path().join("a.zip");
-        {
-            let file = File::create(&archive).expect("create");
-            let mut w = zip::ZipWriter::new(file);
-            let opts: zip::write::SimpleFileOptions = Default::default();
-            w.start_file("dir/hello.txt", opts).expect("start");
-            io::Write::write_all(&mut w, b"hi").expect("write");
-            w.finish().expect("finish");
-        }
-        let dest = base.path().join("out");
-        extract_zip(&archive, &dest).expect("extract");
-        assert_eq!(
-            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
-            "hi"
-        );
-    }
-}
@@ -1,334 +0,0 @@
-//! Artifact ingest.
-//!
-//! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
-//! path plus recorded metadata (content hash, size, discovered facts) that the
-//! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
-//! is also the reconciliation key against sibling products (a firmware sha256
-//! matches tramiton's `Artifact.sha256`).
-
-mod blob;
-
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-
-use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
-use compliance_core::AgentConfig;
-
-use crate::error::AgentError;
-use crate::pipeline::git::{GitOps, RepoCredentials};
-
-/// The paths and identifiers an ingest needs. Decoupled from the full
-/// [`AgentConfig`] so ingest is testable without a complete config.
-pub struct IngestContext<'a> {
-    /// Base directory for content-addressed blobs and working dirs.
-    pub artifact_store_base: &'a Path,
-    /// Base directory for git clones.
-    pub git_clone_base: &'a str,
-    /// Default SSH key path (used when an artifact provides none).
-    pub ssh_key_path: &'a str,
-    /// The id of the target these artifacts belong to (namespaces working dirs).
-    pub target_id: &'a str,
-}
-
-impl<'a> IngestContext<'a> {
-    /// Build an ingest context from the agent config for a given target.
-    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
-        Self {
-            artifact_store_base: Path::new(&config.artifact_store_base_path),
-            git_clone_base: &config.git_clone_base_path,
-            ssh_key_path: &config.ssh_key_path,
-            target_id,
-        }
-    }
-}
-
-/// The result of ingesting one artifact.
-pub struct IngestedArtifact {
-    /// The artifact this corresponds to ([`Artifact::id`]).
-    pub artifact_id: String,
-    /// The artifact kind.
-    pub kind: ArtifactKind,
-    /// Local working path (clone dir, extracted dir, or blob file). `None` for
-    /// artifacts with no on-disk form (live URL, plaintext, container ref).
-    pub working_path: Option<PathBuf>,
-    /// SHA-256 of the content (blobs) or git head SHA (git repos).
-    pub content_hash: Option<String>,
-    /// Stored blob size in bytes, when applicable.
-    pub size_bytes: Option<u64>,
-    /// Facts discovered during ingest.
-    pub facts: Vec<DetectedFact>,
-}
-
-/// All ingested artifacts for a target, keyed by artifact id.
-pub struct IngestSet {
-    /// The ingested artifacts, keyed by [`Artifact::id`].
-    pub by_artifact: HashMap<String, IngestedArtifact>,
-}
-
-impl IngestSet {
-    /// The working paths of every ingested artifact that has one — the input the
-    /// classifier expects.
-    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
-        self.by_artifact
-            .iter()
-            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
-            .collect()
-    }
-
-    /// The ingest result for a specific artifact.
-    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
-        self.by_artifact.get(artifact_id)
-    }
-}
-
-/// Ingest every artifact on a target.
-pub fn ingest_all(
-    target: &OnboardedTarget,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestSet, AgentError> {
-    let mut by_artifact = HashMap::new();
-    for artifact in &target.artifacts {
-        let ingested = ingest_artifact(artifact, ctx)?;
-        by_artifact.insert(artifact.id.clone(), ingested);
-    }
-    Ok(IngestSet { by_artifact })
-}
-
-/// Ingest a single artifact, dispatching on its kind.
-pub fn ingest_artifact(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestedArtifact, AgentError> {
-    match artifact.kind {
-        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
-        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
-            ingest_blob(artifact, ctx, true)
-        }
-        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
-        ArtifactKind::ContainerImage => Ok(metadata_only(
-            artifact,
-            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
-        )),
-        ArtifactKind::LiveUrl => Ok(metadata_only(
-            artifact,
-            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
-        )),
-        ArtifactKind::PlaintextDescription => Ok(metadata_only(
-            artifact,
-            DetectedFact::new(
-                "description_len",
-                artifact.source_ref.len().to_string(),
-                "ingest",
-            ),
-        )),
-    }
-}
-
-/// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
-fn ingest_git(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-) -> Result<IngestedArtifact, AgentError> {
-    let creds = credentials_for(artifact, ctx.ssh_key_path);
-    let git_ops = GitOps::new(ctx.git_clone_base, creds);
-    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
-    let head = GitOps::get_head_sha(&repo_path).ok();
-    Ok(IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: Some(repo_path),
-        content_hash: head,
-        size_bytes: None,
-        facts: Vec::new(),
-    })
-}
-
-/// Store a blob artifact content-addressed. When `extract` is set and the blob
-/// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
-/// working directory; otherwise the working path is the stored blob.
-fn ingest_blob(
-    artifact: &Artifact,
-    ctx: &IngestContext<'_>,
-    extract: bool,
-) -> Result<IngestedArtifact, AgentError> {
-    let base = ctx.artifact_store_base;
-    let src = local_source(artifact)?;
-    let (sha, size) = blob::hash_file(&src)?;
-    let stored = blob::store_file(base, &src, &sha)?;
-
-    let mut facts = Vec::new();
-    let working_path = if extract {
-        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
-        match blob::extract_zip(&stored, &dest) {
-            Ok(()) => dest,
-            Err(e) => {
-                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
-                // note it so later stages can decide what to do.
-                facts.push(DetectedFact::new(
-                    "archive_unextracted",
-                    e.to_string(),
-                    "ingest",
-                ));
-                stored.clone()
-            }
-        }
-    } else {
-        stored.clone()
-    };
-
-    Ok(IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: Some(working_path),
-        content_hash: Some(sha),
-        size_bytes: Some(size),
-        facts,
-    })
-}
-
-/// An artifact with no on-disk form: record a single fact, no hash/path.
-fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
-    IngestedArtifact {
-        artifact_id: artifact.id.clone(),
-        kind: artifact.kind,
-        working_path: None,
-        content_hash: None,
-        size_bytes: None,
-        facts: vec![fact],
-    }
-}
-
-/// The local file backing a blob artifact: its `stored_path` if already
-/// uploaded, else its `source_ref` interpreted as a filesystem path.
-fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
-    let path = artifact
-        .stored_path
-        .as_deref()
-        .unwrap_or(artifact.source_ref.as_str());
-    let path = PathBuf::from(path);
-    if !path.exists() {
-        return Err(AgentError::Other(format!(
-            "artifact {} source not found at {}",
-            artifact.id,
-            path.display()
-        )));
-    }
-    Ok(path)
-}
-
-/// Build git credentials from an artifact's auth plus a default SSH key path.
-fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
-    let auth = artifact.auth.as_ref();
-    RepoCredentials {
-        ssh_key_path: auth
-            .and_then(|a| a.ssh_key_path.clone())
-            .or_else(|| Some(default_ssh_key_path.to_string())),
-        auth_token: auth.and_then(|a| a.secret.clone()),
-        auth_username: auth.and_then(|a| a.username.clone()),
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{ArtifactAuth, TargetType};
-
-    /// A unique scratch directory, removed on drop.
-    struct Scratch(PathBuf);
-    impl Scratch {
-        fn new() -> Self {
-            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
-            std::fs::create_dir_all(&p).expect("mkdir scratch");
-            Self(p)
-        }
-    }
-    impl Drop for Scratch {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
-        IngestContext {
-            artifact_store_base: store,
-            git_clone_base: "/tmp/cs-ingest-test-repos",
-            ssh_key_path: "/tmp/cs-ingest-test-ssh",
-            target_id,
-        }
-    }
-
-    #[test]
-    fn firmware_blob_is_hashed_and_stored() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let fw = scratch.0.join("fw.bin");
-        std::fs::write(&fw, b"firmware-bytes").expect("write");
-
-        let ctx = ctx_for(&store, "t1");
-        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-
-        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
-        assert_eq!(out.size_bytes, Some(14));
-        let sha = out.content_hash.expect("hash");
-        assert_eq!(sha.len(), 64);
-        // working path is the content-addressed blob
-        let wp = out.working_path.expect("working path");
-        assert!(wp.starts_with(store.join("blobs")));
-    }
-
-    #[test]
-    fn live_url_has_no_blob() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let ctx = ctx_for(&store, "t1");
-        let artifact = Artifact::live_url("https://example.com");
-        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
-        assert!(out.working_path.is_none());
-        assert!(out.content_hash.is_none());
-        assert!(out.facts.iter().any(|f| f.key == "live_url"));
-    }
-
-    #[test]
-    fn ingest_all_collects_working_paths() {
-        let scratch = Scratch::new();
-        let store = scratch.0.join("store");
-        let fw = scratch.0.join("fw.bin");
-        std::fs::write(&fw, b"abc").expect("write");
-        let ctx = ctx_for(&store, "t1");
-
-        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
-        target
-            .artifacts
-            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
-        target.artifacts.push(Artifact::live_url("https://x"));
-
-        let set = ingest_all(&target, &ctx).expect("ingest all");
-        assert_eq!(set.by_artifact.len(), 2);
-        // Only the firmware artifact yields a working path.
-        assert_eq!(set.working_paths().len(), 1);
-    }
-
-    #[test]
-    fn credentials_prefer_artifact_auth() {
-        let mut artifact = Artifact::git_repo("https://git/x", "main");
-        artifact.auth = Some(ArtifactAuth {
-            method: "token".to_string(),
-            username: Some("bob".to_string()),
-            secret: Some("pat".to_string()),
-            ..Default::default()
-        });
-        let creds = credentials_for(&artifact, "/default/ssh/key");
-        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
-        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
-    }
-
-    #[test]
-    fn credentials_fall_back_to_default_ssh_key() {
-        let artifact = Artifact::git_repo("git@host:x.git", "main");
-        let creds = credentials_for(&artifact, "/default/ssh/key");
-        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
-        assert!(creds.auth_token.is_none());
-    }
-}
@@ -2,11 +2,9 @@

 pub mod agent;
 pub mod api;
-pub mod classify;
 pub mod config;
 pub mod database;
 pub mod error;
-pub mod ingest;
 pub mod llm;
 pub mod pentest;
 pub mod pipeline;
@@ -328,7 +328,6 @@ mod tests {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: String::new(),
-            artifact_store_base_path: String::new(),
            ssh_key_path: String::new(),
            keycloak_url: None,
            keycloak_realm: None,
@@ -1,152 +0,0 @@
-//! Firmware SBOM via tramiton.
-//!
-//! Phase 2 (full, the default): drive a **reproducible build** with tramiton's
-//! `NixBackend` — `analyze` → `seal_and_build` → a sealed lock whose libraries
-//! are pinned and whose firmware artifact carries a content hash — then render
-//! the SBOM from the lock plus deep binary SCA of pre-compiled inputs. This is
-//! the complete bill of materials (toolchain + every fetched library + the
-//! firmware image), the same one `tramiton sbom` produces.
-//!
-//! Phase 1 fallback (analysis-only): when no nix backend is available or the
-//! build fails, fall back to the resolvable libraries + toolchain from the build
-//! plan alone (no build). A scan therefore always yields *something*, and a nix
-//! that can't run in the deployment never breaks a scan.
-
-use std::path::Path;
-
-use compliance_core::models::{SbomEntry, TargetType};
-use tramiton_repro::ReproBackend;
-use tramiton_sbom::ComponentKind;
-
-/// Whether firmware SBOM applies to this target family.
-pub fn is_firmware_target(target_type: TargetType) -> bool {
-    matches!(
-        target_type,
-        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos | TargetType::EmbeddedLinuxYocto
-    )
-}
-
-/// Build SBOM entries for a firmware target from its source tree. Prefers a full
-/// reproducible build (sealed lock); falls back to analysis-only. Returns an
-/// empty vector when tramiton cannot even form a build plan.
-pub async fn firmware_sbom_entries(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let p = path.to_path_buf();
-    let repo = repo_id.to_string();
-    // The whole analyze → seal → build → render sequence is blocking (it shells
-    // out to nix), so keep it off the async runtime. Bound it: a firmware build
-    // that hangs must not wedge the scan (the orphaned task is abandoned).
-    let handle = tokio::task::spawn_blocking(move || build_sbom_blocking(&p, &repo));
-    match tokio::time::timeout(std::time::Duration::from_secs(900), handle).await {
-        Ok(Ok(entries)) => entries,
-        Ok(Err(e)) => {
-            tracing::warn!(repo_id, error = %e, "Firmware SBOM: task join error");
-            Vec::new()
-        }
-        Err(_) => {
-            tracing::warn!(repo_id, "Firmware SBOM: build exceeded 15m; skipping");
-            Vec::new()
-        }
-    }
-}
-
-fn build_sbom_blocking(path: &Path, repo_id: &str) -> Vec<SbomEntry> {
-    let repo = tramiton_core::Repo::new(path);
-    let plan = match tramiton_core::provider::analyze(&repo) {
-        Ok(Some(bp)) => bp,
-        Ok(None) => return Vec::new(),
-        Err(e) => {
-            tracing::warn!(repo_id, error = %e, "Firmware SBOM: tramiton analyze failed");
-            return Vec::new();
-        }
-    };
-
-    // Phase 2: reproducible build → sealed lock → complete SBOM.
-    if let Some(backend) = tramiton_repro::NixBackend::detect() {
-        match tramiton_repro::seal_and_build(&backend, &plan, path) {
-            Ok(lock) => {
-                let mut sbom = tramiton_sbom::Sbom::from_lock(&lock, repo_id);
-                // Deep binary SCA of any pre-compiled inputs in the tree.
-                sbom.components.extend(tramiton_sbom::binary::scan(path));
-                let entries = sbom_to_entries(&sbom, repo_id);
-                tracing::info!(
-                    repo_id,
-                    backend = backend.name(),
-                    count = entries.len(),
-                    "Firmware SBOM: sealed reproducible build"
-                );
-                return entries;
-            }
-            Err(e) => {
-                tracing::warn!(repo_id, error = %e, "Firmware SBOM: reproducible build failed; falling back to analysis-only")
-            }
-        }
-    } else {
-        tracing::info!(
-            repo_id,
-            "Firmware SBOM: no nix backend available; analysis-only SBOM"
-        );
-    }
-
-    // Phase 1 fallback: analysis-only (toolchain + resolvable libraries).
-    analysis_entries(&plan, repo_id)
-}
-
-/// Map a rendered [`tramiton_sbom::Sbom`] (primary firmware + components) into
-/// our [`SbomEntry`] rows. Source-file (`File`) components are dropped — they are
-/// build inputs, not a dependency inventory.
-fn sbom_to_entries(sbom: &tramiton_sbom::Sbom, repo_id: &str) -> Vec<SbomEntry> {
-    let mut entries = Vec::new();
-    if let Some(primary) = &sbom.primary {
-        entries.push(component_to_entry(primary, repo_id));
-    }
-    for c in &sbom.components {
-        if matches!(c.kind, ComponentKind::File) {
-            continue;
-        }
-        entries.push(component_to_entry(c, repo_id));
-    }
-    entries
-}
-
-fn component_to_entry(c: &tramiton_sbom::Component, repo_id: &str) -> SbomEntry {
-    let manager = match c.kind {
-        ComponentKind::Firmware => "firmware",
-        ComponentKind::Library => "library",
-        ComponentKind::Toolchain => "toolchain",
-        ComponentKind::File => "file",
-    };
-    let mut entry = SbomEntry::new(
-        repo_id.to_string(),
-        c.name.clone(),
-        c.version.clone().unwrap_or_default(),
-        manager.to_string(),
-    );
-    entry.purl = c.source.clone();
-    entry
-}
-
-/// Analysis-only components from the build plan: the cross-toolchain plus the
-/// resolvable fetched libraries, without a build.
-fn analysis_entries(bp: &tramiton_core::BuildPlan, repo_id: &str) -> Vec<SbomEntry> {
-    let mut entries = Vec::new();
-    if let Some(id) = bp.toolchain.id.clone() {
-        let version = bp.toolchain.version.clone().unwrap_or_default();
-        entries.push(SbomEntry::new(
-            repo_id.to_string(),
-            id,
-            version,
-            "toolchain".to_string(),
-        ));
-    }
-    for lib in tramiton_repro::lock::libraries_from_inputs(&bp.inputs) {
-        let mut entry = SbomEntry::new(
-            repo_id.to_string(),
-            lib.name,
-            lib.revision,
-            "library".to_string(),
-        );
-        entry.purl = lib.source;
-        entries.push(entry);
-    }
-    entries
-}
@@ -80,10 +80,7 @@ impl GitOps {

    #[tracing::instrument(skip_all, fields(repo_name = %repo_name))]
    pub fn clone_or_fetch(&self, git_url: &str, repo_name: &str) -> Result<PathBuf, AgentError> {
-        // Names can contain slashes or other path-hostile characters (a target
-        // named after a repo path, say); collapse to one safe directory segment
-        // so the clone path never nests or breaks.
-        let repo_path = self.base_path.join(sanitize_repo_dir(repo_name));
+        let repo_path = self.base_path.join(repo_name);

        if repo_path.exists() {
            tracing::info!("fetching updates for existing repo");
@@ -138,7 +135,7 @@ impl GitOps {
    /// Build credentials from agent config + per-repo overrides
    pub fn make_repo_credentials(
        config: &compliance_core::AgentConfig,
-        repo: &crate::pipeline::repo_view::RepoView,
+        repo: &compliance_core::models::TrackedRepository,
    ) -> RepoCredentials {
        RepoCredentials {
            ssh_key_path: Some(config.ssh_key_path.clone()),
@@ -256,46 +253,3 @@ pub struct DiffFile {
    pub path: String,
    pub hunks: String,
 }
-
-/// Collapse a repository name into a single filesystem-safe directory segment.
-/// Names may carry slashes or other path-hostile characters (a target named
-/// after a repo path, for instance); those would otherwise nest or break the
-/// clone path, so map anything outside `[A-Za-z0-9._-]` to `_`.
-fn sanitize_repo_dir(name: &str) -> String {
-    let mapped: String = name
-        .chars()
-        .map(|c| {
-            if c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.' {
-                c
-            } else {
-                '_'
-            }
-        })
-        .collect();
-    let trimmed = mapped.trim_matches(|c| c == '.' || c == '_');
-    if trimmed.is_empty() {
-        "repo".to_string()
-    } else {
-        trimmed.to_string()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::sanitize_repo_dir;
-
-    #[test]
-    fn sanitizes_path_hostile_names() {
-        assert_eq!(
-            sanitize_repo_dir("zephyr-example-app"),
-            "zephyr-example-app"
-        );
-        assert_eq!(
-            sanitize_repo_dir("ChristianRinn/bare_metal_stm32f411xe"),
-            "ChristianRinn_bare_metal_stm32f411xe"
-        );
-        assert_eq!(sanitize_repo_dir("../../etc/passwd"), "etc_passwd");
-        assert_eq!(sanitize_repo_dir("a b:c"), "a_b_c");
-        assert_eq!(sanitize_repo_dir("///"), "repo");
-    }
-}
@@ -1,6 +1,5 @@
 use mongodb::bson::doc;

-use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;

 use super::orchestrator::{extract_base_url, PipelineOrchestrator};
@@ -11,7 +10,7 @@ use crate::trackers;
 impl PipelineOrchestrator {
    /// Build an issue tracker client from a repository's tracker configuration.
    /// Returns `None` if the repo has no tracker configured.
-    pub(super) fn build_tracker(&self, repo: &RepoView) -> Option<TrackerDispatch> {
+    pub(super) fn build_tracker(&self, repo: &TrackedRepository) -> Option<TrackerDispatch> {
        let tracker_type = repo.tracker_type.as_ref()?;
        // Per-repo token takes precedence, fall back to global config
        match tracker_type {
@@ -82,7 +81,7 @@ impl PipelineOrchestrator {
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
    pub(super) async fn create_tracker_issues(
        &self,
-        repo: &RepoView,
+        repo: &TrackedRepository,
        repo_id: &str,
        new_findings: &[Finding],
    ) -> Result<(), AgentError> {
@@ -1,7 +1,6 @@
 pub mod code_review;
 pub mod cve;
 pub mod dedup;
-pub mod firmware_sbom;
 pub mod git;
 pub mod gitleaks;
 mod graph_build;
@@ -9,9 +8,7 @@ mod issue_creation;
 pub mod lint;
 pub mod orchestrator;
 pub mod patterns;
-pub mod plan;
 mod pr_review;
-pub mod repo_view;
 pub mod sbom;
 pub mod semgrep;
 mod tracker_dispatch;
@@ -15,8 +15,6 @@ use crate::pipeline::git::GitOps;
 use crate::pipeline::gitleaks::GitleaksScanner;
 use crate::pipeline::lint::LintScanner;
 use crate::pipeline::patterns::{GdprPatternScanner, OAuthPatternScanner};
-use crate::pipeline::plan::build_scan_plan;
-use crate::pipeline::repo_view::RepoView;
 use crate::pipeline::sbom::SbomScanner;
 use crate::pipeline::semgrep::SemgrepScanner;

@@ -52,8 +50,72 @@ impl PipelineOrchestrator {
        }
    }

+    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, trigger = ?trigger))]
+    pub async fn run(&self, repo_id: &str, trigger: ScanTrigger) -> Result<(), AgentError> {
+        // Look up the repository
+        let repo = self
+            .db
+            .repositories()
+            .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id).map_err(|e| AgentError::Other(e.to_string()))? })
+            .await?
+            .ok_or_else(|| AgentError::Other(format!("Repository {repo_id} not found")))?;
+
+        // Create scan run
+        let scan_run = ScanRun::new(repo_id.to_string(), trigger);
+        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
+        let scan_run_id = insert
+            .inserted_id
+            .as_object_id()
+            .map(|id| id.to_hex())
+            .unwrap_or_default();
+
+        let result = self.run_pipeline(&repo, &scan_run_id).await;
+
+        // Update scan run status
+        match &result {
+            Ok(count) => {
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! {
+                            "$set": {
+                                "status": "completed",
+                                "current_phase": "completed",
+                                "new_findings_count": *count as i64,
+                                "completed_at": mongodb::bson::DateTime::now(),
+                            }
+                        },
+                    )
+                    .await?;
+            }
+            Err(e) => {
+                tracing::error!(repo_id, error = %e, "Scan pipeline failed");
+                self.db
+                    .scan_runs()
+                    .update_one(
+                        doc! { "_id": &insert.inserted_id },
+                        doc! {
+                            "$set": {
+                                "status": "failed",
+                                "error_message": e.to_string(),
+                                "completed_at": mongodb::bson::DateTime::now(),
+                            }
+                        },
+                    )
+                    .await?;
+            }
+        }
+
+        result.map(|_| ())
+    }
+
    #[tracing::instrument(skip_all, fields(repo_id = repo.name.as_str()))]
-    async fn run_pipeline(&self, repo: &RepoView, scan_run_id: &str) -> Result<u32, AgentError> {
+    async fn run_pipeline(
+        &self,
+        repo: &TrackedRepository,
+        scan_run_id: &str,
+    ) -> Result<u32, AgentError> {
        let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();

        // Stage 0: Change detection
@@ -67,6 +129,7 @@ impl PipelineOrchestrator {
            return Ok(0);
        }

+        let current_sha = GitOps::get_head_sha(&repo_path)?;
        let mut all_findings: Vec<Finding> = Vec::new();

        // Stage 1: Semgrep SAST
@@ -332,9 +395,20 @@ impl PipelineOrchestrator {
            tracing::warn!("[{repo_id}] Issue creation failed: {e}");
        }

-        // The onboarded target's findings_count and the git artifact's
-        // last_scanned_commit watermark are persisted by `finalize_target` after
-        // `run_pipeline` returns.
+        // Stage 7: Update repository
+        self.db
+            .repositories()
+            .update_one(
+                doc! { "_id": repo.id },
+                doc! {
+                    "$set": {
+                        "last_scanned_commit": &current_sha,
+                        "updated_at": mongodb::bson::DateTime::now(),
+                    },
+                    "$inc": { "findings_count": new_count as i64 },
+                },
+            )
+            .await?;

        // Stage 8: DAST (async, optional — only if a DastTarget is configured)
        tracing::info!("[{repo_id}] Stage 8: Checking for DAST targets");
@@ -345,320 +419,6 @@ impl PipelineOrchestrator {
        Ok(new_count)
    }

-    /// Unified entry point (behind `UNIFIED_PIPELINE`): run a scan for an
-    /// `OnboardedTarget`. Mirrors [`Self::run`] but sources the target from
-    /// `onboarded_targets` and dispatches by the scan plan.
-    #[tracing::instrument(skip_all, fields(target_id = %target_id, trigger = ?trigger))]
-    pub async fn run_target(
-        &self,
-        target_id: &str,
-        trigger: ScanTrigger,
-    ) -> Result<(), AgentError> {
-        let oid = mongodb::bson::oid::ObjectId::parse_str(target_id)
-            .map_err(|e| AgentError::Other(e.to_string()))?;
-        let target = self
-            .db
-            .onboarded_targets()
-            .find_one(doc! { "_id": oid })
-            .await?
-            .ok_or_else(|| AgentError::Other(format!("Onboarded target {target_id} not found")))?;
-
-        let scan_run = ScanRun::new(target_id.to_string(), trigger);
-        let insert = self.db.scan_runs().insert_one(&scan_run).await?;
-        let scan_run_id = insert
-            .inserted_id
-            .as_object_id()
-            .map(|id| id.to_hex())
-            .unwrap_or_default();
-
-        let result = self.run_target_pipeline(&target, &scan_run_id).await;
-        match &result {
-            Ok(count) => {
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! { "$set": {
-                            "status": "completed",
-                            "current_phase": "completed",
-                            "new_findings_count": *count as i64,
-                            "completed_at": mongodb::bson::DateTime::now(),
-                        } },
-                    )
-                    .await?;
-                // Refresh the target's cached findings count. The shared pipeline
-                // (Stage 7) increments `repositories`, which the unified path does
-                // not use, so set the accurate total on the target itself.
-                let total = self
-                    .db
-                    .findings()
-                    .count_documents(doc! { "repo_id": target_id })
-                    .await
-                    .unwrap_or(*count as u64);
-                self.db
-                    .onboarded_targets()
-                    .update_one(
-                        doc! { "_id": oid },
-                        doc! { "$set": {
-                            "findings_count": total as i64,
-                            "updated_at": mongodb::bson::DateTime::now(),
-                        } },
-                    )
-                    .await?;
-            }
-            Err(e) => {
-                tracing::error!(target_id, error = %e, "Unified scan pipeline failed");
-                self.db
-                    .scan_runs()
-                    .update_one(
-                        doc! { "_id": &insert.inserted_id },
-                        doc! { "$set": {
-                            "status": "failed",
-                            "error_message": e.to_string(),
-                            "completed_at": mongodb::bson::DateTime::now(),
-                        } },
-                    )
-                    .await?;
-            }
-        }
-        result.map(|_| ())
-    }
-
-    /// Run the applicable scans for a target. For a code target this reuses the
-    /// full legacy pipeline over the code artifact (clone → SAST umbrella →
-    /// triage → persist → issues → DAST); firmware/PLC/mobile scanners are
-    /// follow-ups (#128/#129/#130). Returns the number of new findings.
-    async fn run_target_pipeline(
-        &self,
-        target: &OnboardedTarget,
-        scan_run_id: &str,
-    ) -> Result<u32, AgentError> {
-        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
-        let plan = build_scan_plan(target);
-        tracing::info!(
-            target_id = %target_id,
-            target_type = %target.target_type,
-            planned_steps = plan.steps.len(),
-            "Unified pipeline: scan plan built"
-        );
-
-        // Ingest + classify (tramiton for firmware) and store the detected type.
-        self.classify_and_store(target, &target_id, scan_run_id)
-            .await;
-        // Provision a DAST target from a LiveUrl artifact so DAST fires for
-        // wizard-created targets, not just migrated ones.
-        self.ensure_dast_target(target, &plan).await;
-
-        match target.code_artifact() {
-            Some(code) if code.kind == ArtifactKind::GitRepo => {
-                let repo = RepoView::from_target(target, code);
-                let new_count = self.run_pipeline(&repo, scan_run_id).await?;
-                self.finalize_target(target, &repo, new_count).await?;
-                Ok(new_count)
-            }
-            Some(_) => {
-                tracing::warn!(
-                    target_id = %target_id,
-                    "Unified pipeline: source-archive scanning not yet wired; skipping"
-                );
-                Ok(0)
-            }
-            None => {
-                // No code to scan. Firmware/PLC/mobile static scanners land in
-                // #128/#129/#130; DAST for a running URL still works when a
-                // DastTarget row exists (migrated targets).
-                tracing::info!(
-                    target_id = %target_id,
-                    "Unified pipeline: no code artifact; attempting DAST only"
-                );
-                self.update_phase(scan_run_id, "dast_scanning").await;
-                self.maybe_trigger_dast(&target_id, scan_run_id).await;
-                Ok(0)
-            }
-        }
-    }
-
-    /// Ingest the target's artifacts, classify (tramiton for firmware/RTOS/Yocto,
-    /// heuristics otherwise), and store the detected classification on the target.
-    /// Best-effort — never fails the scan.
-    async fn classify_and_store(
-        &self,
-        target: &OnboardedTarget,
-        target_id: &str,
-        scan_run_id: &str,
-    ) {
-        self.update_phase(scan_run_id, "classification").await;
-        let ctx = crate::ingest::IngestContext::from_config(&self.config, target_id);
-        let ingest_set = match crate::ingest::ingest_all(target, &ctx) {
-            Ok(set) => set,
-            Err(e) => {
-                tracing::warn!(target_id, error = %e, "Unified pipeline: ingest for classification failed");
-                return;
-            }
-        };
-        let working_paths = ingest_set.working_paths();
-        match crate::classify::classify_target(
-            target,
-            &working_paths,
-            &crate::classify::TramitonNative,
-        )
-        .await
-        {
-            Ok(classification) => {
-                tracing::info!(
-                    target_id,
-                    suggested = %classification.suggested,
-                    "Unified pipeline: classified target"
-                );
-                if let (Some(oid), Ok(bson)) = (target.id, mongodb::bson::to_bson(&classification))
-                {
-                    let _ = self
-                        .db
-                        .onboarded_targets()
-                        .update_one(
-                            doc! { "_id": oid },
-                            doc! { "$set": { "classification": bson } },
-                        )
-                        .await;
-                }
-            }
-            Err(e) => {
-                tracing::warn!(target_id, error = %e, "Unified pipeline: classification failed")
-            }
-        }
-
-        // Analysis-based firmware SBOM: for embedded targets, derive components
-        // (resolved libraries + cross-toolchain) from tramiton's build-plan
-        // analysis over the already-ingested source — no build, no binary
-        // upload. Best-effort; empty when no build plan forms.
-        if crate::pipeline::firmware_sbom::is_firmware_target(target.target_type) {
-            if let Some(code) = target.code_artifact() {
-                if let Some(path) = working_paths.get(&code.id) {
-                    let entries =
-                        crate::pipeline::firmware_sbom::firmware_sbom_entries(path, target_id)
-                            .await;
-                    if !entries.is_empty() {
-                        let _ = self
-                            .db
-                            .sbom_entries()
-                            .delete_many(doc! { "repo_id": target_id })
-                            .await;
-                        for entry in &entries {
-                            let filter = doc! {
-                                "repo_id": &entry.repo_id,
-                                "name": &entry.name,
-                                "version": &entry.version,
-                            };
-                            if let Ok(d) = mongodb::bson::to_document(entry) {
-                                let _ = self
-                                    .db
-                                    .sbom_entries()
-                                    .update_one(filter, doc! { "$set": d })
-                                    .upsert(true)
-                                    .await;
-                            }
-                        }
-                        tracing::info!(
-                            target_id,
-                            count = entries.len(),
-                            "Firmware SBOM: stored components from tramiton analysis"
-                        );
-                    }
-                }
-            }
-        }
-    }
-
-    /// If the target has a `LiveUrl` artifact and DAST is planned, provision a
-    /// `DastTarget` (keyed by `repo_id` = target id) so the existing DAST trigger
-    /// fires for wizard-created targets. Idempotent.
-    async fn ensure_dast_target(
-        &self,
-        target: &OnboardedTarget,
-        plan: &crate::pipeline::plan::ScanPlan,
-    ) {
-        if !plan.has(ScanType::Dast) {
-            return;
-        }
-        let (Some(url), Some(oid)) = (target.live_url(), target.id) else {
-            return;
-        };
-        let target_id = oid.to_hex();
-        if self
-            .db
-            .dast_targets()
-            .find_one(doc! { "repo_id": &target_id })
-            .await
-            .ok()
-            .flatten()
-            .is_some()
-        {
-            return; // already provisioned
-        }
-        let kind = url
-            .web
-            .as_ref()
-            .map(|w| w.target_kind.clone())
-            .unwrap_or(DastTargetType::WebApp);
-        let mut dast = DastTarget::new(target.name.clone(), url.source_ref.clone(), kind);
-        dast.repo_id = Some(target_id);
-        if let Some(web) = &url.web {
-            dast.excluded_paths = web.excluded_paths.clone();
-            dast.max_crawl_depth = web.max_crawl_depth;
-            dast.rate_limit = web.rate_limit;
-            dast.allow_destructive = web.allow_destructive;
-        }
-        if let Some(auth) = &url.auth {
-            dast.auth_config = Some(DastAuthConfig {
-                method: auth.method.clone(),
-                login_url: auth.login_url.clone(),
-                username: auth.username.clone(),
-                password: None,
-                token: auth.secret.clone(),
-                headers: auth.headers.clone(),
-            });
-        }
-        if let Err(e) = self.db.dast_targets().insert_one(&dast).await {
-            tracing::warn!(error = %e, "Unified pipeline: failed to provision DAST target");
-        }
-    }
-
-    /// Sync the onboarded-target document after a scan: bump `findings_count`
-    /// and advance the git artifact's `last_scanned_commit` watermark.
-    async fn finalize_target(
-        &self,
-        target: &OnboardedTarget,
-        repo: &RepoView,
-        new_count: u32,
-    ) -> Result<(), AgentError> {
-        let oid = match target.id {
-            Some(id) => id,
-            None => return Ok(()),
-        };
-        self.db
-            .onboarded_targets()
-            .update_one(
-                doc! { "_id": oid },
-                doc! {
-                    "$inc": { "findings_count": new_count as i64 },
-                    "$set": { "updated_at": mongodb::bson::DateTime::now() },
-                },
-            )
-            .await?;
-
-        let repo_path = std::path::Path::new(&self.config.git_clone_base_path).join(&repo.name);
-        if let (Ok(sha), Some(code)) = (GitOps::get_head_sha(&repo_path), target.code_artifact()) {
-            self.db
-                .onboarded_targets()
-                .update_one(
-                    doc! { "_id": oid, "artifacts.id": &code.id },
-                    doc! { "$set": { "artifacts.$.git.last_scanned_commit": sha } },
-                )
-                .await?;
-        }
-        Ok(())
-    }
-
    pub(super) async fn update_phase(&self, scan_run_id: &str, phase: &str) {
        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(scan_run_id) {
            let _ = self
@@ -700,50 +460,3 @@ pub(super) fn extract_base_url(git_url: &str) -> Option<String> {
        None
    }
 }
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{
-        Artifact, ArtifactAuth, IssueTrackerConfig, TargetType, TrackerType,
-    };
-
-    #[test]
-    fn repo_view_preserves_id_git_auth_and_tracker() {
-        let mut target = OnboardedTarget::new("acme".to_string(), TargetType::WebApp);
-        target.id = Some(mongodb::bson::oid::ObjectId::new());
-        target.findings_count = 3;
-        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
-            tracker_type: Some(TrackerType::Gitea),
-            owner: Some("acme".to_string()),
-            repo: Some("web".to_string()),
-            token: Some("tt".to_string()),
-        });
-
-        let mut artifact = Artifact::git_repo("https://git/acme.git", "develop");
-        if let Some(git) = artifact.git.as_mut() {
-            git.last_scanned_commit = Some("abc123".to_string());
-        }
-        artifact.auth = Some(ArtifactAuth {
-            method: "token".to_string(),
-            username: Some("bob".to_string()),
-            secret: Some("pat".to_string()),
-            ..Default::default()
-        });
-        target.artifacts.push(artifact);
-
-        let code = target.code_artifact().expect("code artifact");
-        let repo = RepoView::from_target(&target, code);
-
-        assert_eq!(repo.id, target.id); // preserved
-        assert_eq!(repo.git_url, "https://git/acme.git");
-        assert_eq!(repo.default_branch, "develop");
-        assert_eq!(repo.last_scanned_commit.as_deref(), Some("abc123"));
-        assert_eq!(repo.auth_token.as_deref(), Some("pat"));
-        assert_eq!(repo.auth_username.as_deref(), Some("bob"));
-        assert_eq!(repo.tracker_type, Some(TrackerType::Gitea));
-        assert_eq!(repo.tracker_owner.as_deref(), Some("acme"));
-        assert_eq!(repo.findings_count, 3);
-    }
-}
@@ -215,7 +215,7 @@ fn scan_with_patterns(
                        repo_id.to_string(),
                        fingerprint,
                        scanner_name.to_string(),
-                        scan_type,
+                        scan_type.clone(),
                        pattern.title.clone(),
                        pattern.description.clone(),
                        pattern.severity.clone(),
@@ -1,195 +0,0 @@
-//! The scan plan.
-//!
-//! [`build_scan_plan`] turns an [`OnboardedTarget`] into the concrete ordered
-//! list of scans to run, each bound to the artifact it consumes. It intersects
-//! the scan-applicability matrix ([`applicable_scans`]) with the target's
-//! `scan_config` overrides: a scan runs when its required artifact is present and
-//! it is either on by default or explicitly enabled, and is not explicitly
-//! disabled. This is the decision engine the unified pipeline (`run_target`)
-//! executes.
-
-use compliance_core::models::{Artifact, ArtifactKind, OnboardedTarget, ScanPhase, ScanType};
-use compliance_core::scan_matrix::applicable_scans;
-
-/// One scan to run, bound to the artifact it operates on.
-#[derive(Debug, Clone, PartialEq)]
-pub struct ScanStep {
-    /// The scan to run.
-    pub scan_type: ScanType,
-    /// The pipeline phase to report while it runs.
-    pub phase: ScanPhase,
-    /// The id of the artifact this scan consumes ([`Artifact::id`]).
-    pub artifact_id: String,
-}
-
-/// The ordered set of scans to run for a target.
-#[derive(Debug, Clone, Default, PartialEq)]
-pub struct ScanPlan {
-    /// The scans, in matrix order.
-    pub steps: Vec<ScanStep>,
-}
-
-impl ScanPlan {
-    /// Whether the plan contains a step for the given scan type.
-    pub fn has(&self, scan: ScanType) -> bool {
-        self.steps.iter().any(|s| s.scan_type == scan)
-    }
-
-    /// Whether the plan is empty (nothing to run).
-    pub fn is_empty(&self) -> bool {
-        self.steps.is_empty()
-    }
-}
-
-/// Build the scan plan for a target: matrix defaults ∩ `scan_config`, each scan
-/// bound to the artifact it consumes. Scans whose required artifact is absent, or
-/// that are disabled, or off-by-default and not explicitly enabled, are dropped.
-pub fn build_scan_plan(target: &OnboardedTarget) -> ScanPlan {
-    let enabled = &target.scan_config.enabled_scans;
-    let disabled = &target.scan_config.disabled_scans;
-
-    let mut steps = Vec::new();
-    for option in applicable_scans(target) {
-        // Required artifact missing → not runnable.
-        if option.blocked_reason.is_some() {
-            continue;
-        }
-        // Explicit opt-out wins.
-        if disabled.contains(&option.scan) {
-            continue;
-        }
-        // Run if on by default, or explicitly enabled.
-        if !option.default_on && !enabled.contains(&option.scan) {
-            continue;
-        }
-        let Some(artifact) = resolve_artifact(target, option.required_artifact) else {
-            continue;
-        };
-        steps.push(ScanStep {
-            scan_type: option.scan,
-            phase: phase_for(option.scan),
-            artifact_id: artifact.id.clone(),
-        });
-    }
-    ScanPlan { steps }
-}
-
-/// Resolve the artifact a scan consumes. A "code" requirement (represented by
-/// `GitRepo`) is satisfied by a git repo *or* a source archive.
-fn resolve_artifact(target: &OnboardedTarget, required: Option<ArtifactKind>) -> Option<&Artifact> {
-    match required {
-        Some(ArtifactKind::GitRepo) => target.code_artifact(),
-        Some(kind) => target.first_of(kind),
-        None => target.code_artifact().or_else(|| target.artifacts.first()),
-    }
-}
-
-/// The pipeline phase reported while a given scan runs.
-fn phase_for(scan: ScanType) -> ScanPhase {
-    match scan {
-        ScanType::Sast => ScanPhase::Sast,
-        ScanType::Sbom => ScanPhase::SbomGeneration,
-        ScanType::Cve => ScanPhase::CveScanning,
-        ScanType::Gdpr | ScanType::OAuth => ScanPhase::PatternScanning,
-        ScanType::SecretDetection => ScanPhase::SecretDetection,
-        ScanType::Lint => ScanPhase::LintScanning,
-        ScanType::CodeReview => ScanPhase::CodeReview,
-        ScanType::Graph => ScanPhase::GraphBuilding,
-        ScanType::Dast => ScanPhase::DastScanning,
-        ScanType::FirmwareStatic => ScanPhase::FirmwareStatic,
-        ScanType::PlcControlLogic => ScanPhase::PlcAnalysis,
-        ScanType::MobileStatic => ScanPhase::MobileStatic,
-        ScanType::ContainerScan => ScanPhase::ContainerScan,
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use compliance_core::models::{PlcFormat, TargetType};
-
-    fn target(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
-        let mut t = OnboardedTarget::new("t".to_string(), target_type);
-        t.artifacts = artifacts;
-        t
-    }
-
-    fn step_for<'a>(plan: &'a ScanPlan, scan: ScanType) -> Option<&'a ScanStep> {
-        plan.steps.iter().find(|s| s.scan_type == scan)
-    }
-
-    #[test]
-    fn webapp_with_code_and_url_runs_sast_and_dast_bound_to_the_right_artifacts() {
-        let code = Artifact::git_repo("https://git/x", "main");
-        let url = Artifact::live_url("https://x");
-        let (code_id, url_id) = (code.id.clone(), url.id.clone());
-        let t = target(TargetType::WebApp, vec![code, url]);
-
-        let plan = build_scan_plan(&t);
-        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
-        assert_eq!(sast.artifact_id, code_id);
-        assert_eq!(sast.phase, ScanPhase::Sast);
-        let dast = step_for(&plan, ScanType::Dast).expect("dast planned");
-        assert_eq!(dast.artifact_id, url_id);
-    }
-
-    #[test]
-    fn webapp_without_url_omits_dast() {
-        let t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
-        let plan = build_scan_plan(&t);
-        assert!(plan.has(ScanType::Sast));
-        assert!(!plan.has(ScanType::Dast));
-    }
-
-    #[test]
-    fn code_scan_binds_to_source_archive_when_no_git_repo() {
-        let arc = Artifact::source_archive("src.zip");
-        let arc_id = arc.id.clone();
-        let t = target(TargetType::BackendService, vec![arc]);
-        let plan = build_scan_plan(&t);
-        let sast = step_for(&plan, ScanType::Sast).expect("sast planned");
-        assert_eq!(sast.artifact_id, arc_id);
-    }
-
-    #[test]
-    fn firmware_sbom_and_cve_bind_to_the_firmware_image() {
-        let fw = Artifact::firmware_image("fw.bin");
-        let fw_id = fw.id.clone();
-        let t = target(TargetType::FirmwareBareMetal, vec![fw]);
-        let plan = build_scan_plan(&t);
-        let sbom = step_for(&plan, ScanType::Sbom).expect("sbom planned");
-        assert_eq!(sbom.artifact_id, fw_id);
-        assert!(step_for(&plan, ScanType::FirmwareStatic).is_some());
-        assert!(!plan.has(ScanType::Dast));
-    }
-
-    #[test]
-    fn plc_plans_only_control_logic() {
-        let plc = Artifact::plc_project("p.xml", PlcFormat::PlcopenXml);
-        let t = target(TargetType::PlcSps, vec![plc]);
-        let plan = build_scan_plan(&t);
-        assert_eq!(plan.steps.len(), 1);
-        assert_eq!(plan.steps[0].scan_type, ScanType::PlcControlLogic);
-        assert_eq!(plan.steps[0].phase, ScanPhase::PlcAnalysis);
-    }
-
-    #[test]
-    fn disabled_scan_is_dropped_and_off_by_default_can_be_enabled() {
-        let mut t = target(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
-        t.scan_config.disabled_scans = vec![ScanType::Lint];
-        // CodeReview is off by default for web; enable it explicitly.
-        t.scan_config.enabled_scans = vec![ScanType::CodeReview];
-        let plan = build_scan_plan(&t);
-        assert!(!plan.has(ScanType::Lint));
-        assert!(plan.has(ScanType::CodeReview));
-        assert!(plan.has(ScanType::Sast));
-    }
-
-    #[test]
-    fn no_code_artifact_yields_empty_plan_for_web() {
-        let t = target(TargetType::WebApp, vec![]);
-        let plan = build_scan_plan(&t);
-        assert!(plan.is_empty());
-    }
-}
@@ -1,4 +1,3 @@
-use crate::pipeline::repo_view::RepoView;
 use compliance_core::models::*;

 use super::dedup::compute_fingerprint;
@@ -15,7 +14,7 @@ impl PipelineOrchestrator {
    #[tracing::instrument(skip_all, fields(repo_id = %repo_id, pr_number))]
    pub async fn run_pr_review(
        &self,
-        repo: &RepoView,
+        repo: &TrackedRepository,
        repo_id: &str,
        pr_number: u64,
        base_sha: &str,
@@ -1,74 +0,0 @@
-//! `RepoView` — an internal, non-persisted view of a code target for the scan
-//! pipeline.
-//!
-//! It replaces the old persisted `TrackedRepository` model. The pipeline
-//! (SAST → SBOM → CVE → triage → issues → DAST, and PR review) only ever needs a
-//! flat bundle of git + issue-tracker + auth fields; those are projected from an
-//! [`OnboardedTarget`] and its code [`Artifact`] by [`RepoView::from_target`].
-//! Nothing here is written to Mongo — onboarded targets are the sole persisted
-//! entity.
-
-use compliance_core::models::{Artifact, OnboardedTarget, TrackerType};
-
-/// A flat, pipeline-facing view of a code target. Built from an onboarded
-/// target; never persisted.
-#[derive(Debug, Clone)]
-pub struct RepoView {
-    /// The onboarded target's id (used as `repo_id` across findings/sbom/etc.).
-    pub id: Option<mongodb::bson::oid::ObjectId>,
-    pub name: String,
-    pub git_url: String,
-    pub default_branch: String,
-    pub local_path: Option<String>,
-    pub scan_schedule: Option<String>,
-    pub webhook_enabled: bool,
-    pub webhook_secret: Option<String>,
-    pub tracker_type: Option<TrackerType>,
-    pub tracker_owner: Option<String>,
-    pub tracker_repo: Option<String>,
-    pub tracker_token: Option<String>,
-    pub auth_token: Option<String>,
-    pub auth_username: Option<String>,
-    pub last_scanned_commit: Option<String>,
-    pub findings_count: u32,
-}
-
-impl RepoView {
-    /// Project an onboarded target + its code artifact into a pipeline view.
-    pub fn from_target(target: &OnboardedTarget, code: &Artifact) -> Self {
-        let mut view = Self {
-            id: target.id,
-            name: target.name.clone(),
-            git_url: code.source_ref.clone(),
-            default_branch: "main".to_string(),
-            local_path: None,
-            scan_schedule: target.scan_schedule.clone(),
-            webhook_enabled: target.webhook_enabled,
-            webhook_secret: target.webhook_secret.clone(),
-            tracker_type: None,
-            tracker_owner: None,
-            tracker_repo: None,
-            tracker_token: None,
-            auth_token: None,
-            auth_username: None,
-            last_scanned_commit: None,
-            findings_count: target.findings_count,
-        };
-        if let Some(git) = &code.git {
-            view.default_branch = git.default_branch.clone();
-            view.last_scanned_commit = git.last_scanned_commit.clone();
-            view.local_path = git.local_path.clone();
-        }
-        if let Some(auth) = &code.auth {
-            view.auth_token = auth.secret.clone();
-            view.auth_username = auth.username.clone();
-        }
-        if let Some(it) = &target.scan_config.issue_tracker {
-            view.tracker_type = it.tracker_type.clone();
-            view.tracker_owner = it.owner.clone();
-            view.tracker_repo = it.repo.clone();
-            view.tracker_token = it.token.clone();
-        }
-        view
-    }
-}
@@ -288,25 +288,25 @@ async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
        None => return,
    };

-    let cursor = match db.onboarded_targets().find(doc! {}).await {
+    let cursor = match db.repositories().find(doc! {}).await {
        Ok(c) => c,
        Err(e) => {
-            tracing::error!("Failed to list targets for tenant '{tenant_id}': {e}");
+            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
            return;
        }
    };

-    let targets: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;
+    let repos: Vec<_> = cursor.filter_map(|r| async { r.ok() }).collect().await;

-    for target in targets {
-        let target_id = target.id.map(|id| id.to_hex()).unwrap_or_default();
+    for repo in repos {
+        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
        if let Err(e) = agent
-            .run_target_scan(tenant_id, &target_id, ScanTrigger::Scheduled)
+            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
            .await
        {
            tracing::error!(
                "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
-                target.name
+                repo.name
            );
        }
    }
@@ -348,7 +348,7 @@ async fn monitor_cves(agent: &ComplianceAgent, tenant_id: &str) {
        std::collections::HashMap::new();
    for rid in &repo_ids {
        if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(rid) {
-            if let Ok(Some(repo)) = db.onboarded_targets().find_one(doc! { "_id": oid }).await {
+            if let Ok(Some(repo)) = db.repositories().find_one(doc! { "_id": oid }).await {
                repo_names.insert(rid.clone(), repo.name.clone());
            }
        }
@@ -31,7 +31,7 @@ pub async fn handle_gitea_webhook(
        }
    };
    let repo = match db
-        .onboarded_targets()
+        .repositories()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -31,7 +31,7 @@ pub async fn handle_github_webhook(
        }
    };
    let repo = match db
-        .onboarded_targets()
+        .repositories()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -27,7 +27,7 @@ pub async fn handle_gitlab_webhook(
        }
    };
    let repo = match db
-        .onboarded_targets()
+        .repositories()
        .find_one(mongodb::bson::doc! { "_id": oid })
        .await
    {
@@ -25,9 +25,8 @@ impl TestServer {
        let mongodb_uri = std::env::var("TEST_MONGODB_URI")
            .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());

-        // Unique db-name prefix per run. Must fit the pool's 30-char cap
-        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
-        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
+        // Unique database name per test run to avoid collisions
+        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());

        let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
            .await
@@ -45,7 +44,6 @@ impl TestServer {
            scan_schedule: String::new(),
            cve_monitor_schedule: String::new(),
            git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
-            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
            ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
            github_token: None,
            github_webhook_secret: None,
@@ -113,16 +113,15 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
    // Create a repo
    let resp = server
        .post(
-            "/api/v1/targets",
+            "/api/v1/repositories",
            &json!({
                "name": "cascade-test",
-                "target_type": "web_app",
-                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/cascade-test.git", "branch": "main" }],
+                "git_url": "https://github.com/example/cascade-test.git",
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["id"].as_str().unwrap().to_string();

    // Insert DAST target linked to repo
    let target_id = insert_dast_target(&server, &repo_id, "cascade-target").await;
@@ -141,7 +140,9 @@ async fn delete_repo_cascades_to_dast_and_pentest_data() {
    assert_eq!(count_docs(&server, "dast_findings").await, 1);

    // Delete the repo
-    let resp = server.delete(&format!("/api/v1/targets/{repo_id}")).await;
+    let resp = server
+        .delete(&format!("/api/v1/repositories/{repo_id}"))
+        .await;
    assert_eq!(resp.status(), 200);

    // All downstream data should be gone
@@ -160,16 +161,15 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
    // Create a repo
    let resp = server
        .post(
-            "/api/v1/targets",
+            "/api/v1/repositories",
            &json!({
                "name": "sast-cascade",
-                "target_type": "web_app",
-                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/sast-cascade.git", "branch": "main" }],
+                "git_url": "https://github.com/example/sast-cascade.git",
            }),
        )
        .await;
    let body: serde_json::Value = resp.json().await.unwrap();
-    let repo_id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
+    let repo_id = body["data"]["id"].as_str().unwrap().to_string();

    // Insert SAST finding and SBOM entry
    let mongodb_uri = std::env::var("TEST_MONGODB_URI")
@@ -209,7 +209,9 @@ async fn delete_repo_cascades_sast_findings_and_sbom() {
    assert_eq!(count_docs(&server, "sbom_entries").await, 1);

    // Delete repo
-    server.delete(&format!("/api/v1/targets/{repo_id}")).await;
+    server
+        .delete(&format!("/api/v1/repositories/{repo_id}"))
+        .await;

    // Both should be gone
    assert_eq!(count_docs(&server, "findings").await, 0);
@@ -2,5 +2,5 @@ mod cascade_delete;
 mod dast;
 mod findings;
 mod health;
-mod onboarding;
+mod repositories;
 mod stats;
@@ -1,115 +0,0 @@
-use crate::common::TestServer;
-use serde_json::json;
-
-#[tokio::test]
-async fn create_list_and_applicable_scans() {
-    let server = TestServer::start().await;
-
-    // Initially empty.
-    let resp = server.get("/api/v1/targets").await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 0);
-
-    // Create a web-app target with a git repo + a live URL.
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({
-                "name": "acme-web",
-                "target_type": "web_app",
-                "artifacts": [
-                    { "kind": "git_repo", "source_ref": "https://git/acme.git", "branch": "main" },
-                    { "kind": "live_url", "source_ref": "https://acme.example.com" }
-                ]
-            }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-    assert!(!id.is_empty());
-    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 2);
-
-    // List returns it.
-    let resp = server.get("/api/v1/targets").await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"].as_array().unwrap().len(), 1);
-
-    // Applicable scans: SAST present + DAST offered (live URL present), pentest supported.
-    let resp = server
-        .get(&format!("/api/v1/targets/{id}/applicable-scans"))
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let scans = body["data"]["scans"].as_array().unwrap();
-    let names: Vec<&str> = scans.iter().filter_map(|s| s["scan"].as_str()).collect();
-    assert!(names.contains(&"sast"));
-    assert!(names.contains(&"dast"));
-    assert_eq!(body["data"]["pentest_supported"], true);
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn detect_classifies_a_plc_target() {
-    let server = TestServer::start().await;
-
-    // A PLC project artifact is a strong kind-based signal.
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({
-                "name": "line-controller",
-                "target_type": "backend_service", // deliberately wrong; detect should suggest PLC
-                "artifacts": [
-                    { "kind": "plc_project", "source_ref": "line.xml", "plc_format": "plcopen_xml" }
-                ]
-            }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-
-    let resp = server
-        .post(&format!("/api/v1/targets/{id}/detect"), &json!({}))
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"]["classification"]["suggested"], "plc_sps");
-
-    server.cleanup().await;
-}
-
-#[tokio::test]
-async fn add_artifact_and_delete_target() {
-    let server = TestServer::start().await;
-
-    let resp = server
-        .post(
-            "/api/v1/targets",
-            &json!({ "name": "svc", "target_type": "backend_service" }),
-        )
-        .await;
-    let body: serde_json::Value = resp.json().await.unwrap();
-    let id = body["data"]["_id"]["$oid"].as_str().unwrap().to_string();
-
-    // Attach a git repo.
-    let resp = server
-        .post(
-            &format!("/api/v1/targets/{id}/artifacts"),
-            &json!({ "kind": "git_repo", "source_ref": "https://git/svc.git" }),
-        )
-        .await;
-    assert_eq!(resp.status(), 200);
-    let body: serde_json::Value = resp.json().await.unwrap();
-    assert_eq!(body["data"]["artifacts"].as_array().unwrap().len(), 1);
-
-    // Delete it.
-    let resp = server.delete(&format!("/api/v1/targets/{id}")).await;
-    assert_eq!(resp.status(), 200);
-    let resp = server.get(&format!("/api/v1/targets/{id}")).await;
-    assert_eq!(resp.status(), 404);
-
-    server.cleanup().await;
-}
@@ -0,0 +1,110 @@
+use crate::common::TestServer;
+use serde_json::json;
+
+#[tokio::test]
+async fn add_and_list_repository() {
+    let server = TestServer::start().await;
+
+    // Initially empty
+    let resp = server.get("/api/v1/repositories").await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    // Add a repository
+    let resp = server
+        .post(
+            "/api/v1/repositories",
+            &json!({
+                "name": "test-repo",
+                "git_url": "https://github.com/example/test-repo.git",
+            }),
+        )
+        .await;
+    assert_eq!(resp.status(), 200);
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let repo_id = body["data"]["id"].as_str().unwrap().to_string();
+    assert!(!repo_id.is_empty());
+
+    // List should now return 1
+    let resp = server.get("/api/v1/repositories").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let repos = body["data"].as_array().unwrap();
+    assert_eq!(repos.len(), 1);
+    assert_eq!(repos[0]["name"], "test-repo");
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn add_duplicate_repository_fails() {
+    let server = TestServer::start().await;
+
+    let payload = json!({
+        "name": "dup-repo",
+        "git_url": "https://github.com/example/dup-repo.git",
+    });
+
+    // First add succeeds
+    let resp = server.post("/api/v1/repositories", &payload).await;
+    assert_eq!(resp.status(), 200);
+
+    // Second add with same git_url should fail (unique index)
+    let resp = server.post("/api/v1/repositories", &payload).await;
+    assert_ne!(resp.status(), 200);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn delete_repository() {
+    let server = TestServer::start().await;
+
+    // Add a repo
+    let resp = server
+        .post(
+            "/api/v1/repositories",
+            &json!({
+                "name": "to-delete",
+                "git_url": "https://github.com/example/to-delete.git",
+            }),
+        )
+        .await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    let repo_id = body["data"]["id"].as_str().unwrap();
+
+    // Delete it
+    let resp = server
+        .delete(&format!("/api/v1/repositories/{repo_id}"))
+        .await;
+    assert_eq!(resp.status(), 200);
+
+    // List should be empty again
+    let resp = server.get("/api/v1/repositories").await;
+    let body: serde_json::Value = resp.json().await.unwrap();
+    assert_eq!(body["data"].as_array().unwrap().len(), 0);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn delete_nonexistent_repository_returns_404() {
+    let server = TestServer::start().await;
+
+    let resp = server
+        .delete("/api/v1/repositories/000000000000000000000000")
+        .await;
+    assert_eq!(resp.status(), 404);
+
+    server.cleanup().await;
+}
+
+#[tokio::test]
+async fn delete_invalid_id_returns_400() {
+    let server = TestServer::start().await;
+
+    let resp = server.delete("/api/v1/repositories/not-a-valid-id").await;
+    assert_eq!(resp.status(), 400);
+
+    server.cleanup().await;
+}
@@ -5,14 +5,13 @@ use serde_json::json;
 async fn stats_overview_reflects_inserted_data() {
    let server = TestServer::start().await;

-    // Add a target
+    // Add a repo
    server
        .post(
-            "/api/v1/targets",
+            "/api/v1/repositories",
            &json!({
                "name": "stats-repo",
-                "target_type": "web_app",
-                "artifacts": [{ "kind": "git_repo", "source_ref": "https://github.com/example/stats-repo.git", "branch": "main" }],
+                "git_url": "https://github.com/example/stats-repo.git",
            }),
        )
        .await;
@@ -11,7 +11,7 @@
 #![allow(clippy::expect_used, clippy::unwrap_used)]

 use compliance_agent::database::DatabasePool;
-use compliance_core::models::{Artifact, OnboardedTarget, TargetType};
+use compliance_core::models::TrackedRepository;
 use compliance_core::{OrgRole, TenantContext, TenantStatus};
 use mongodb::bson::doc;

@@ -28,12 +28,27 @@ fn ctx(tenant_id: &str, slug: &str) -> TenantContext {
    }
 }

-fn fixture_repo(name: &str, git_url: &str) -> OnboardedTarget {
-    let mut target = OnboardedTarget::new(name.to_string(), TargetType::WebApp);
-    target
-        .artifacts
-        .push(Artifact::git_repo(git_url.to_string(), "main".to_string()));
-    target
+fn fixture_repo(name: &str, git_url: &str) -> TrackedRepository {
+    TrackedRepository {
+        id: None,
+        name: name.to_string(),
+        git_url: git_url.to_string(),
+        default_branch: "main".to_string(),
+        local_path: None,
+        scan_schedule: None,
+        webhook_enabled: false,
+        webhook_secret: None,
+        tracker_type: None,
+        tracker_owner: None,
+        tracker_repo: None,
+        tracker_token: None,
+        auth_token: None,
+        auth_username: None,
+        last_scanned_commit: None,
+        findings_count: 0,
+        created_at: chrono::Utc::now(),
+        updated_at: chrono::Utc::now(),
+    }
 }

 #[tokio::test]
@@ -56,12 +71,12 @@ async fn pool_isolates_tenants_at_driver_level() {

    // Write distinct repos into each tenant's database.
    acme_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
        .await
        .expect("insert acme");
    globex_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo(
            "globex-platform",
            "git@example.com:globex/platform.git",
@@ -158,12 +173,12 @@ async fn admin_helpers_list_and_drop_tenant_dbs() {
    let acme_db = pool.for_tenant(&acme).await.expect("acme db");
    let globex_db = pool.for_tenant(&globex).await.expect("globex db");
    acme_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
        .await
        .expect("insert acme");
    globex_db
-        .onboarded_targets()
+        .repositories()
        .insert_one(fixture_repo("globex-app", "git@example.com:globex/app.git"))
        .await
        .expect("insert globex");
@@ -269,9 +284,9 @@ fn short_id() -> String {
 }

 /// Drain a `repositories` find cursor on the given tenant database.
-async fn collect(db: &compliance_agent::database::Database) -> Vec<OnboardedTarget> {
+async fn collect(db: &compliance_agent::database::Database) -> Vec<TrackedRepository> {
    let mut cursor = db
-        .onboarded_targets()
+        .repositories()
        .find(doc! {})
        .await
        .expect("find repositories");
@@ -24,9 +24,6 @@ pub struct AgentConfig {
    pub scan_schedule: String,
    pub cve_monitor_schedule: String,
    pub git_clone_base_path: String,
-    /// Base directory for content-addressed artifact blobs and per-run working
-    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
-    pub artifact_store_base_path: String,
    pub ssh_key_path: String,
    pub keycloak_url: Option<String>,
    pub keycloak_realm: Option<String>,
@@ -2,7 +2,6 @@ pub mod config;
 pub mod db;
 pub mod error;
 pub mod models;
-pub mod scan_matrix;
 #[cfg(feature = "telemetry")]
 pub mod telemetry;
 pub mod tenant;
@@ -1,69 +0,0 @@
-//! Per-tenant API tokens used by `compliance-mcp` to authenticate MCP
-//! HTTP requests on behalf of LLM clients (Claude Desktop, Cursor,
-//! ChatGPT, etc.) that can't run a Keycloak OIDC flow.
-//!
-//! Tokens are opaque strings of the form `mcpt_<44 url-safe random
-//! chars>`. The raw value is shown to the user exactly once at
-//! creation; the database only ever sees the SHA-256 hash. Lookups go
-//! through the cross-tenant `<prefix>__admin.mcp_tokens` collection
-//! and return the `tenant_id` the MCP server should route to.
-
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
-
-/// Persisted token metadata. `token_hash` is the SHA-256 hex of the
-/// raw token; the raw token itself is never stored.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct McpToken {
-    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
-    pub id: Option<bson::oid::ObjectId>,
-    /// SHA-256 hex of the raw token. Unique index in the collection.
-    pub token_hash: String,
-    /// First 8 chars of the raw token — purely for UI display so users
-    /// can identify which token is which without re-issuing.
-    pub token_prefix: String,
-    /// Routes to `<db_prefix>_<tenant_id>` on MCP requests.
-    pub tenant_id: String,
-    /// User-given label, e.g. "Claude Desktop" or "Sharang's laptop".
-    pub name: String,
-    /// Keycloak `sub` of the user who created this token, for audit.
-    pub created_by: String,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub created_at: DateTime<Utc>,
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub last_used_at: Option<DateTime<Utc>>,
-    /// Soft-delete flag. A revoked token doc stays around for audit
-    /// but never authenticates.
-    #[serde(default)]
-    pub revoked: bool,
-}
-
-/// Public projection of a token — never includes the hash.
-/// Returned by `GET /api/v1/mcp-tokens`.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct McpTokenView {
-    pub id: String,
-    pub name: String,
-    /// `mcpt_xxxx…` so the user can identify which row is which.
-    pub token_prefix: String,
-    pub created_by: String,
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub created_at: DateTime<Utc>,
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub last_used_at: Option<DateTime<Utc>>,
-    pub revoked: bool,
-}
-
-impl From<&McpToken> for McpTokenView {
-    fn from(t: &McpToken) -> Self {
-        Self {
-            id: t.id.map(|o| o.to_hex()).unwrap_or_default(),
-            name: t.name.clone(),
-            token_prefix: t.token_prefix.clone(),
-            created_by: t.created_by.clone(),
-            created_at: t.created_at,
-            last_used_at: t.last_used_at,
-            revoked: t.revoked,
-        }
-    }
-}
@@ -7,9 +7,7 @@ pub mod finding;
 pub mod graph;
 pub mod issue;
 pub mod mcp;
-pub mod mcp_token;
 pub mod notification;
-pub mod onboarding;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
@@ -30,20 +28,13 @@ pub use graph::{
 };
 pub use issue::{IssueStatus, TrackerIssue, TrackerType};
 pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
-pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
-pub use onboarding::{
-    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
-    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
-    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
-    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
-};
 pub use pentest::{
    AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
    PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
    PentestStatus, PentestStrategy, SeverityDistribution, TestUserRecord, TesterInfo,
    ToolCallRecord,
 };
-pub use repository::ScanTrigger;
+pub use repository::{ScanTrigger, TrackedRepository};
 pub use sbom::{SbomEntry, VulnRef};
 pub use scan::{ScanPhase, ScanRun, ScanRunStatus, ScanType};
@@ -1,753 +0,0 @@
-//! The unified onboarding model.
-//!
-//! An [`OnboardedTarget`] is the single source of truth for anything the scanner
-//! can analyze. It records *what kind of software* the target is ([`TargetType`]),
-//! the concrete [`Artifact`]s that were provided for it (a git repo, a firmware
-//! image, a live URL, a PLC project, ...), the classifier's verdict, and the scan
-//! configuration. It replaces the older git-only `TrackedRepository` and the
-//! standalone `DastTarget`, both of which fold into this type as artifacts.
-
-use std::collections::HashMap;
-
-use chrono::{DateTime, Utc};
-use serde::{Deserialize, Serialize};
-
-use super::dast::{DastAuthConfig, DastTargetType};
-use super::issue::TrackerType;
-use super::pentest::{Environment, PentestConfig, PentestStrategy};
-use super::scan::ScanType;
-
-/// The family of software a target belongs to.
-///
-/// Targets look endlessly varied but fall into a small enumerable set classified
-/// by where the analyzable signal lives. This drives the scan-applicability
-/// matrix and the onboarding wizard's type selection.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum TargetType {
-    /// Browser-facing web application (front end + server).
-    WebApp,
-    /// Headless backend service / API (REST, GraphQL, gRPC).
-    BackendService,
-    /// Desktop application (Windows/macOS/Linux GUI or CLI binary).
-    DesktopApp,
-    /// Android application (APK / AAB).
-    AndroidApp,
-    /// iOS application (IPA).
-    IosApp,
-    /// Bare-metal embedded firmware (no operating system).
-    FirmwareBareMetal,
-    /// Embedded firmware running on an RTOS (Zephyr, FreeRTOS, ...).
-    FirmwareRtos,
-    /// Embedded Linux built with Yocto / OpenEmbedded (BSP + image).
-    EmbeddedLinuxYocto,
-    /// Programmable logic controller software (IEC 61131-3, PLCopen / SPS).
-    PlcSps,
-}
-
-impl std::fmt::Display for TargetType {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::WebApp => write!(f, "web_app"),
-            Self::BackendService => write!(f, "backend_service"),
-            Self::DesktopApp => write!(f, "desktop_app"),
-            Self::AndroidApp => write!(f, "android_app"),
-            Self::IosApp => write!(f, "ios_app"),
-            Self::FirmwareBareMetal => write!(f, "firmware_bare_metal"),
-            Self::FirmwareRtos => write!(f, "firmware_rtos"),
-            Self::EmbeddedLinuxYocto => write!(f, "embedded_linux_yocto"),
-            Self::PlcSps => write!(f, "plc_sps"),
-        }
-    }
-}
-
-/// The kind of artifact provided for a target.
-///
-/// Which scans are possible is a function of the target type *and* which of
-/// these are present (SAST needs code, DAST needs a running URL, and so on).
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ArtifactKind {
-    /// A git repository (cloned for static analysis).
-    GitRepo,
-    /// A source archive (zip / tarball) with no live git remote.
-    SourceArchive,
-    /// A firmware image or binary blob.
-    FirmwareImage,
-    /// A mobile package: Android APK/AAB or iOS IPA.
-    MobilePackage,
-    /// An OCI/Docker container image reference.
-    ContainerImage,
-    /// A reachable running instance (base URL / endpoint) for dynamic testing.
-    LiveUrl,
-    /// A PLC project: PLCopen XML or Structured Text source.
-    PlcProject,
-    /// Free-form plaintext describing the target (feeds classification only).
-    PlaintextDescription,
-}
-
-impl std::fmt::Display for ArtifactKind {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::GitRepo => write!(f, "git_repo"),
-            Self::SourceArchive => write!(f, "source_archive"),
-            Self::FirmwareImage => write!(f, "firmware_image"),
-            Self::MobilePackage => write!(f, "mobile_package"),
-            Self::ContainerImage => write!(f, "container_image"),
-            Self::LiveUrl => write!(f, "live_url"),
-            Self::PlcProject => write!(f, "plc_project"),
-            Self::PlaintextDescription => write!(f, "plaintext_description"),
-        }
-    }
-}
-
-/// Credentials attached to an artifact.
-///
-/// This folds both `TrackedRepository`'s git auth (`auth_token` / `auth_username`
-/// / SSH key) and `DastAuthConfig`'s HTTP auth (form / bearer / cookie) into one
-/// shape so a single artifact carries whatever it needs to be fetched or probed.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct ArtifactAuth {
-    /// Auth method: `none` | `token` | `basic` | `bearer` | `cookie` | `form` | `ssh`.
-    #[serde(default)]
-    pub method: String,
-    /// Username (git user, basic-auth user, or `x-access-token` for PATs).
-    pub username: Option<String>,
-    /// The secret credential: PAT, password, or bearer token. Encrypted at rest.
-    pub secret: Option<String>,
-    /// Path to an SSH private key for git-over-SSH.
-    pub ssh_key_path: Option<String>,
-    /// Login URL for form-based authentication.
-    pub login_url: Option<String>,
-    /// Extra headers to send when authenticating / probing.
-    pub headers: Option<HashMap<String, String>>,
-}
-
-impl From<DastAuthConfig> for ArtifactAuth {
-    fn from(c: DastAuthConfig) -> Self {
-        Self {
-            method: c.method,
-            username: c.username,
-            // Prefer a bearer token; otherwise fall back to the password.
-            secret: c.token.or(c.password),
-            ssh_key_path: None,
-            login_url: c.login_url,
-            headers: c.headers,
-        }
-    }
-}
-
-/// Git-specific configuration for a [`ArtifactKind::GitRepo`] artifact.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct GitArtifactConfig {
-    /// Branch to scan.
-    pub default_branch: String,
-    /// Commit SHA of the last completed scan (change-detection watermark).
-    pub last_scanned_commit: Option<String>,
-    /// Local clone path once the repo has been fetched.
-    pub local_path: Option<String>,
-}
-
-impl GitArtifactConfig {
-    /// Config for a fresh git artifact on the given branch.
-    pub fn on_branch(branch: impl Into<String>) -> Self {
-        Self {
-            default_branch: branch.into(),
-            last_scanned_commit: None,
-            local_path: None,
-        }
-    }
-}
-
-impl Default for GitArtifactConfig {
-    fn default() -> Self {
-        Self::on_branch("main")
-    }
-}
-
-/// Dynamic-analysis configuration for a [`ArtifactKind::LiveUrl`] artifact.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct WebArtifactConfig {
-    /// Whether the endpoint is a web app, REST API, or GraphQL API.
-    pub target_kind: DastTargetType,
-    /// URL paths to exclude from crawling / scanning.
-    #[serde(default)]
-    pub excluded_paths: Vec<String>,
-    /// Maximum crawl depth.
-    pub max_crawl_depth: u32,
-    /// Rate limit in requests per second.
-    pub rate_limit: u32,
-    /// Whether destructive methods (DELETE / PUT) are permitted.
-    #[serde(default)]
-    pub allow_destructive: bool,
-}
-
-impl Default for WebArtifactConfig {
-    fn default() -> Self {
-        Self {
-            target_kind: DastTargetType::WebApp,
-            excluded_paths: Vec::new(),
-            max_crawl_depth: 3,
-            rate_limit: 10,
-            allow_destructive: false,
-        }
-    }
-}
-
-/// The source format of a PLC project artifact.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum PlcFormat {
-    /// PLCopen XML project export.
-    PlcopenXml,
-    /// IEC 61131-3 Structured Text source.
-    StructuredText,
-}
-
-/// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct PlcArtifactConfig {
-    /// The project source format.
-    pub format: PlcFormat,
-}
-
-/// A single fact discovered about a target by ingest or classification
-/// (e.g. `language=rust`, `build_system=cmake`, `mcu=stm32f429`).
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct DetectedFact {
-    /// The fact name.
-    pub key: String,
-    /// The fact value.
-    pub value: String,
-    /// What produced the fact (e.g. `tramiton`, `language-fingerprint`).
-    pub source: String,
-}
-
-impl DetectedFact {
-    /// Build a fact from its parts.
-    pub fn new(
-        key: impl Into<String>,
-        value: impl Into<String>,
-        source: impl Into<String>,
-    ) -> Self {
-        Self {
-            key: key.into(),
-            value: value.into(),
-            source: source.into(),
-        }
-    }
-}
-
-/// One concrete thing provided for a target: code, a binary, a URL, etc.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Artifact {
-    /// Stable per-artifact id (UUID v4) — scan steps reference this.
-    pub id: String,
-    /// What kind of artifact this is.
-    pub kind: ArtifactKind,
-    /// The source reference: git URL, blob id, live URL, or image ref.
-    pub source_ref: String,
-    /// Optional human-friendly label.
-    pub display_name: Option<String>,
-    /// Content-addressed storage path once ingested (blobs only).
-    pub stored_path: Option<String>,
-    /// SHA-256 of the ingested content (git artifacts store the head SHA).
-    pub content_hash: Option<String>,
-    /// Size of the stored blob in bytes.
-    pub size_bytes: Option<u64>,
-    /// Credentials for fetching or probing this artifact.
-    pub auth: Option<ArtifactAuth>,
-    /// Git configuration (present for [`ArtifactKind::GitRepo`]).
-    pub git: Option<GitArtifactConfig>,
-    /// Dynamic-analysis configuration (present for [`ArtifactKind::LiveUrl`]).
-    pub web: Option<WebArtifactConfig>,
-    /// PLC configuration (present for [`ArtifactKind::PlcProject`]).
-    pub plc: Option<PlcArtifactConfig>,
-    /// Facts discovered about this artifact by ingest / classification.
-    #[serde(default)]
-    pub detected: Vec<DetectedFact>,
-    /// When this artifact was last ingested.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub ingested_at: Option<DateTime<Utc>>,
-}
-
-impl Artifact {
-    /// A bare artifact of the given kind and source reference.
-    fn bare(kind: ArtifactKind, source_ref: impl Into<String>) -> Self {
-        Self {
-            id: uuid::Uuid::new_v4().to_string(),
-            kind,
-            source_ref: source_ref.into(),
-            display_name: None,
-            stored_path: None,
-            content_hash: None,
-            size_bytes: None,
-            auth: None,
-            git: None,
-            web: None,
-            plc: None,
-            detected: Vec::new(),
-            ingested_at: None,
-        }
-    }
-
-    /// A git-repository artifact tracking the given branch.
-    pub fn git_repo(url: impl Into<String>, branch: impl Into<String>) -> Self {
-        let mut a = Self::bare(ArtifactKind::GitRepo, url);
-        a.git = Some(GitArtifactConfig::on_branch(branch));
-        a
-    }
-
-    /// A live-URL artifact with default crawl settings.
-    pub fn live_url(url: impl Into<String>) -> Self {
-        let mut a = Self::bare(ArtifactKind::LiveUrl, url);
-        a.web = Some(WebArtifactConfig::default());
-        a
-    }
-
-    /// A firmware-image artifact referenced by name (blob ingested later).
-    pub fn firmware_image(source_ref: impl Into<String>) -> Self {
-        Self::bare(ArtifactKind::FirmwareImage, source_ref)
-    }
-
-    /// A source-archive artifact referenced by name (blob ingested later).
-    pub fn source_archive(source_ref: impl Into<String>) -> Self {
-        Self::bare(ArtifactKind::SourceArchive, source_ref)
-    }
-
-    /// A mobile-package artifact (APK/AAB/IPA) referenced by name.
-    pub fn mobile_package(source_ref: impl Into<String>) -> Self {
-        Self::bare(ArtifactKind::MobilePackage, source_ref)
-    }
-
-    /// A container-image artifact referenced by OCI ref.
-    pub fn container_image(source_ref: impl Into<String>) -> Self {
-        Self::bare(ArtifactKind::ContainerImage, source_ref)
-    }
-
-    /// A PLC-project artifact in the given format.
-    pub fn plc_project(source_ref: impl Into<String>, format: PlcFormat) -> Self {
-        let mut a = Self::bare(ArtifactKind::PlcProject, source_ref);
-        a.plc = Some(PlcArtifactConfig { format });
-        a
-    }
-
-    /// A plaintext-description artifact (classification input only).
-    pub fn plaintext(text: impl Into<String>) -> Self {
-        Self::bare(ArtifactKind::PlaintextDescription, text)
-    }
-}
-
-/// One ranked candidate produced by the classifier.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TargetTypeCandidate {
-    /// The candidate target type.
-    pub target_type: TargetType,
-    /// Confidence in `[0.0, 1.0]`.
-    pub confidence: f32,
-    /// Why this candidate was proposed.
-    pub rationale: String,
-}
-
-/// The classifier's verdict for a target: a suggested type plus ranked
-/// alternatives and the facts the decision rested on.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Classification {
-    /// The top-ranked target type.
-    pub suggested: TargetType,
-    /// All candidates, sorted by descending confidence.
-    #[serde(default)]
-    pub candidates: Vec<TargetTypeCandidate>,
-    /// Facts gathered during classification.
-    #[serde(default)]
-    pub facts: Vec<DetectedFact>,
-    /// Which classifiers contributed (e.g. `["tramiton", "language-fingerprint"]`).
-    #[serde(default)]
-    pub detected_by: Vec<String>,
-    /// When classification ran.
-    #[serde(with = "super::serde_helpers::bson_datetime")]
-    pub detected_at: DateTime<Utc>,
-    /// Whether a human confirmed the suggestion.
-    #[serde(default)]
-    pub confirmed: bool,
-}
-
-/// Issue-tracker linkage, migrated from `TrackedRepository`'s `tracker_*` fields.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct IssueTrackerConfig {
-    /// The tracker platform.
-    pub tracker_type: Option<TrackerType>,
-    /// Tracker owner / organization.
-    pub owner: Option<String>,
-    /// Tracker repository / project.
-    pub repo: Option<String>,
-    /// Per-target tracker access token.
-    pub token: Option<String>,
-}
-
-/// How a target should be scanned.
-///
-/// `enabled_scans` / `disabled_scans` override the scan-applicability matrix
-/// defaults; the pentest and tracker blocks reuse the existing wizard config.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct TargetScanConfig {
-    /// Scans explicitly turned on (empty means "use matrix defaults").
-    #[serde(default)]
-    pub enabled_scans: Vec<ScanType>,
-    /// Scans explicitly turned off.
-    #[serde(default)]
-    pub disabled_scans: Vec<ScanType>,
-    /// Target environment (gates destructive / active testing).
-    #[serde(default)]
-    pub environment: Environment,
-    /// Whether destructive tests are permitted for this target.
-    #[serde(default)]
-    pub allow_destructive: bool,
-    /// Pentest strategy selector.
-    pub strategy: Option<PentestStrategy>,
-    /// Full pentest wizard configuration.
-    pub pentest: Option<PentestConfig>,
-    /// Issue-tracker linkage.
-    pub issue_tracker: Option<IssueTrackerConfig>,
-}
-
-/// A sibling product in the company suite that may already hold authoritative
-/// data for a target. compliance-scanner reconciles with these rather than
-/// recomputing what they already know.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ExternalSystem {
-    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
-    /// attestation).
-    Tramiton,
-    /// Code assistant (downstream remediation consumer).
-    Werkpilot,
-    /// Compliance-controls RAG (atomic controls derived from laws).
-    BreakpilotCompliance,
-}
-
-impl std::fmt::Display for ExternalSystem {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Tramiton => write!(f, "tramiton"),
-            Self::Werkpilot => write!(f, "werkpilot"),
-            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
-        }
-    }
-}
-
-/// A link from this target to a record in a sibling product, used to reconcile
-/// existing evidence instead of recomputing it.
-///
-/// For tramiton, `project_id` is the shared cross-product key and
-/// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
-/// (which equals tramiton's `Artifact.sha256`).
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ExternalRef {
-    /// Which sibling product this reference points at.
-    pub system: ExternalSystem,
-    /// The sibling product's project identifier, if known.
-    pub project_id: Option<String>,
-    /// Content digest of the subject artifact (firmware sha256), if known.
-    pub subject_sha256: Option<String>,
-    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
-    #[serde(default)]
-    pub status: String,
-    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
-    /// `LicenseGrant`), if the tenant provided one.
-    pub license_grant: Option<String>,
-    /// When evidence was last reconciled from this system.
-    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
-    pub last_reconciled_at: Option<DateTime<Utc>>,
-}
-
-impl ExternalRef {
-    /// A freshly linked (not yet reconciled) reference to a sibling system.
-    pub fn linked(system: ExternalSystem) -> Self {
-        Self {
-            system,
-            project_id: None,
-            subject_sha256: None,
-            status: "linked".to_string(),
-            license_grant: None,
-            last_reconciled_at: None,
-        }
-    }
-}
-
-/// A regulatory / standards framework a target must comply with. Drives which
-/// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum ComplianceFramework {
-    /// EU Cyber Resilience Act.
-    Cra,
-    /// IEC 62443 (industrial automation & control systems security).
-    Iec62443,
-    /// EU General Data Protection Regulation.
-    Gdpr,
-    /// SOC 2.
-    Soc2,
-    /// ISO/IEC 27001.
-    Iso27001,
-    /// EU Radio Equipment Directive (RED) cybersecurity articles.
-    RedDirective,
-}
-
-impl std::fmt::Display for ComplianceFramework {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Cra => write!(f, "cra"),
-            Self::Iec62443 => write!(f, "iec_62443"),
-            Self::Gdpr => write!(f, "gdpr"),
-            Self::Soc2 => write!(f, "soc2"),
-            Self::Iso27001 => write!(f, "iso_27001"),
-            Self::RedDirective => write!(f, "red_directive"),
-        }
-    }
-}
-
-/// The compliance scope of a target: which frameworks apply and, optionally, the
-/// jurisdiction. Captured at onboarding (with per-target-type defaults from
-/// [`default_compliance_profile`]).
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct ComplianceProfile {
-    /// Applicable frameworks.
-    #[serde(default)]
-    pub frameworks: Vec<ComplianceFramework>,
-    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
-    pub jurisdiction: Option<String>,
-}
-
-/// The sensible default compliance scope for a target type. Firmware / PLC /
-/// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
-pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
-    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
-    let frameworks = match target_type {
-        TargetType::PlcSps
-        | TargetType::FirmwareBareMetal
-        | TargetType::FirmwareRtos
-        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
-        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
-        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
-            vec![Gdpr, Cra]
-        }
-    };
-    ComplianceProfile {
-        frameworks,
-        jurisdiction: None,
-    }
-}
-
-/// A target onboarded for scanning: the unified replacement for the legacy
-/// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct OnboardedTarget {
-    /// Mongo id. Preserved from the legacy record during migration so every
-    /// downstream collection keyed by `repo_id` / `target_id` keeps resolving.
-    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
-    pub id: Option<bson::oid::ObjectId>,
-    /// Human-friendly name.
-    #[serde(default)]
-    pub name: String,
-    /// The software family this target belongs to.
-    pub target_type: TargetType,
-    /// Optional free-form description (also a classification input).
-    pub description: Option<String>,
-    /// The artifacts provided for this target.
-    #[serde(default)]
-    pub artifacts: Vec<Artifact>,
-    /// The classifier's verdict, once run.
-    pub classification: Option<Classification>,
-    /// How this target should be scanned.
-    #[serde(default)]
-    pub scan_config: TargetScanConfig,
-    /// The compliance scope (applicable frameworks / jurisdiction).
-    #[serde(default)]
-    pub compliance_profile: ComplianceProfile,
-    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
-    #[serde(default)]
-    pub external_refs: Vec<ExternalRef>,
-    /// Cron schedule for recurring scans, if any.
-    pub scan_schedule: Option<String>,
-    /// Whether inbound webhooks are enabled for this target.
-    #[serde(default)]
-    pub webhook_enabled: bool,
-    /// HMAC secret for verifying inbound webhooks.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub webhook_secret: Option<String>,
-    /// Cached count of findings across this target's scans.
-    #[serde(default)]
-    pub findings_count: u32,
-    /// Creation timestamp.
-    #[serde(
-        default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
-    )]
-    pub created_at: DateTime<Utc>,
-    /// Last-update timestamp.
-    #[serde(
-        default = "chrono::Utc::now",
-        with = "super::serde_helpers::bson_datetime"
-    )]
-    pub updated_at: DateTime<Utc>,
-}
-
-impl OnboardedTarget {
-    /// A new target of the given type with a freshly generated webhook secret.
-    pub fn new(name: String, target_type: TargetType) -> Self {
-        let now = Utc::now();
-        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
-        Self {
-            id: None,
-            name,
-            target_type,
-            description: None,
-            artifacts: Vec::new(),
-            classification: None,
-            scan_config: TargetScanConfig::default(),
-            compliance_profile: default_compliance_profile(target_type),
-            external_refs: Vec::new(),
-            scan_schedule: None,
-            webhook_enabled: false,
-            webhook_secret: Some(webhook_secret),
-            findings_count: 0,
-            created_at: now,
-            updated_at: now,
-        }
-    }
-
-    /// The first artifact of the given kind, if present.
-    pub fn first_of(&self, kind: ArtifactKind) -> Option<&Artifact> {
-        self.artifacts.iter().find(|a| a.kind == kind)
-    }
-
-    /// Whether the target has at least one artifact of the given kind.
-    pub fn has(&self, kind: ArtifactKind) -> bool {
-        self.artifacts.iter().any(|a| a.kind == kind)
-    }
-
-    /// The primary code artifact (git repo or source archive), if any.
-    pub fn code_artifact(&self) -> Option<&Artifact> {
-        self.artifacts
-            .iter()
-            .find(|a| matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive))
-    }
-
-    /// The live-URL artifact, if any.
-    pub fn live_url(&self) -> Option<&Artifact> {
-        self.first_of(ArtifactKind::LiveUrl)
-    }
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-
-    fn sample_target() -> OnboardedTarget {
-        let mut t = OnboardedTarget::new("acme-web".to_string(), TargetType::WebApp);
-        t.artifacts.push(Artifact::git_repo(
-            "https://git.example.com/acme.git",
-            "main",
-        ));
-        t.artifacts
-            .push(Artifact::live_url("https://acme.example.com"));
-        t
-    }
-
-    #[test]
-    fn onboarded_target_bson_round_trip() {
-        let t = sample_target();
-        let b = bson::to_bson(&t).expect("serialize");
-        let back: OnboardedTarget = bson::from_bson(b.clone()).expect("deserialize");
-        let b2 = bson::to_bson(&back).expect("re-serialize");
-        assert_eq!(b, b2);
-    }
-
-    #[test]
-    fn enum_display_is_snake_case() {
-        assert_eq!(
-            TargetType::FirmwareBareMetal.to_string(),
-            "firmware_bare_metal"
-        );
-        assert_eq!(TargetType::PlcSps.to_string(), "plc_sps");
-        assert_eq!(ArtifactKind::PlcProject.to_string(), "plc_project");
-        assert_eq!(ArtifactKind::MobilePackage.to_string(), "mobile_package");
-    }
-
-    #[test]
-    fn helpers_locate_artifacts() {
-        let t = sample_target();
-        assert!(t.has(ArtifactKind::GitRepo));
-        assert!(t.live_url().is_some());
-        assert!(t.code_artifact().is_some());
-        assert!(!t.has(ArtifactKind::FirmwareImage));
-        assert_eq!(
-            t.first_of(ArtifactKind::GitRepo).map(|a| a.kind),
-            Some(ArtifactKind::GitRepo)
-        );
-    }
-
-    #[test]
-    fn new_target_generates_webhook_secret() {
-        let t = OnboardedTarget::new("t".to_string(), TargetType::BackendService);
-        let secret = t.webhook_secret.expect("secret present");
-        assert_eq!(secret.len(), 32);
-        assert!(!secret.contains('-'));
-    }
-
-    #[test]
-    fn dast_auth_folds_into_artifact_auth() {
-        let dast = DastAuthConfig {
-            method: "bearer".to_string(),
-            login_url: Some("https://x/login".to_string()),
-            username: Some("user".to_string()),
-            password: Some("pw".to_string()),
-            token: Some("tok".to_string()),
-            headers: None,
-        };
-        let auth = ArtifactAuth::from(dast);
-        assert_eq!(auth.method, "bearer");
-        // Bearer token wins over password.
-        assert_eq!(auth.secret.as_deref(), Some("tok"));
-        assert_eq!(auth.login_url.as_deref(), Some("https://x/login"));
-    }
-
-    #[test]
-    fn each_artifact_gets_a_unique_id() {
-        let a = Artifact::firmware_image("fw.bin");
-        let b = Artifact::firmware_image("fw.bin");
-        assert_ne!(a.id, b.id);
-    }
-
-    #[test]
-    fn firmware_default_profile_is_cra_and_62443() {
-        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
-        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
-        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
-    }
-
-    #[test]
-    fn webapp_default_profile_is_gdpr_and_soc2() {
-        let p = default_compliance_profile(TargetType::WebApp);
-        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
-        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
-    }
-
-    #[test]
-    fn new_target_gets_default_profile_and_no_external_refs() {
-        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
-        assert!(!t.compliance_profile.frameworks.is_empty());
-        assert!(t.external_refs.is_empty());
-    }
-
-    #[test]
-    fn external_ref_linked_defaults() {
-        let r = ExternalRef::linked(ExternalSystem::Tramiton);
-        assert_eq!(r.system, ExternalSystem::Tramiton);
-        assert_eq!(r.status, "linked");
-        assert!(r.project_id.is_none());
-        assert!(r.last_reconciled_at.is_none());
-    }
-}
@@ -1,6 +1,8 @@
-use serde::{Deserialize, Serialize};
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Deserializer, Serialize};
+
+use super::issue::TrackerType;

-/// What initiated a scan.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum ScanTrigger {
@@ -8,3 +10,92 @@ pub enum ScanTrigger {
    Webhook,
    Manual,
 }
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TrackedRepository {
+    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
+    pub id: Option<bson::oid::ObjectId>,
+    #[serde(default)]
+    pub name: String,
+    #[serde(default)]
+    pub git_url: String,
+    #[serde(default = "default_branch")]
+    pub default_branch: String,
+    pub local_path: Option<String>,
+    pub scan_schedule: Option<String>,
+    #[serde(default)]
+    pub webhook_enabled: bool,
+    /// Auto-generated HMAC secret for verifying incoming webhooks
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webhook_secret: Option<String>,
+    pub tracker_type: Option<TrackerType>,
+    pub tracker_owner: Option<String>,
+    pub tracker_repo: Option<String>,
+    /// Optional per-repo PAT for the issue tracker (GitHub/GitLab/Jira)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tracker_token: Option<String>,
+    /// Optional auth token for HTTPS private repos (PAT or password)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auth_token: Option<String>,
+    /// Optional username for HTTPS auth (defaults to "x-access-token" for PATs)
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auth_username: Option<String>,
+    pub last_scanned_commit: Option<String>,
+    #[serde(default, deserialize_with = "deserialize_findings_count")]
+    pub findings_count: u32,
+    #[serde(
+        default = "chrono::Utc::now",
+        with = "super::serde_helpers::bson_datetime"
+    )]
+    pub created_at: DateTime<Utc>,
+    #[serde(
+        default = "chrono::Utc::now",
+        with = "super::serde_helpers::bson_datetime"
+    )]
+    pub updated_at: DateTime<Utc>,
+}
+
+fn default_branch() -> String {
+    "main".to_string()
+}
+
+fn deserialize_findings_count<'de, D>(deserializer: D) -> Result<u32, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let bson = bson::Bson::deserialize(deserializer)?;
+    match &bson {
+        bson::Bson::Int32(n) => Ok(*n as u32),
+        bson::Bson::Int64(n) => Ok(*n as u32),
+        bson::Bson::Double(n) => Ok(*n as u32),
+        _ => Ok(0),
+    }
+}
+
+impl TrackedRepository {
+    pub fn new(name: String, git_url: String) -> Self {
+        let now = Utc::now();
+        // Generate a random webhook secret (hex-encoded UUID v4, no dashes)
+        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
+        Self {
+            id: None,
+            name,
+            git_url,
+            default_branch: "main".to_string(),
+            local_path: None,
+            scan_schedule: None,
+            auth_token: None,
+            auth_username: None,
+            webhook_enabled: false,
+            webhook_secret: Some(webhook_secret),
+            tracker_type: None,
+            tracker_owner: None,
+            tracker_repo: None,
+            tracker_token: None,
+            last_scanned_commit: None,
+            findings_count: 0,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+}
@@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize};

 use super::repository::ScanTrigger;

-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
 pub enum ScanType {
    Sast,
@@ -16,14 +16,6 @@ pub enum ScanType {
    SecretDetection,
    Lint,
    CodeReview,
-    /// Static analysis of a firmware image (unpack + component CVE).
-    FirmwareStatic,
-    /// Control-logic security analysis of PLC / SPS programs.
-    PlcControlLogic,
-    /// Static analysis of a mobile package (APK / AAB / IPA).
-    MobileStatic,
-    /// Static analysis of a container image.
-    ContainerScan,
 }

 impl std::fmt::Display for ScanType {
@@ -39,10 +31,6 @@ impl std::fmt::Display for ScanType {
            Self::SecretDetection => write!(f, "secret_detection"),
            Self::Lint => write!(f, "lint"),
            Self::CodeReview => write!(f, "code_review"),
-            Self::FirmwareStatic => write!(f, "firmware_static"),
-            Self::PlcControlLogic => write!(f, "plc_control_logic"),
-            Self::MobileStatic => write!(f, "mobile_static"),
-            Self::ContainerScan => write!(f, "container_scan"),
        }
    }
 }
@@ -59,8 +47,6 @@ pub enum ScanRunStatus {
 #[serde(rename_all = "snake_case")]
 pub enum ScanPhase {
    ChangeDetection,
-    ArtifactIngest,
-    Classification,
    Sast,
    SbomGeneration,
    CveScanning,
@@ -69,10 +55,6 @@ pub enum ScanPhase {
    LintScanning,
    CodeReview,
    GraphBuilding,
-    FirmwareStatic,
-    PlcAnalysis,
-    MobileStatic,
-    ContainerScan,
    LlmTriage,
    IssueCreation,
    DastScanning,
@@ -1,379 +0,0 @@
-//! The scan-applicability matrix.
-//!
-//! Which scans are possible for a target is a function of its [`TargetType`] and
-//! which [`ArtifactKind`]s are actually present: SAST needs code, DAST needs a
-//! running URL, firmware-static analysis needs a firmware image, and so on. This
-//! module encodes that as a table — one rule set per target type — and resolves
-//! it against a concrete [`OnboardedTarget`] into a list of [`ScanOption`]s the
-//! onboarding wizard and the scan pipeline both consume.
-
-use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
-
-/// What an artifact a scan needs in order to run.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ArtifactRequirement {
-    /// Source code — a git repo or a source archive.
-    Code,
-    /// A reachable running instance (live URL / endpoint).
-    RunningUrl,
-    /// A firmware image / binary blob.
-    Firmware,
-    /// A PLC project (PLCopen XML or Structured Text).
-    Plc,
-    /// A mobile package (APK / AAB / IPA).
-    Mobile,
-    /// A container image.
-    Container,
-    /// No specific artifact required.
-    Any,
-}
-
-/// A static rule: this scan applies to a target type, needs this artifact, and
-/// defaults on/off. The rationale explains the entry to the user.
-#[derive(Debug, Clone, Copy)]
-pub struct ScanRule {
-    /// The scan this rule governs.
-    pub scan: ScanType,
-    /// Whether the scan is on by default (only when its artifact is present).
-    pub default_on: bool,
-    /// Human-readable explanation of what the scan does here.
-    pub rationale: &'static str,
-    /// The artifact the scan consumes.
-    pub requires: ArtifactRequirement,
-}
-
-impl ScanRule {
-    const fn new(
-        scan: ScanType,
-        default_on: bool,
-        rationale: &'static str,
-        requires: ArtifactRequirement,
-    ) -> Self {
-        Self {
-            scan,
-            default_on,
-            rationale,
-            requires,
-        }
-    }
-}
-
-/// A resolved scan choice for a specific target: a rule intersected with the
-/// artifacts actually present. `blocked_reason` is `Some` when the required
-/// artifact is missing.
-#[derive(Debug, Clone)]
-pub struct ScanOption {
-    /// The scan.
-    pub scan: ScanType,
-    /// Whether to pre-select the scan (false when blocked).
-    pub default_on: bool,
-    /// Why the scan is offered.
-    pub rationale: String,
-    /// The artifact kind the scan needs, if any specific one.
-    pub required_artifact: Option<ArtifactKind>,
-    /// Set when the required artifact is absent, explaining the block.
-    pub blocked_reason: Option<String>,
-}
-
-/// The SAST umbrella: every static-analysis sub-scan that runs over source code.
-fn sast_umbrella() -> Vec<ScanRule> {
-    use ArtifactRequirement::Code;
-    vec![
-        ScanRule::new(
-            ScanType::Sast,
-            true,
-            "Static analysis (Semgrep) over source",
-            Code,
-        ),
-        ScanRule::new(
-            ScanType::Sbom,
-            true,
-            "Software bill of materials from source",
-            Code,
-        ),
-        ScanRule::new(
-            ScanType::Cve,
-            true,
-            "Match dependencies against known CVEs",
-            Code,
-        ),
-        ScanRule::new(
-            ScanType::SecretDetection,
-            true,
-            "Scan source for committed secrets",
-            Code,
-        ),
-        ScanRule::new(ScanType::Lint, true, "Language linters over source", Code),
-        ScanRule::new(
-            ScanType::Gdpr,
-            true,
-            "GDPR data-handling pattern checks",
-            Code,
-        ),
-        ScanRule::new(
-            ScanType::OAuth,
-            true,
-            "OAuth misconfiguration patterns",
-            Code,
-        ),
-        ScanRule::new(
-            ScanType::Graph,
-            true,
-            "Build the code graph for impact analysis",
-            Code,
-        ),
-        ScanRule::new(
-            ScanType::CodeReview,
-            false,
-            "LLM code review over changed source",
-            Code,
-        ),
-    ]
-}
-
-/// The rule set for a target type. Scans that are never applicable to a type are
-/// simply absent (e.g. DAST is not listed for a PLC target).
-pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
-    use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
-    match target_type {
-        TargetType::WebApp | TargetType::BackendService => {
-            let mut r = sast_umbrella();
-            r.push(ScanRule::new(
-                ScanType::Dast,
-                true,
-                "Dynamic scan of the running endpoint",
-                RunningUrl,
-            ));
-            r
-        }
-        TargetType::DesktopApp => sast_umbrella(),
-        TargetType::AndroidApp | TargetType::IosApp => {
-            let mut r = sast_umbrella();
-            r.push(ScanRule::new(
-                ScanType::MobileStatic,
-                true,
-                "Static analysis of the mobile package (manifest, permissions, libs)",
-                Mobile,
-            ));
-            r
-        }
-        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos => {
-            let mut r = sast_umbrella();
-            r.push(ScanRule::new(
-                ScanType::FirmwareStatic,
-                true,
-                "Unpack and statically analyze the firmware image",
-                Firmware,
-            ));
-            r.push(ScanRule::new(
-                ScanType::Sbom,
-                true,
-                "SBOM from the firmware image (binwalk / tramiton)",
-                Firmware,
-            ));
-            r.push(ScanRule::new(
-                ScanType::Cve,
-                true,
-                "Match firmware components against known CVEs",
-                Firmware,
-            ));
-            r
-        }
-        TargetType::EmbeddedLinuxYocto => {
-            let mut r = sast_umbrella();
-            r.push(ScanRule::new(
-                ScanType::FirmwareStatic,
-                true,
-                "EMBA / binwalk static analysis of the image",
-                Firmware,
-            ));
-            r.push(ScanRule::new(
-                ScanType::Sbom,
-                true,
-                "SBOM from image layers / recipes",
-                Firmware,
-            ));
-            r.push(ScanRule::new(
-                ScanType::Cve,
-                true,
-                "Match image components against known CVEs",
-                Firmware,
-            ));
-            r.push(ScanRule::new(
-                ScanType::Dast,
-                false,
-                "Dynamic scan of exposed network services (if any)",
-                RunningUrl,
-            ));
-            r
-        }
-        TargetType::PlcSps => vec![ScanRule::new(
-            ScanType::PlcControlLogic,
-            true,
-            "Control-logic security rules over the PLC program",
-            Plc,
-        )],
-    }
-}
-
-/// Whether an active penetration test is applicable to this target type.
-///
-/// Pentest runs as its own session (not a [`ScanType`] scan) and needs a
-/// reachable running target, so it is offered only for the network-reachable
-/// families.
-pub fn supports_pentest(target_type: TargetType) -> bool {
-    matches!(
-        target_type,
-        TargetType::WebApp
-            | TargetType::BackendService
-            | TargetType::AndroidApp
-            | TargetType::IosApp
-            | TargetType::EmbeddedLinuxYocto
-    )
-}
-
-/// The representative artifact kind a requirement is satisfied by.
-fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
-    match req {
-        ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
-        ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
-        ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
-        ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
-        ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
-        ArtifactRequirement::Container => Some(ArtifactKind::ContainerImage),
-        ArtifactRequirement::Any => None,
-    }
-}
-
-/// Whether the target carries an artifact that satisfies the requirement.
-fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
-    match req {
-        ArtifactRequirement::Code => target.code_artifact().is_some(),
-        ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
-        ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
-        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
-        ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
-        ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
-        ArtifactRequirement::Any => true,
-    }
-}
-
-/// Resolve the matrix for a concrete target into the scans it can run, marking
-/// any whose required artifact is missing as blocked.
-pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
-    rules_for(target.target_type)
-        .into_iter()
-        .map(|rule| {
-            let satisfied = requirement_satisfied(rule.requires, target);
-            let required_artifact = representative_kind(rule.requires);
-            let blocked_reason = if satisfied {
-                None
-            } else {
-                Some(match required_artifact {
-                    Some(kind) => format!("no {kind} artifact provided"),
-                    None => "required artifact missing".to_string(),
-                })
-            };
-            ScanOption {
-                scan: rule.scan,
-                default_on: rule.default_on && satisfied,
-                rationale: rule.rationale.to_string(),
-                required_artifact,
-                blocked_reason,
-            }
-        })
-        .collect()
-}
-
-#[cfg(test)]
-#[allow(clippy::expect_used, clippy::unwrap_used)]
-mod tests {
-    use super::*;
-    use crate::models::{Artifact, PlcFormat};
-
-    fn target_with(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
-        let mut t = OnboardedTarget::new("t".to_string(), target_type);
-        t.artifacts = artifacts;
-        t
-    }
-
-    fn option<'a>(opts: &'a [ScanOption], scan: ScanType) -> Option<&'a ScanOption> {
-        opts.iter().find(|o| o.scan == scan)
-    }
-
-    #[test]
-    fn webapp_with_code_and_url_offers_sast_and_dast() {
-        let t = target_with(
-            TargetType::WebApp,
-            vec![
-                Artifact::git_repo("u", "main"),
-                Artifact::live_url("http://x"),
-            ],
-        );
-        let opts = applicable_scans(&t);
-        let sast = option(&opts, ScanType::Sast).expect("sast offered");
-        assert!(sast.default_on && sast.blocked_reason.is_none());
-        let dast = option(&opts, ScanType::Dast).expect("dast offered");
-        assert!(dast.default_on && dast.blocked_reason.is_none());
-    }
-
-    #[test]
-    fn webapp_without_url_blocks_dast() {
-        let t = target_with(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
-        let opts = applicable_scans(&t);
-        let dast = option(&opts, ScanType::Dast).expect("dast listed");
-        assert!(!dast.default_on);
-        assert!(dast.blocked_reason.is_some());
-        assert_eq!(dast.required_artifact, Some(ArtifactKind::LiveUrl));
-    }
-
-    #[test]
-    fn firmware_offers_firmware_static_and_not_dast() {
-        let t = target_with(
-            TargetType::FirmwareBareMetal,
-            vec![Artifact::firmware_image("fw.bin")],
-        );
-        let opts = applicable_scans(&t);
-        let fw = option(&opts, ScanType::FirmwareStatic).expect("firmware static offered");
-        assert!(fw.default_on && fw.blocked_reason.is_none());
-        assert!(option(&opts, ScanType::Dast).is_none());
-    }
-
-    #[test]
-    fn plc_offers_only_control_logic() {
-        let t = target_with(
-            TargetType::PlcSps,
-            vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
-        );
-        let opts = applicable_scans(&t);
-        assert_eq!(opts.len(), 1);
-        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
-        assert!(opts[0].default_on);
-    }
-
-    #[test]
-    fn pentest_support_matches_reachable_families() {
-        assert!(supports_pentest(TargetType::WebApp));
-        assert!(supports_pentest(TargetType::BackendService));
-        assert!(!supports_pentest(TargetType::PlcSps));
-        assert!(!supports_pentest(TargetType::FirmwareBareMetal));
-        assert!(!supports_pentest(TargetType::DesktopApp));
-    }
-
-    #[test]
-    fn every_target_type_has_at_least_one_rule() {
-        for tt in [
-            TargetType::WebApp,
-            TargetType::BackendService,
-            TargetType::DesktopApp,
-            TargetType::AndroidApp,
-            TargetType::IosApp,
-            TargetType::FirmwareBareMetal,
-            TargetType::FirmwareRtos,
-            TargetType::EmbeddedLinuxYocto,
-            TargetType::PlcSps,
-        ] {
-            assert!(!rules_for(tt).is_empty(), "{tt} has no rules");
-        }
-    }
-}
@@ -1,51 +0,0 @@
-//! The target-classification port.
-//!
-//! A [`TargetClassifier`] inspects a target's artifacts (and optionally their
-//! ingested working directories) and proposes one or more [`ClassifierVerdict`]s
-//! — a target type, a confidence, and the facts the decision rested on. Concrete
-//! classifiers live in the agent (language/build-system fingerprinting, a
-//! firmware detector backed by tramiton, etc.); a registry merges and ranks
-//! their verdicts. This mirrors the [`crate::traits::Scanner`] port so the two
-//! read the same way.
-
-use std::collections::HashMap;
-use std::path::PathBuf;
-
-use crate::error::CoreError;
-use crate::models::{Artifact, DetectedFact, TargetType};
-
-/// Everything a classifier needs to reason about a target.
-pub struct ClassificationInput<'a> {
-    /// The artifacts declared for the target.
-    pub artifacts: &'a [Artifact],
-    /// Ingested working paths, keyed by [`Artifact::id`]. Absent for artifacts
-    /// with no on-disk form (e.g. a live URL).
-    pub working_paths: &'a HashMap<String, PathBuf>,
-    /// Free-form description of the target, if provided.
-    pub description: Option<&'a str>,
-}
-
-/// A single classifier's proposal for a target.
-pub struct ClassifierVerdict {
-    /// The proposed target type.
-    pub target_type: TargetType,
-    /// Confidence in `[0.0, 1.0]`.
-    pub confidence: f32,
-    /// Facts that informed the proposal.
-    pub facts: Vec<DetectedFact>,
-    /// Human-readable explanation.
-    pub rationale: String,
-}
-
-/// A source of target-type classification.
-#[allow(async_fn_in_trait)]
-pub trait TargetClassifier: Send + Sync {
-    /// Stable identifier for this classifier (recorded in `detected_by`).
-    fn name(&self) -> &str;
-
-    /// Propose zero or more ranked verdicts for the given input.
-    async fn classify(
-        &self,
-        input: &ClassificationInput<'_>,
-    ) -> Result<Vec<ClassifierVerdict>, CoreError>;
-}
@@ -1,45 +0,0 @@
-//! The compliance-controls provider port.
-//!
-//! The mapping engine turns findings into compliance status against a corpus of
-//! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
-//! a tenant-owned RAG of atomic controls derived from laws
-//! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
-//! source so the mapping engine does not hardcode a catalog.
-
-use crate::error::CoreError;
-use crate::models::ComplianceFramework;
-
-/// A control retrieved from a controls corpus.
-#[derive(Debug, Clone)]
-pub struct Control {
-    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
-    pub id: String,
-    /// The framework this control belongs to.
-    pub framework: ComplianceFramework,
-    /// Short human-readable title.
-    pub title: String,
-    /// The control text / requirement.
-    pub text: String,
-    /// Free-form source reference (catalog name, law citation, ...).
-    pub source: Option<String>,
-}
-
-/// A query for relevant controls.
-pub struct ControlQuery<'a> {
-    /// Frameworks in scope for the target.
-    pub frameworks: &'a [ComplianceFramework],
-    /// Free-text describing what to map (a finding summary, a component, ...).
-    pub context: &'a str,
-    /// Maximum number of controls to return.
-    pub limit: usize,
-}
-
-/// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
-#[allow(async_fn_in_trait)]
-pub trait ControlsProvider: Send + Sync {
-    /// Stable identifier for this provider.
-    fn name(&self) -> &str;
-
-    /// Retrieve the controls most relevant to the query.
-    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
-}
@@ -1,58 +0,0 @@
-//! The external-evidence provider port.
-//!
-//! A sibling product (tramiton, for firmware) may already hold authoritative
-//! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
-//! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
-//! reproducible-build lock, an attestation — instead of recomputing it. The key
-//! used to match is the artifact content digest (a firmware sha256, which equals
-//! [`crate::models::Artifact::content_hash`]).
-//!
-//! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
-//! client later) plus a deterministic mock for tests, so nothing here depends on
-//! an external binary.
-
-use std::path::Path;
-
-use crate::error::CoreError;
-use crate::models::{Artifact, ExternalSystem};
-
-/// A single reconcilable evidence document fetched from a sibling product.
-#[derive(Debug, Clone)]
-pub struct EvidenceDocument {
-    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
-    pub kind: String,
-    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
-    pub format: String,
-    /// The raw document payload.
-    pub content: String,
-}
-
-/// The evidence a provider could return for a target's artifact.
-#[derive(Debug, Clone, Default)]
-pub struct ReconciledEvidence {
-    /// The sibling's project identifier, if resolved.
-    pub project_id: Option<String>,
-    /// The subject content digest the evidence pertains to.
-    pub subject_sha256: Option<String>,
-    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
-    pub documents: Vec<EvidenceDocument>,
-}
-
-/// A source of externally-held, reconcilable evidence for an artifact.
-#[allow(async_fn_in_trait)]
-pub trait EvidenceProvider: Send + Sync {
-    /// Which sibling product this provider integrates.
-    fn system(&self) -> ExternalSystem;
-
-    /// Whether this provider can handle the given artifact + working path
-    /// (e.g. tramiton handles firmware images / embedded source trees).
-    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
-
-    /// Reconcile existing evidence for the artifact, keyed by its content digest.
-    /// Returns `Ok(None)` when the provider has nothing for this artifact.
-    async fn reconcile(
-        &self,
-        artifact: &Artifact,
-        working_path: Option<&Path>,
-    ) -> Result<Option<ReconciledEvidence>, CoreError>;
-}
@@ -1,16 +1,10 @@
-pub mod classifier;
-pub mod controls;
 pub mod dast_agent;
-pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;

-pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
-pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
-pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};
@@ -10,10 +10,8 @@ pub enum Route {
    #[layout(AppShell)]
        #[route("/")]
        OverviewPage {},
-        #[route("/targets")]
-        TargetsPage {},
-        #[route("/onboard")]
-        OnboardingPage {},
+        #[route("/repositories")]
+        RepositoriesPage {},
        #[route("/findings")]
        FindingsPage {},
        #[route("/findings/:id")]
@@ -46,8 +44,6 @@ pub enum Route {
        PentestSessionPage { session_id: String },
        #[route("/mcp-servers")]
        McpServersPage {},
-        #[route("/mcp-tokens")]
-        McpTokensPage {},
 }

 const FAVICON: Asset = asset!("/assets/favicon.svg");
@@ -4,9 +4,8 @@ use dioxus_free_icons::Icon;

 use crate::app::Route;
 use crate::infrastructure::dast::fetch_dast_targets;
-use crate::infrastructure::onboarding::fetch_targets;
 use crate::infrastructure::pentest::{create_pentest_session_wizard, lookup_repo_by_url};
-use crate::infrastructure::repositories::fetch_ssh_public_key;
+use crate::infrastructure::repositories::{fetch_repositories, fetch_ssh_public_key};

 const DISCLAIMER_TEXT: &str = "I confirm that I have authorization to perform security testing \
 against the specified target. I understand that penetration testing may cause disruption to the \
@@ -40,7 +39,7 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
    let mut show_target_dropdown = use_signal(|| false);
    let mut show_repo_dropdown = use_signal(|| false);
    let existing_targets = use_resource(|| async { fetch_dast_targets().await.ok() });
-    let existing_repos = use_resource(|| async { fetch_targets().await.ok() });
+    let existing_repos = use_resource(|| async { fetch_repositories(1).await.ok() });

    // SSH key state for private repos
    let mut ssh_public_key = use_signal(String::new);
@@ -212,25 +211,7 @@ pub fn PentestWizard(show: Signal<bool>) -> Element {
            Some(Some(data)) => data
                .data
                .iter()
-                .filter_map(|t| {
-                    let name = t
-                        .get("name")
-                        .and_then(|v| v.as_str())
-                        .unwrap_or_default()
-                        .to_string();
-                    let git_url = t
-                        .get("artifacts")
-                        .and_then(|a| a.as_array())
-                        .and_then(|arr| {
-                            arr.iter().find(|a| {
-                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
-                            })
-                        })
-                        .and_then(|a| a.get("source_ref"))
-                        .and_then(|s| s.as_str())?
-                        .to_string();
-                    Some((git_url, name))
-                })
+                .map(|r| (r.git_url.clone(), r.name.clone()))
                .collect(),
            _ => Vec::new(),
        }
@@ -24,15 +24,10 @@ pub fn Sidebar() -> Element {
            icon: rsx! { Icon { icon: BsSpeedometer2, width: 18, height: 18 } },
        },
        NavItem {
-            label: "Targets",
-            route: Route::TargetsPage {},
+            label: "Repositories",
+            route: Route::RepositoriesPage {},
            icon: rsx! { Icon { icon: BsFolder2Open, width: 18, height: 18 } },
        },
-        NavItem {
-            label: "Onboard",
-            route: Route::OnboardingPage {},
-            icon: rsx! { Icon { icon: BsPlusCircle, width: 18, height: 18 } },
-        },
        NavItem {
            label: "Findings",
            route: Route::FindingsPage {},
@@ -19,6 +19,10 @@ impl Database {
        Ok(Self { inner: db })
    }

+    pub fn repositories(&self) -> Collection<TrackedRepository> {
+        self.inner.collection("repositories")
+    }
+
    pub fn findings(&self) -> Collection<Finding> {
        self.inner.collection("findings")
    }
@@ -1,90 +0,0 @@
-//! Server-functions for the MCP-tokens management UI.
-//!
-//! These wrap the agent's `/api/v1/mcp-tokens` CRUD endpoints. The raw
-//! token returned by `create_mcp_token` is only visible at creation
-//! time — the agent's storage never holds the plaintext.
-
-use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct McpTokenView {
-    pub id: String,
-    pub name: String,
-    pub token_prefix: String,
-    pub created_by: String,
-    pub created_at: serde_json::Value,
-    #[serde(default)]
-    pub last_used_at: Option<serde_json::Value>,
-    #[serde(default)]
-    pub revoked: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct McpTokensListResponse {
-    pub data: Vec<McpTokenView>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct CreateMcpTokenResponse {
-    /// Raw token. Shown ONCE — the user must copy it now.
-    pub token: String,
-    pub view: McpTokenView,
-}
-
-#[server]
-pub async fn fetch_mcp_tokens() -> Result<McpTokensListResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get("/api/v1/mcp-tokens")
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let body: McpTokensListResponse = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    Ok(body)
-}
-
-#[server]
-pub async fn create_mcp_token(name: String) -> Result<CreateMcpTokenResponse, ServerFnError> {
-    if name.trim().is_empty() {
-        return Err(ServerFnError::new("Name is required"));
-    }
-    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/mcp-tokens")
-        .await?
-        .json(&serde_json::json!({ "name": name.trim() }))
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    if !resp.status().is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to create token: {body}"
-        )));
-    }
-    let body: CreateMcpTokenResponse = resp
-        .json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    Ok(body)
-}
-
-#[server]
-pub async fn revoke_mcp_token(id: String) -> Result<(), ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::DELETE,
-        &format!("/api/v1/mcp-tokens/{id}"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    if !resp.status().is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        return Err(ServerFnError::new(format!(
-            "Failed to revoke token: {body}"
-        )));
-    }
-    Ok(())
-}
@@ -8,9 +8,7 @@ pub mod graph;
 pub mod help_chat;
 pub mod issues;
 pub mod mcp;
-pub mod mcp_tokens;
 pub mod notifications;
-pub mod onboarding;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
 pub mod repositories;
@@ -1,227 +0,0 @@
-//! Server functions for the onboarding wizard — proxy to the agent's
-//! `/api/v1/targets` endpoints.
-
-use dioxus::prelude::*;
-use serde::{Deserialize, Serialize};
-
-/// One artifact the wizard collects for a target.
-#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq)]
-pub struct ArtifactInputDto {
-    pub kind: String,
-    pub source_ref: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub branch: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub plc_format: Option<String>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct TargetsResponse {
-    pub data: Vec<serde_json::Value>,
-    pub total: Option<u64>,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct TargetResponse {
-    pub data: serde_json::Value,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ApplicableScansData {
-    #[serde(default)]
-    pub scans: Vec<serde_json::Value>,
-    #[serde(default)]
-    pub pentest_supported: bool,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
-pub struct ApplicableScansResponse {
-    pub data: ApplicableScansData,
-}
-
-/// Validate a target name. The name is used as the clone directory downstream,
-/// so it must be a single safe segment (no slashes) and free of stray spaces.
-pub fn validate_target_name(name: &str) -> Option<String> {
-    let n = name.trim();
-    if n.is_empty() {
-        return Some("Enter a name".to_string());
-    }
-    if name != n {
-        return Some("Remove the leading/trailing spaces".to_string());
-    }
-    if n.contains('/') || n.contains('\\') {
-        return Some("No slashes — the name becomes a folder (e.g. stm32f411-blinky)".to_string());
-    }
-    None
-}
-
-/// Client-side validation of an artifact reference for its kind. Returns an
-/// error message when the value is obviously wrong for its category, so the
-/// wizard / editor can flag it up front instead of the scan discovering it.
-pub fn validate_artifact_ref(kind: &str, source_ref: &str) -> Option<String> {
-    let s = source_ref;
-    if s.trim().is_empty() {
-        return Some("Cannot be empty".to_string());
-    }
-    if s != s.trim() {
-        return Some("Remove the leading/trailing spaces".to_string());
-    }
-    let no_space = !s.contains(char::is_whitespace);
-    match kind {
-        "git_repo" => {
-            let looks_git = s.starts_with("https://")
-                || s.starts_with("http://")
-                || s.starts_with("ssh://")
-                || s.starts_with("git://")
-                || (s.contains('@') && s.contains(':'));
-            (!(looks_git && no_space))
-                .then(|| "Enter a git URL — https://…, ssh://…, or git@host:path".to_string())
-        }
-        "live_url" => {
-            let ok = (s.starts_with("https://") || s.starts_with("http://")) && no_space;
-            (!ok).then(|| "Enter an http(s) URL, e.g. https://app.example.com".to_string())
-        }
-        "container_image" => {
-            (!no_space).then(|| "Enter an image ref, e.g. registry/name:tag".to_string())
-        }
-        "source_archive" | "firmware_image" | "mobile_package" | "plc_project" => {
-            (!no_space).then(|| "Enter a path or URL (no spaces)".to_string())
-        }
-        // plaintext_description (and anything unknown): accept free-form text.
-        _ => None,
-    }
-}
-
-/// List onboarded targets.
-#[server]
-pub async fn fetch_targets() -> Result<TargetsResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get("/api/v1/targets")
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Create a target with the collected artifacts.
-#[server]
-pub async fn create_target(
-    name: String,
-    target_type: String,
-    description: Option<String>,
-    artifacts: Vec<ArtifactInputDto>,
-) -> Result<TargetResponse, ServerFnError> {
-    let body = serde_json::json!({
-        "name": name,
-        "target_type": target_type,
-        "description": description,
-        "artifacts": artifacts,
-    });
-    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/targets")
-        .await?
-        .json(&body)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Update a target's name / type / artifacts (dashboard editor).
-#[server]
-pub async fn update_target(
-    id: String,
-    name: Option<String>,
-    target_type: Option<String>,
-    artifacts: Option<Vec<ArtifactInputDto>>,
-) -> Result<TargetResponse, ServerFnError> {
-    let mut body = serde_json::Map::new();
-    if let Some(n) = name {
-        body.insert("name".to_string(), serde_json::json!(n));
-    }
-    if let Some(t) = target_type {
-        body.insert("target_type".to_string(), serde_json::json!(t));
-    }
-    if let Some(a) = artifacts {
-        body.insert(
-            "artifacts".to_string(),
-            serde_json::to_value(a).map_err(|e| ServerFnError::new(e.to_string()))?,
-        );
-    }
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::PATCH,
-        &format!("/api/v1/targets/{id}"),
-    )
-    .await?
-    .json(&serde_json::Value::Object(body))
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Run kind-based classification on a target.
-#[server]
-pub async fn detect_target(id: String) -> Result<TargetResponse, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/detect"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Fetch the scan-applicability matrix for a target.
-#[server]
-pub async fn fetch_applicable_scans(id: String) -> Result<ApplicableScansResponse, ServerFnError> {
-    let resp = super::agent_client::agent_get(&format!("/api/v1/targets/{id}/applicable-scans"))
-        .await?
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Delete a target (and cascade its findings / SBOM / scan runs / CVE alerts).
-#[server]
-pub async fn delete_target(id: String) -> Result<serde_json::Value, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::DELETE,
-        &format!("/api/v1/targets/{id}"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
-
-/// Trigger a scan for a target.
-#[server]
-pub async fn trigger_target_scan(id: String) -> Result<serde_json::Value, ServerFnError> {
-    let resp = super::agent_client::agent_request(
-        reqwest::Method::POST,
-        &format!("/api/v1/targets/{id}/scan"),
-    )
-    .await?
-    .send()
-    .await
-    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    resp.json()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))
-}
@@ -1,10 +1,145 @@
-//! The agent's SSH deploy public key — shown so a read-only deploy key can be
-//! added to private git targets. (The legacy repositories CRUD moved to the
-//! unified onboarding/targets API.)
-
 use dioxus::prelude::*;
+use serde::{Deserialize, Serialize};
+
+use compliance_core::models::TrackedRepository;
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct RepositoryListResponse {
+    pub data: Vec<TrackedRepository>,
+    pub total: Option<u64>,
+    pub page: Option<u64>,
+}
+
+#[server]
+pub async fn fetch_repositories(page: u64) -> Result<RepositoryListResponse, ServerFnError> {
+    let path = format!("/api/v1/repositories?page={page}&limit=20");
+    let resp = super::agent_client::agent_get(&path)
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: RepositoryListResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+#[server]
+pub async fn add_repository(
+    name: String,
+    git_url: String,
+    default_branch: String,
+    auth_token: Option<String>,
+    auth_username: Option<String>,
+    tracker_type: Option<String>,
+    tracker_owner: Option<String>,
+    tracker_repo: Option<String>,
+    tracker_token: Option<String>,
+) -> Result<(), ServerFnError> {
+    let mut body = serde_json::json!({
+        "name": name,
+        "git_url": git_url,
+        "default_branch": default_branch,
+    });
+    if let Some(token) = auth_token.filter(|t| !t.is_empty()) {
+        body["auth_token"] = serde_json::Value::String(token);
+    }
+    if let Some(username) = auth_username.filter(|u| !u.is_empty()) {
+        body["auth_username"] = serde_json::Value::String(username);
+    }
+    if let Some(tt) = tracker_type.filter(|t| !t.is_empty()) {
+        body["tracker_type"] = serde_json::Value::String(tt);
+    }
+    if let Some(to) = tracker_owner.filter(|t| !t.is_empty()) {
+        body["tracker_owner"] = serde_json::Value::String(to);
+    }
+    if let Some(tr) = tracker_repo.filter(|t| !t.is_empty()) {
+        body["tracker_repo"] = serde_json::Value::String(tr);
+    }
+    if let Some(tk) = tracker_token.filter(|t| !t.is_empty()) {
+        body["tracker_token"] = serde_json::Value::String(tk);
+    }
+
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/repositories")
+        .await?
+        .json(&body)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    if !resp.status().is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to add repository: {body}"
+        )));
+    }
+
+    Ok(())
+}
+
+#[server]
+pub async fn update_repository(
+    repo_id: String,
+    name: Option<String>,
+    default_branch: Option<String>,
+    auth_token: Option<String>,
+    auth_username: Option<String>,
+    tracker_type: Option<String>,
+    tracker_owner: Option<String>,
+    tracker_repo: Option<String>,
+    tracker_token: Option<String>,
+    scan_schedule: Option<String>,
+) -> Result<(), ServerFnError> {
+    let mut body = serde_json::Map::new();
+    if let Some(v) = name.filter(|s| !s.is_empty()) {
+        body.insert("name".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = default_branch.filter(|s| !s.is_empty()) {
+        body.insert("default_branch".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = auth_token {
+        body.insert("auth_token".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = auth_username {
+        body.insert("auth_username".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_type {
+        body.insert("tracker_type".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_owner {
+        body.insert("tracker_owner".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_repo {
+        body.insert("tracker_repo".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = tracker_token {
+        body.insert("tracker_token".into(), serde_json::Value::String(v));
+    }
+    if let Some(v) = scan_schedule {
+        body.insert("scan_schedule".into(), serde_json::Value::String(v));
+    }
+
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::PATCH,
+        &format!("/api/v1/repositories/{repo_id}"),
+    )
+    .await?
+    .json(&body)
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    if !resp.status().is_success() {
+        let text = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to update repository: {text}"
+        )));
+    }
+
+    Ok(())
+}

-/// Fetch the agent's SSH deploy public key.
 #[server]
 pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
    let resp = super::agent_client::agent_get("/api/v1/settings/ssh-public-key")
@@ -28,3 +163,86 @@ pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
        .unwrap_or("")
        .to_string())
 }
+
+#[server]
+pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::DELETE,
+        &format!("/api/v1/repositories/{repo_id}"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    if !resp.status().is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to delete repository: {body}"
+        )));
+    }
+
+    Ok(())
+}
+
+#[server]
+pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
+    super::agent_client::agent_request(
+        reqwest::Method::POST,
+        &format!("/api/v1/repositories/{repo_id}/scan"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    Ok(())
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct WebhookConfigResponse {
+    pub webhook_secret: Option<String>,
+    pub tracker_type: String,
+}
+
+#[server]
+pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
+    let resp =
+        super::agent_client::agent_get(&format!("/api/v1/repositories/{repo_id}/webhook-config"))
+            .await?
+            .send()
+            .await
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: WebhookConfigResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+/// Check if a repository has any running scans
+#[server]
+pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {
+    let resp = super::agent_client::agent_get("/api/v1/scan-runs?page=1&limit=1")
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: serde_json::Value = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+
+    // Check if the most recent scan for this repo is still running
+    if let Some(scans) = body.get("data").and_then(|d| d.as_array()) {
+        for scan in scans {
+            let scan_repo = scan.get("repo_id").and_then(|v| v.as_str()).unwrap_or("");
+            let status = scan.get("status").and_then(|v| v.as_str()).unwrap_or("");
+            if scan_repo == repo_id && status == "running" {
+                return Ok(true);
+            }
+        }
+    }
+
+    Ok(false)
+}
@@ -2,11 +2,11 @@ use dioxus::prelude::*;

 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::fetch_targets;
+use crate::infrastructure::repositories::fetch_repositories;

 #[component]
 pub fn ChatIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_targets().await.ok() });
+    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });

    rsx! {
        PageHeader {
@@ -28,32 +28,10 @@ pub fn ChatIndexPage() -> Element {
                        div { class: "graph-index-grid",
                            for repo in repo_list {
                                {
-                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
-                                    let url = repo
-                                        .get("artifacts")
-                                        .and_then(|a| a.as_array())
-                                        .and_then(|arr| {
-                                            arr.iter().find(|a| {
-                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
-                                            })
-                                        })
-                                        .and_then(|a| a.get("source_ref"))
-                                        .and_then(|s| s.as_str())
-                                        .unwrap_or_default()
-                                        .to_string();
-                                    let branch = repo
-                                        .get("artifacts")
-                                        .and_then(|a| a.as_array())
-                                        .and_then(|arr| {
-                                            arr.iter().find_map(|a| {
-                                                a.get("git")
-                                                    .and_then(|g| g.get("default_branch"))
-                                                    .and_then(|b| b.as_str())
-                                            })
-                                        })
-                                        .unwrap_or("main")
-                                        .to_string();
+                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+                                    let name = repo.name.clone();
+                                    let url = repo.git_url.clone();
+                                    let branch = repo.default_branch.clone();
                                    rsx! {
                                        Link {
                                            to: Route::ChatPage { repo_id },
@@ -20,7 +20,7 @@ pub fn FindingsPage() -> Element {
    let mut selected_ids = use_signal(Vec::<String>::new);

    let repos = use_resource(|| async {
-        crate::infrastructure::onboarding::fetch_targets()
+        crate::infrastructure::repositories::fetch_repositories(1)
            .await
            .ok()
    });
@@ -86,14 +86,14 @@ pub fn FindingsPage() -> Element {
            }
            select {
                onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                option { value: "", "All Targets" }
+                option { value: "", "All Repositories" }
                {
                    match &*repos.read() {
                        Some(Some(resp)) => rsx! {
-                            for t in &resp.data {
+                            for repo in &resp.data {
                                {
-                                    let id = t.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                    let name = t.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                    let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
+                                    let name = repo.name.clone();
                                    rsx! {
                                        option { value: "{id}", "{name}" }
                                    }
@@ -2,11 +2,11 @@ use dioxus::prelude::*;

 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::fetch_targets;
+use crate::infrastructure::repositories::fetch_repositories;

 #[component]
 pub fn GraphIndexPage() -> Element {
-    let repos = use_resource(|| async { fetch_targets().await.ok() });
+    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });

    rsx! {
        PageHeader {
@@ -28,34 +28,27 @@ pub fn GraphIndexPage() -> Element {
                        div { class: "graph-index-grid",
                            for repo in repo_list {
                                {
-                                    let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                    let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
-                                    let url = repo
-                                        .get("artifacts")
-                                        .and_then(|a| a.as_array())
-                                        .and_then(|arr| {
-                                            arr.iter().find(|a| {
-                                                a.get("kind").and_then(|k| k.as_str()) == Some("git_repo")
-                                            })
-                                        })
-                                        .and_then(|a| a.get("source_ref"))
-                                        .and_then(|s| s.as_str())
-                                        .unwrap_or_default()
-                                        .to_string();
-                                    let branch = repo
-                                        .get("artifacts")
-                                        .and_then(|a| a.as_array())
-                                        .and_then(|arr| {
-                                            arr.iter().find_map(|a| {
-                                                a.get("git")
-                                                    .and_then(|g| g.get("default_branch"))
-                                                    .and_then(|b| b.as_str())
-                                            })
-                                        })
-                                        .unwrap_or("main")
-                                        .to_string();
-                                    let findings = repo.get("findings_count").and_then(|n| n.as_u64()).unwrap_or(0);
+                                    let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+                                    let name = repo.name.clone();
+                                    let url = repo.git_url.clone();
+                                    let branch = repo.default_branch.clone();
+                                    let findings = repo.findings_count;
                                    let findings_label = if findings != 1 { format!("{findings} findings") } else { "1 finding".to_string() };
+                                    let updated = {
+                                        let now = chrono::Utc::now();
+                                        let diff = now.signed_duration_since(repo.updated_at);
+                                        if diff.num_minutes() < 1 {
+                                            "just now".to_string()
+                                        } else if diff.num_hours() < 1 {
+                                            format!("{}m ago", diff.num_minutes())
+                                        } else if diff.num_days() < 1 {
+                                            format!("{}h ago", diff.num_hours())
+                                        } else if diff.num_days() < 30 {
+                                            format!("{}d ago", diff.num_days())
+                                        } else {
+                                            repo.updated_at.format("%Y-%m-%d").to_string()
+                                        }
+                                    };
                                    rsx! {
                                        Link {
                                            to: Route::GraphExplorerPage { repo_id },
@@ -74,6 +67,9 @@ pub fn GraphIndexPage() -> Element {
                                                span { class: "graph-repo-card-tag graph-repo-card-tag-findings",
                                                    "{findings_label}"
                                                }
+                                                span { class: "graph-repo-card-tag",
+                                                    "Updated {updated}"
+                                                }
                                            }
                                        }
                                    }
@@ -1,271 +0,0 @@
-use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
-
-use crate::components::page_header::PageHeader;
-use crate::components::toast::{ToastType, Toasts};
-use crate::infrastructure::mcp_tokens::{
-    create_mcp_token, fetch_mcp_tokens, revoke_mcp_token, CreateMcpTokenResponse,
-};
-
-#[component]
-pub fn McpTokensPage() -> Element {
-    let mut tokens = use_resource(|| async { fetch_mcp_tokens().await.ok() });
-    let mut toasts = use_context::<Toasts>();
-
-    // Create-form state
-    let mut show_form = use_signal(|| false);
-    let mut new_name = use_signal(String::new);
-    let mut submitting = use_signal(|| false);
-
-    // After creation, the raw token shows once in a banner
-    let mut just_created: Signal<Option<CreateMcpTokenResponse>> = use_signal(|| None);
-
-    // Revoke confirmation: (id, name)
-    let mut confirm_revoke: Signal<Option<(String, String)>> = use_signal(|| None);
-
-    rsx! {
-        PageHeader {
-            title: "MCP Tokens",
-            description: "Static bearer tokens for the MCP server. Use in your LLM client (Claude Desktop, Cursor, etc.) — one token per tool/device.",
-        }
-
-        // ── Just-created banner ────────────────────────────────────
-        if let Some(resp) = just_created() {
-            div { class: "card mb-4", style: "border: 1px solid var(--accent-warning); background: var(--bg-warning-subtle);",
-                div { class: "card-header", style: "color: var(--accent-warning);",
-                    Icon { icon: BsExclamationTriangle, width: 14, height: 14 }
-                    " Copy this token now — it won't be shown again"
-                }
-                div { style: "padding: 1rem;",
-                    p { style: "margin-bottom: 0.5rem; color: var(--text-secondary);",
-                        "Token for "
-                        strong { "{resp.view.name}" }
-                    }
-                    div { class: "copyable", style: "background: var(--bg-secondary); padding: 0.75rem; border-radius: 4px;",
-                        code { style: "font-family: var(--font-mono); word-break: break-all; flex: 1;", "{resp.token}" }
-                        crate::components::copy_button::CopyButton { value: resp.token.clone(), small: false }
-                    }
-                    div { style: "margin-top: 0.75rem;",
-                        button {
-                            class: "btn btn-sm btn-ghost",
-                            onclick: move |_| just_created.set(None),
-                            "Dismiss"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ── Create form ────────────────────────────────────────────
-        div { class: "mb-4",
-            button {
-                class: "btn btn-primary",
-                onclick: move |_| {
-                    show_form.set(!show_form());
-                    new_name.set(String::new());
-                },
-                if show_form() { "Cancel" } else {
-                    Icon { icon: BsPlusLg, width: 14, height: 14 }
-                    " Create Token"
-                }
-            }
-        }
-
-        if show_form() {
-            div { class: "card mb-4",
-                div { class: "card-header", "New MCP Token" }
-                div { style: "padding: 1rem;",
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            placeholder: "Claude Desktop on my laptop",
-                            value: "{new_name}",
-                            oninput: move |e| new_name.set(e.value()),
-                        }
-                        small { style: "color: var(--text-secondary);", "A label so you can identify this token in the list. Not visible to LLM clients." }
-                    }
-                    div { style: "margin-top: 1rem;",
-                        button {
-                            class: "btn btn-primary",
-                            disabled: submitting() || new_name().trim().is_empty(),
-                            onclick: move |_| {
-                                let name = new_name().trim().to_string();
-                                if name.is_empty() {
-                                    return;
-                                }
-                                spawn(async move {
-                                    submitting.set(true);
-                                    match create_mcp_token(name).await {
-                                        Ok(resp) => {
-                                            toasts.push(ToastType::Success, "Token created. Copy it now — it won't be shown again.");
-                                            just_created.set(Some(resp));
-                                            show_form.set(false);
-                                            new_name.set(String::new());
-                                            tokens.restart();
-                                        }
-                                        Err(e) => {
-                                            toasts.push(ToastType::Error, format!("Failed to create token: {e}"));
-                                        }
-                                    }
-                                    submitting.set(false);
-                                });
-                            },
-                            if submitting() { "Creating..." } else { "Create" }
-                        }
-                    }
-                }
-            }
-        }
-
-        // ── Tokens list ────────────────────────────────────────────
-        match &*tokens.read() {
-            Some(Some(resp)) => {
-                if resp.data.is_empty() {
-                    rsx! {
-                        div { class: "card",
-                            p { style: "padding: 1rem; color: var(--text-secondary);", "No MCP tokens yet. Create one to start using the MCP server from an LLM client." }
-                        }
-                    }
-                } else {
-                    rsx! {
-                        div { class: "mcp-cards-grid",
-                            for token in resp.data.iter() {
-                                {
-                                    let id = token.id.clone();
-                                    let name = token.name.clone();
-                                    let prefix = token.token_prefix.clone();
-                                    let created_str = format_timestamp(&token.created_at);
-                                    let last_used_str = token
-                                        .last_used_at
-                                        .as_ref()
-                                        .map(format_timestamp)
-                                        .unwrap_or_else(|| "never".to_string());
-                                    let revoked = token.revoked;
-                                    rsx! {
-                                        div { class: "mcp-card", style: if revoked { "opacity: 0.55;" } else { "" },
-                                            div { class: "mcp-card-header",
-                                                div { class: "mcp-card-title",
-                                                    Icon { icon: BsKey, width: 14, height: 14 }
-                                                    h3 { "{name}" }
-                                                    if revoked {
-                                                        span { class: "mcp-card-status stopped", "revoked" }
-                                                    }
-                                                }
-                                                if !revoked {
-                                                    button {
-                                                        class: "btn btn-sm btn-ghost btn-ghost-danger",
-                                                        title: "Revoke token",
-                                                        onclick: {
-                                                            let id = id.clone();
-                                                            let name = name.clone();
-                                                            move |_| {
-                                                                confirm_revoke.set(Some((id.clone(), name.clone())));
-                                                            }
-                                                        },
-                                                        Icon { icon: BsTrash, width: 14, height: 14 }
-                                                    }
-                                                }
-                                            }
-                                            div { class: "mcp-card-details",
-                                                div { class: "mcp-detail-row",
-                                                    Icon { icon: BsKey, width: 13, height: 13 }
-                                                    span { class: "mcp-detail-label", "Prefix" }
-                                                    code { class: "mcp-detail-value", "{prefix}…" }
-                                                }
-                                                div { class: "mcp-detail-row",
-                                                    Icon { icon: BsCalendar, width: 13, height: 13 }
-                                                    span { class: "mcp-detail-label", "Created" }
-                                                    span { class: "mcp-detail-value", "{created_str}" }
-                                                }
-                                                div { class: "mcp-detail-row",
-                                                    Icon { icon: BsClockHistory, width: 13, height: 13 }
-                                                    span { class: "mcp-detail-label", "Last used" }
-                                                    span { class: "mcp-detail-value", "{last_used_str}" }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            Some(None) => rsx! {
-                div { class: "card",
-                    p { style: "padding: 1rem; color: var(--accent-danger);", "Failed to load MCP tokens." }
-                }
-            },
-            None => rsx! {
-                div { class: "card",
-                    p { style: "padding: 1rem; color: var(--text-secondary);", "Loading..." }
-                }
-            },
-        }
-
-        // ── Revoke confirmation modal ──────────────────────────────
-        if let Some((id, name)) = confirm_revoke() {
-            div { class: "modal-overlay",
-                div { class: "modal",
-                    h3 { "Revoke token?" }
-                    p {
-                        "The token "
-                        strong { "{name}" }
-                        " will stop working immediately. This cannot be undone. Any LLM client using it will start getting 401."
-                    }
-                    div { style: "display: flex; gap: 0.5rem; margin-top: 1rem; justify-content: flex-end;",
-                        button {
-                            class: "btn btn-ghost",
-                            onclick: move |_| confirm_revoke.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-danger",
-                            onclick: {
-                                let id = id.clone();
-                                move |_| {
-                                    let id = id.clone();
-                                    spawn(async move {
-                                        match revoke_mcp_token(id).await {
-                                            Ok(()) => {
-                                                toasts.push(ToastType::Success, "Token revoked");
-                                                tokens.restart();
-                                            }
-                                            Err(e) => {
-                                                toasts.push(ToastType::Error, format!("Failed to revoke: {e}"));
-                                            }
-                                        }
-                                        confirm_revoke.set(None);
-                                    });
-                                }
-                            },
-                            "Revoke"
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-
-/// Best-effort timestamp formatter. The agent serializes BSON DateTime
-/// as `{"$date":{"$numberLong":"..."}}` in extended JSON. We accept
-/// that shape, plain ISO strings, or anything else (best-effort).
-fn format_timestamp(v: &serde_json::Value) -> String {
-    if let Some(s) = v.as_str() {
-        return s.to_string();
-    }
-    if let Some(ms) = v
-        .get("$date")
-        .and_then(|d| d.get("$numberLong"))
-        .and_then(|s| s.as_str())
-        .and_then(|s| s.parse::<i64>().ok())
-    {
-        return chrono::DateTime::<chrono::Utc>::from_timestamp_millis(ms)
-            .map(|d| d.format("%Y-%m-%d %H:%M").to_string())
-            .unwrap_or_else(|| ms.to_string());
-    }
-    "—".to_string()
-}
@@ -11,13 +11,11 @@ pub mod graph_index;
 pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
-pub mod mcp_tokens;
-pub mod onboarding;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
+pub mod repositories;
 pub mod sbom;
-pub mod targets;

 pub use chat::ChatPage;
 pub use chat_index::ChatIndexPage;
@@ -32,10 +30,8 @@ pub use graph_index::GraphIndexPage;
 pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
-pub use mcp_tokens::McpTokensPage;
-pub use onboarding::OnboardingPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;
+pub use repositories::RepositoriesPage;
 pub use sbom::SbomPage;
-pub use targets::TargetsPage;
@@ -1,421 +0,0 @@
-use dioxus::prelude::*;
-
-use crate::components::page_header::PageHeader;
-use crate::infrastructure::onboarding::{
-    create_target, detect_target, fetch_applicable_scans, trigger_target_scan,
-    validate_artifact_ref, validate_target_name, ArtifactInputDto,
-};
-
-/// (value, label, one-line description) for the 9 target families.
-const TARGET_TYPES: &[(&str, &str, &str)] = &[
-    ("web_app", "Web Application", "Front end + server"),
-    ("backend_service", "Backend / API", "REST, GraphQL, gRPC"),
-    ("desktop_app", "Desktop App", "Windows / macOS / Linux"),
-    ("android_app", "Android App", "APK / AAB"),
-    ("ios_app", "iOS App", "IPA"),
-    (
-        "firmware_bare_metal",
-        "Firmware — bare metal",
-        "No operating system",
-    ),
-    ("firmware_rtos", "Firmware — RTOS", "Zephyr, FreeRTOS, ..."),
-    (
-        "embedded_linux_yocto",
-        "Embedded Linux / Yocto",
-        "BSP + image",
-    ),
-    ("plc_sps", "PLC / SPS", "IEC 61131-3"),
-];
-
-/// (value, label) for the artifact kinds a user can attach.
-const ARTIFACT_KINDS: &[(&str, &str)] = &[
-    ("git_repo", "Git repository"),
-    ("source_archive", "Source archive (zip)"),
-    ("firmware_image", "Firmware image"),
-    ("mobile_package", "Mobile package (APK/IPA)"),
-    ("container_image", "Container image"),
-    ("live_url", "Live URL"),
-    ("plc_project", "PLC project"),
-    ("plaintext_description", "Description (text)"),
-];
-
-const STEP_LABELS: &[&str] = &["Target type", "Artifacts", "Review", "Done"];
-
-/// One row in the applicable-scans list on the success step.
-#[component]
-fn ScanRow(scan: serde_json::Value) -> Element {
-    let name = scan
-        .get("scan")
-        .and_then(|v| v.as_str())
-        .unwrap_or("?")
-        .to_string();
-    let rationale = scan
-        .get("rationale")
-        .and_then(|v| v.as_str())
-        .unwrap_or("")
-        .to_string();
-    let blocked = scan
-        .get("blocked_reason")
-        .and_then(|v| v.as_str())
-        .map(String::from);
-    let default_on = scan
-        .get("default_on")
-        .and_then(|v| v.as_bool())
-        .unwrap_or(false);
-    let badge_class = if blocked.is_some() {
-        "badge badge-info"
-    } else if default_on {
-        "badge badge-success"
-    } else {
-        "badge"
-    };
-    rsx! {
-        div { style: "display: flex; gap: 8px; align-items: center; padding: 6px 0;",
-            span { class: "{badge_class}", "{name}" }
-            span { style: "opacity: 0.8;", "{rationale}" }
-            if let Some(b) = blocked {
-                span { style: "opacity: 0.6; font-style: italic;", "— {b}" }
-            }
-        }
-    }
-}
-
-fn kind_label(kind: &str) -> &str {
-    ARTIFACT_KINDS
-        .iter()
-        .find(|(v, _)| *v == kind)
-        .map(|(_, l)| *l)
-        .unwrap_or(kind)
-}
-
-fn type_label(value: &str) -> &str {
-    TARGET_TYPES
-        .iter()
-        .find(|(v, _, _)| *v == value)
-        .map(|(_, l, _)| *l)
-        .unwrap_or(value)
-}
-
-#[component]
-pub fn OnboardingPage() -> Element {
-    let mut step = use_signal(|| 0usize);
-    let mut name = use_signal(String::new);
-    let mut target_type = use_signal(String::new);
-    let mut description = use_signal(String::new);
-    let mut artifacts = use_signal(Vec::<ArtifactInputDto>::new);
-
-    // "Add artifact" mini-form.
-    let mut new_kind = use_signal(|| "git_repo".to_string());
-    let mut new_source = use_signal(String::new);
-    let mut new_branch = use_signal(|| "main".to_string());
-
-    // Create + result state.
-    let mut creating = use_signal(|| false);
-    let mut error = use_signal(|| Option::<String>::None);
-    let mut scans = use_signal(Vec::<serde_json::Value>::new);
-    let mut suggested = use_signal(|| Option::<String>::None);
-    let mut created_id = use_signal(|| Option::<String>::None);
-    let mut scan_msg = use_signal(|| Option::<String>::None);
-
-    let step_now = step();
-    let name_error = validate_target_name(&name());
-    let can_advance_type = name_error.is_none() && !target_type().trim().is_empty();
-    let has_artifacts = !artifacts().is_empty();
-    // Live validation of the artifact reference being typed (empty = no error yet).
-    let new_source_error = if new_source().is_empty() {
-        None
-    } else {
-        validate_artifact_ref(&new_kind(), &new_source())
-    };
-
-    rsx! {
-        PageHeader {
-            title: "Onboard a target",
-            description: "Add a target, attach its artifacts, and see which scans apply.",
-        }
-
-        // Stepper.
-        div { class: "wizard-steps",
-            for (i, label) in STEP_LABELS.iter().enumerate() {
-                div {
-                    class: if i == step_now { "wizard-step wizard-step-active" } else { "wizard-step" },
-                    span { class: "wizard-step-dot", "{i + 1}" }
-                    span { class: "wizard-step-label", "{label}" }
-                }
-            }
-        }
-
-        if let Some(err) = error() {
-            div { class: "card", style: "border-color: var(--danger, #d33); margin-bottom: 12px;",
-                div { class: "card-header", "Error" }
-                div { style: "padding: 12px;", "{err}" }
-            }
-        }
-
-        div { class: "card",
-            // ---- Step 0: target type + name ----
-            if step_now == 0 {
-                div { class: "card-header", "What kind of software is this?" }
-                div { style: "padding: 16px;",
-                    div { class: "form-group",
-                        label { "Name" }
-                        input {
-                            r#type: "text",
-                            placeholder: "acme-web",
-                            value: "{name}",
-                            oninput: move |e| name.set(e.value()),
-                        }
-                        if !name().is_empty() {
-                            if let Some(err) = name_error.clone() {
-                                div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 4px;", "{err}" }
-                            }
-                        }
-                    }
-                    div {
-                        style: "display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 12px; margin-top: 12px;",
-                        for (value, tlabel, tdesc) in TARGET_TYPES.iter().copied() {
-                            div {
-                                class: "card",
-                                style: if target_type() == value {
-                                    "padding: 12px; cursor: pointer; border: 2px solid var(--accent, #3b82f6);"
-                                } else {
-                                    "padding: 12px; cursor: pointer;"
-                                },
-                                onclick: move |_| target_type.set(value.to_string()),
-                                div { style: "font-weight: 600;", "{tlabel}" }
-                                div { style: "font-size: 0.85em; opacity: 0.7;", "{tdesc}" }
-                            }
-                        }
-                    }
-                }
-            }
-
-            // ---- Step 1: artifacts ----
-            if step_now == 1 {
-                div { class: "card-header", "Attach artifacts" }
-                div { style: "padding: 16px;",
-                    div { style: "display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-end;",
-                        div { class: "form-group", style: "margin: 0;",
-                            label { "Kind" }
-                            select {
-                                value: "{new_kind}",
-                                oninput: move |e| new_kind.set(e.value()),
-                                for (value, klabel) in ARTIFACT_KINDS.iter().copied() {
-                                    option { value: "{value}", "{klabel}" }
-                                }
-                            }
-                        }
-                        div { class: "form-group", style: "margin: 0; flex: 1; min-width: 240px;",
-                            label { "Reference (URL / path / text)" }
-                            input {
-                                r#type: "text",
-                                placeholder: "https://git.example.com/acme.git",
-                                value: "{new_source}",
-                                oninput: move |e| new_source.set(e.value()),
-                            }
-                        }
-                        if new_kind() == "git_repo" {
-                            div { class: "form-group", style: "margin: 0;",
-                                label { "Branch" }
-                                input {
-                                    r#type: "text",
-                                    value: "{new_branch}",
-                                    oninput: move |e| new_branch.set(e.value()),
-                                }
-                            }
-                        }
-                        button {
-                            class: "btn btn-secondary",
-                            disabled: new_source().trim().is_empty() || new_source_error.is_some(),
-                            onclick: move |_| {
-                                let kind = new_kind();
-                                if !new_source().trim().is_empty()
-                                    && validate_artifact_ref(&kind, &new_source()).is_none()
-                                {
-                                    let branch = if kind == "git_repo" { Some(new_branch()) } else { None };
-                                    artifacts.write().push(ArtifactInputDto {
-                                        kind,
-                                        source_ref: new_source(),
-                                        branch,
-                                        plc_format: None,
-                                    });
-                                    new_source.set(String::new());
-                                }
-                            },
-                            "+ Add"
-                        }
-                    }
-                    if let Some(err) = new_source_error.clone() {
-                        div { style: "color: var(--danger, #d33); font-size: 0.85em; margin-top: 6px;", "{err}" }
-                    }
-
-                    div { style: "margin-top: 16px;",
-                        if has_artifacts {
-                            for (i, a) in artifacts().iter().enumerate() {
-                                div {
-                                    style: "display: flex; justify-content: space-between; align-items: center; padding: 8px 12px; border: 1px solid var(--border, #333); border-radius: 6px; margin-bottom: 6px;",
-                                    span {
-                                        span { style: "opacity: 0.7;", "{kind_label(&a.kind)}: " }
-                                        "{a.source_ref}"
-                                    }
-                                    button {
-                                        class: "btn btn-ghost-danger btn-sm",
-                                        onclick: move |_| { artifacts.write().remove(i); },
-                                        "Remove"
-                                    }
-                                }
-                            }
-                        } else {
-                            div { style: "opacity: 0.6;", "No artifacts yet. Add at least one." }
-                        }
-                    }
-                }
-            }
-
-            // ---- Step 2: review + create ----
-            if step_now == 2 {
-                div { class: "card-header", "Review" }
-                div { style: "padding: 16px;",
-                    div { class: "wizard-summary",
-                        div { strong { "Name: " } "{name()}" }
-                        div { strong { "Type: " } "{type_label(&target_type())}" }
-                        div { strong { "Artifacts:" } }
-                        ul {
-                            for a in artifacts() {
-                                li { "{kind_label(&a.kind)}: {a.source_ref}" }
-                            }
-                        }
-                    }
-                    div { style: "margin-top: 12px; opacity: 0.7; font-size: 0.9em;",
-                        "The applicable scans (SAST / DAST / firmware / PLC) are shown after the target is created."
-                    }
-                }
-            }
-
-            // ---- Step 3: created ----
-            if step_now == 3 {
-                div { class: "card-header", "Target onboarded" }
-                div { style: "padding: 16px;",
-                    p {
-                        strong { "{name()}" }
-                        " was created."
-                        if let Some(s) = suggested() {
-                            span { " Suggested type from detection: " strong { "{type_label(&s)}" } "." }
-                        }
-                    }
-                    h4 { style: "margin-top: 16px;", "Applicable scans" }
-                    if scans().is_empty() {
-                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
-                    } else {
-                        for s in scans() {
-                            ScanRow { scan: s }
-                        }
-                    }
-                    if let Some(msg) = scan_msg() {
-                        div { style: "margin-top: 8px; color: var(--success, #2a2);", "{msg}" }
-                    }
-                    div { style: "margin-top: 16px; display: flex; gap: 8px;",
-                        button {
-                            class: "btn btn-primary",
-                            onclick: move |_| {
-                                if let Some(id) = created_id() {
-                                    scan_msg.set(Some("Scan triggered...".to_string()));
-                                    spawn(async move {
-                                        match trigger_target_scan(id).await {
-                                            Ok(_) => scan_msg.set(Some(
-                                                "Scan started — findings will appear as it runs.".to_string(),
-                                            )),
-                                            Err(e) => scan_msg.set(Some(format!("Failed to start scan: {e}"))),
-                                        }
-                                    });
-                                }
-                            },
-                            "Run scan"
-                        }
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| {
-                                step.set(0);
-                                name.set(String::new());
-                                target_type.set(String::new());
-                                description.set(String::new());
-                                artifacts.write().clear();
-                                scans.write().clear();
-                                suggested.set(None);
-                                created_id.set(None);
-                                scan_msg.set(None);
-                                error.set(None);
-                            },
-                            "Onboard another"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ---- Footer navigation ----
-        if step_now < 3 {
-            div { style: "display: flex; justify-content: space-between; margin-top: 16px;",
-                button {
-                    class: "btn btn-back",
-                    disabled: step_now == 0,
-                    onclick: move |_| { if step() > 0 { step.set(step() - 1); } },
-                    "Back"
-                }
-                if step_now < 2 {
-                    button {
-                        class: "btn btn-primary",
-                        disabled: (step_now == 0 && !can_advance_type) || (step_now == 1 && !has_artifacts),
-                        onclick: move |_| step.set(step() + 1),
-                        "Next"
-                    }
-                } else {
-                    button {
-                        class: "btn btn-primary",
-                        disabled: creating(),
-                        onclick: move |_| {
-                            let n = name();
-                            let tt = target_type();
-                            let desc = description();
-                            let arts = artifacts();
-                            let d = if desc.trim().is_empty() { None } else { Some(desc) };
-                            creating.set(true);
-                            error.set(None);
-                            spawn(async move {
-                                match create_target(n, tt, d, arts).await {
-                                    Ok(resp) => {
-                                        let id = resp
-                                            .data
-                                            .get("_id")
-                                            .and_then(|o| o.get("$oid"))
-                                            .and_then(|s| s.as_str())
-                                            .map(String::from);
-                                        if let Some(id) = id {
-                                            created_id.set(Some(id.clone()));
-                                            if let Ok(sc) = fetch_applicable_scans(id.clone()).await {
-                                                scans.set(sc.data.scans);
-                                            }
-                                            if let Ok(det) = detect_target(id).await {
-                                                suggested.set(
-                                                    det.data
-                                                        .get("classification")
-                                                        .and_then(|c| c.get("suggested"))
-                                                        .and_then(|s| s.as_str())
-                                                        .map(String::from),
-                                                );
-                                            }
-                                        }
-                                        step.set(3);
-                                    }
-                                    Err(e) => error.set(Some(e.to_string())),
-                                }
-                                creating.set(false);
-                            });
-                        },
-                        if creating() { "Creating..." } else { "Create target" }
-                    }
-                }
-            }
-        }
-    }
-}
@@ -6,7 +6,7 @@ use crate::app::Route;
 use crate::components::page_header::PageHeader;
 use crate::components::stat_card::StatCard;
 use crate::infrastructure::mcp::fetch_mcp_servers;
-use crate::infrastructure::onboarding::fetch_targets;
+use crate::infrastructure::repositories::fetch_repositories;

 #[cfg(feature = "server")]
 use crate::infrastructure::stats::fetch_overview_stats;
@@ -26,7 +26,7 @@ pub fn OverviewPage() -> Element {
        }
    });

-    let repos = use_resource(|| async { fetch_targets().await.ok() });
+    let repos = use_resource(|| async { fetch_repositories(1).await.ok() });
    let mcp_servers = use_resource(|| async { fetch_mcp_servers().await.ok() });

    rsx! {
@@ -94,8 +94,8 @@ pub fn OverviewPage() -> Element {
                                        style: "display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; padding: 1rem;",
                                        for repo in repo_list {
                                            {
-                                                let repo_id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                                let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+                                                let name = repo.name.clone();
                                                rsx! {
                                                    Link {
                                                        to: Route::ChatPage { repo_id },
@@ -0,0 +1,657 @@
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+#[allow(unused_imports)]
+use dioxus_free_icons::icons::bs_icons::{BsGear, BsPencil};
+use dioxus_free_icons::Icon;
+
+use crate::components::page_header::PageHeader;
+use crate::components::pagination::Pagination;
+use crate::components::toast::{ToastType, Toasts};
+use crate::pages::graph_explorer::GraphExplorerInline;
+
+async fn async_sleep_5s() {
+    #[cfg(feature = "web")]
+    {
+        gloo_timers::future::TimeoutFuture::new(5_000).await;
+    }
+    #[cfg(not(feature = "web"))]
+    {
+        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
+    }
+}
+
+#[component]
+pub fn RepositoriesPage() -> Element {
+    let mut page = use_signal(|| 1u64);
+    let mut show_add_form = use_signal(|| false);
+    let mut name = use_signal(String::new);
+    let mut git_url = use_signal(String::new);
+    let mut branch = use_signal(|| "main".to_string());
+    let mut auth_token = use_signal(String::new);
+    let mut auth_username = use_signal(String::new);
+    let mut show_auth = use_signal(|| false);
+    let mut ssh_public_key = use_signal(String::new);
+    let mut show_tracker = use_signal(|| false);
+    let mut tracker_type_val = use_signal(String::new);
+    let mut tracker_owner_val = use_signal(String::new);
+    let mut tracker_repo_val = use_signal(String::new);
+    let mut tracker_token_val = use_signal(String::new);
+    let mut adding = use_signal(|| false);
+    let mut toasts = use_context::<Toasts>();
+    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None); // (id, name)
+    let mut edit_repo_id = use_signal(|| Option::<String>::None);
+    let mut edit_name = use_signal(String::new);
+    let mut edit_branch = use_signal(String::new);
+    let mut edit_tracker_type = use_signal(String::new);
+    let mut edit_tracker_owner = use_signal(String::new);
+    let mut edit_tracker_repo = use_signal(String::new);
+    let mut edit_tracker_token = use_signal(String::new);
+    let mut edit_saving = use_signal(|| false);
+    let mut edit_webhook_secret = use_signal(|| Option::<String>::None);
+    let mut edit_webhook_tracker = use_signal(String::new);
+    let mut scanning_ids = use_signal(Vec::<String>::new);
+    let mut graph_repo_id = use_signal(|| Option::<String>::None);
+
+    let mut repos = use_resource(move || {
+        let p = page();
+        async move {
+            crate::infrastructure::repositories::fetch_repositories(p)
+                .await
+                .ok()
+        }
+    });
+
+    rsx! {
+        PageHeader {
+            title: "Repositories",
+            description: "Tracked git repositories",
+        }
+
+        div { style: "margin-bottom: 16px;",
+            button {
+                class: "btn btn-primary",
+                onclick: move |_| show_add_form.toggle(),
+                if show_add_form() { "Cancel" } else { "+ Add Repository" }
+            }
+        }
+
+        if show_add_form() {
+            div { class: "card",
+                div { class: "card-header", "Add Repository" }
+                div { class: "form-group",
+                    label { "Name" }
+                    input {
+                        r#type: "text",
+                        placeholder: "my-project",
+                        value: "{name}",
+                        oninput: move |e| name.set(e.value()),
+                    }
+                }
+                div { class: "form-group",
+                    label { "Git URL" }
+                    input {
+                        r#type: "text",
+                        placeholder: "https://github.com/org/repo.git  or  git@github.com:org/repo.git",
+                        value: "{git_url}",
+                        oninput: move |e| git_url.set(e.value()),
+                    }
+                }
+                div { class: "form-group",
+                    label { "Default Branch" }
+                    input {
+                        r#type: "text",
+                        placeholder: "main",
+                        value: "{branch}",
+                        oninput: move |e| branch.set(e.value()),
+                    }
+                }
+
+                // Private repo auth section
+                div { style: "margin-top: 8px;",
+                    button {
+                        class: "btn btn-ghost",
+                        style: "font-size: 12px; padding: 4px 8px;",
+                        onclick: move |_| {
+                            let opening = !show_auth();
+                            show_auth.toggle();
+                            if opening {
+                                // Fetch SSH key every time the section opens
+                                ssh_public_key.set(String::new());
+                                spawn(async move {
+                                    match crate::infrastructure::repositories::fetch_ssh_public_key().await {
+                                        Ok(key) => ssh_public_key.set(key),
+                                        Err(_) => ssh_public_key.set("(not available)".to_string()),
+                                    }
+                                });
+                            }
+                        },
+                        if show_auth() { "Hide auth options" } else { "Private repository?" }
+                    }
+                }
+
+                if show_auth() {
+                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
+                        // SSH deploy key display
+                        div { style: "margin-bottom: 12px;",
+                            label { style: "font-size: 12px; color: var(--text-secondary);",
+                                "For SSH URLs: add this deploy key (read-only) to your repository"
+                            }
+                            div {
+                                class: "copyable",
+                                style: "margin-top: 4px; padding: 8px; background: var(--bg-secondary); border-radius: 4px;",
+                                code {
+                                    style: "font-size: 11px; word-break: break-all; user-select: all;",
+                                    if ssh_public_key().is_empty() {
+                                        "Loading..."
+                                    } else {
+                                        "{ssh_public_key}"
+                                    }
+                                }
+                                if !ssh_public_key().is_empty() {
+                                    crate::components::copy_button::CopyButton { value: ssh_public_key(), small: true }
+                                }
+                            }
+                        }
+
+                        // HTTPS auth fields
+                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "For HTTPS URLs: provide an access token (PAT) or username/password"
+                        }
+                        div { class: "form-group",
+                            label { "Auth Token / Password" }
+                            input {
+                                r#type: "password",
+                                placeholder: "ghp_xxxx or personal access token",
+                                value: "{auth_token}",
+                                oninput: move |e| auth_token.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Username (optional, defaults to x-access-token)" }
+                            input {
+                                r#type: "text",
+                                placeholder: "x-access-token",
+                                value: "{auth_username}",
+                                oninput: move |e| auth_username.set(e.value()),
+                            }
+                        }
+                    }
+                }
+
+                // Issue tracker config section
+                div { style: "margin-top: 8px;",
+                    button {
+                        class: "btn btn-ghost",
+                        style: "font-size: 12px; padding: 4px 8px;",
+                        onclick: move |_| show_tracker.toggle(),
+                        if show_tracker() { "Hide tracker options" } else { "Issue tracker?" }
+                    }
+                }
+
+                if show_tracker() {
+                    div { class: "auth-section", style: "margin-top: 12px; padding: 12px; border: 1px solid var(--border-subtle); border-radius: 8px;",
+                        p { style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "Configure an issue tracker to auto-create issues from findings"
+                        }
+                        div { class: "form-group",
+                            label { "Tracker Type" }
+                            select {
+                                value: "{tracker_type_val}",
+                                onchange: move |e| tracker_type_val.set(e.value()),
+                                option { value: "", "None" }
+                                option { value: "github", "GitHub" }
+                                option { value: "gitlab", "GitLab" }
+                                option { value: "gitea", "Gitea" }
+                                option { value: "jira", "Jira" }
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Owner / Namespace" }
+                            input {
+                                r#type: "text",
+                                placeholder: "org-name",
+                                value: "{tracker_owner_val}",
+                                oninput: move |e| tracker_owner_val.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Repository / Project" }
+                            input {
+                                r#type: "text",
+                                placeholder: "repo-name",
+                                value: "{tracker_repo_val}",
+                                oninput: move |e| tracker_repo_val.set(e.value()),
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Tracker Token (PAT)" }
+                            input {
+                                r#type: "password",
+                                placeholder: "ghp_xxxx / glpat-xxxx",
+                                value: "{tracker_token_val}",
+                                oninput: move |e| tracker_token_val.set(e.value()),
+                            }
+                        }
+                    }
+                }
+
+                button {
+                    class: "btn btn-primary",
+                    disabled: adding(),
+                    onclick: move |_| {
+                        let n = name();
+                        let u = git_url();
+                        let b = branch();
+                        let tok = {
+                            let v = auth_token();
+                            if v.is_empty() { None } else { Some(v) }
+                        };
+                        let usr = {
+                            let v = auth_username();
+                            if v.is_empty() { None } else { Some(v) }
+                        };
+                        let tt = { let v = tracker_type_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_owner = { let v = tracker_owner_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_repo = { let v = tracker_repo_val(); if v.is_empty() { None } else { Some(v) } };
+                        let t_tok = { let v = tracker_token_val(); if v.is_empty() { None } else { Some(v) } };
+                        adding.set(true);
+                        spawn(async move {
+                            match crate::infrastructure::repositories::add_repository(n, u, b, tok, usr, tt, t_owner, t_repo, t_tok).await {
+                                Ok(_) => {
+                                    toasts.push(ToastType::Success, "Repository added");
+                                    repos.restart();
+                                }
+                                Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                            }
+                            adding.set(false);
+                        });
+                        show_add_form.set(false);
+                        show_auth.set(false);
+                        show_tracker.set(false);
+                        name.set(String::new());
+                        git_url.set(String::new());
+                        auth_token.set(String::new());
+                        auth_username.set(String::new());
+                        tracker_type_val.set(String::new());
+                        tracker_owner_val.set(String::new());
+                        tracker_repo_val.set(String::new());
+                        tracker_token_val.set(String::new());
+                    },
+                    if adding() { "Validating..." } else { "Add" }
+                }
+            }
+        }
+
+        // ── Delete confirmation dialog ──
+        if let Some((del_id, del_name)) = confirm_delete() {
+            div { class: "modal-overlay",
+                div { class: "modal-dialog",
+                    h3 { "Delete Repository" }
+                    p {
+                        "Are you sure you want to delete "
+                        strong { "{del_name}" }
+                        "?"
+                    }
+                    p { class: "modal-warning",
+                        "This will permanently remove all associated findings, SBOM entries, scan runs, graph data, embeddings, and CVE alerts."
+                    }
+                    div { class: "modal-actions",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| confirm_delete.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-danger",
+                            onclick: move |_| {
+                                let id = del_id.clone();
+                                let name = del_name.clone();
+                                confirm_delete.set(None);
+                                spawn(async move {
+                                    match crate::infrastructure::repositories::delete_repository(id).await {
+                                        Ok(_) => {
+                                            toasts.push(ToastType::Success, format!("{name} deleted"));
+                                            repos.restart();
+                                        }
+                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                    }
+                                });
+                            },
+                            "Delete"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Edit repository dialog ──
+        if let Some(eid) = edit_repo_id() {
+            div { class: "modal-overlay",
+                div { class: "modal-dialog",
+                    h3 { "Edit Repository" }
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            value: "{edit_name}",
+                            oninput: move |e| edit_name.set(e.value()),
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Default Branch" }
+                        input {
+                            r#type: "text",
+                            value: "{edit_branch}",
+                            oninput: move |e| edit_branch.set(e.value()),
+                        }
+                    }
+                    h4 { style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);", "Issue Tracker" }
+                    div { class: "form-group",
+                        label { "Tracker Type" }
+                        select {
+                            value: "{edit_tracker_type}",
+                            onchange: move |e| edit_tracker_type.set(e.value()),
+                            option { value: "", "None" }
+                            option { value: "github", "GitHub" }
+                            option { value: "gitlab", "GitLab" }
+                            option { value: "gitea", "Gitea" }
+                            option { value: "jira", "Jira" }
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Owner / Namespace" }
+                        input {
+                            r#type: "text",
+                            placeholder: "org-name",
+                            value: "{edit_tracker_owner}",
+                            oninput: move |e| edit_tracker_owner.set(e.value()),
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Repository / Project" }
+                        input {
+                            r#type: "text",
+                            placeholder: "repo-name",
+                            value: "{edit_tracker_repo}",
+                            oninput: move |e| edit_tracker_repo.set(e.value()),
+                        }
+                    }
+                    div { class: "form-group",
+                        label { "Tracker Token (leave empty to keep existing)" }
+                        input {
+                            r#type: "password",
+                            placeholder: "Enter new token to change",
+                            value: "{edit_tracker_token}",
+                            oninput: move |e| edit_tracker_token.set(e.value()),
+                        }
+                    }
+                    // Webhook configuration section
+                    if let Some(secret) = edit_webhook_secret() {
+                        h4 {
+                            style: "margin-top: 16px; margin-bottom: 8px; font-size: 14px; color: var(--text-secondary);",
+                            "Webhook Configuration"
+                        }
+                        p {
+                            style: "font-size: 12px; color: var(--text-secondary); margin-bottom: 8px;",
+                            "Add this webhook in your repository settings to enable push-triggered scans and PR reviews."
+                        }
+                        div { class: "form-group",
+                            label { "Webhook URL" }
+                            {
+                                #[cfg(feature = "web")]
+                                let origin = web_sys::window()
+                                    .and_then(|w: web_sys::Window| w.location().origin().ok())
+                                    .unwrap_or_default();
+                                #[cfg(not(feature = "web"))]
+                                let origin = String::new();
+                                let webhook_url = format!("{origin}/webhook/{}/{eid}", edit_webhook_tracker());
+                                rsx! {
+                                    div { class: "copyable",
+                                        input {
+                                            r#type: "text",
+                                            readonly: true,
+                                            style: "font-family: monospace; font-size: 12px; flex: 1;",
+                                            value: "{webhook_url}",
+                                        }
+                                        crate::components::copy_button::CopyButton { value: webhook_url.clone() }
+                                    }
+                                }
+                            }
+                        }
+                        div { class: "form-group",
+                            label { "Webhook Secret" }
+                            div { class: "copyable",
+                                input {
+                                    r#type: "text",
+                                    readonly: true,
+                                    style: "font-family: monospace; font-size: 12px; flex: 1;",
+                                    value: "{secret}",
+                                }
+                                crate::components::copy_button::CopyButton { value: secret.clone() }
+                            }
+                        }
+                    }
+                    div { class: "modal-actions",
+                        button {
+                            class: "btn btn-secondary",
+                            onclick: move |_| edit_repo_id.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-primary",
+                            disabled: edit_saving(),
+                            onclick: move |_| {
+                                let id = eid.clone();
+                                let nm = { let v = edit_name(); if v.is_empty() { None } else { Some(v) } };
+                                let br = { let v = edit_branch(); if v.is_empty() { None } else { Some(v) } };
+                                let tt = { let v = edit_tracker_type(); if v.is_empty() { None } else { Some(v) } };
+                                let t_owner = { let v = edit_tracker_owner(); if v.is_empty() { None } else { Some(v) } };
+                                let t_repo = { let v = edit_tracker_repo(); if v.is_empty() { None } else { Some(v) } };
+                                let t_tok = { let v = edit_tracker_token(); if v.is_empty() { None } else { Some(v) } };
+                                edit_saving.set(true);
+                                spawn(async move {
+                                    match crate::infrastructure::repositories::update_repository(
+                                        id, nm, br, None, None, tt, t_owner, t_repo, t_tok, None,
+                                    ).await {
+                                        Ok(_) => {
+                                            toasts.push(ToastType::Success, "Repository updated");
+                                            repos.restart();
+                                        }
+                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                    }
+                                    edit_saving.set(false);
+                                    edit_repo_id.set(None);
+                                });
+                            },
+                            if edit_saving() { "Saving..." } else { "Save" }
+                        }
+                    }
+                }
+            }
+        }
+
+        match &*repos.read() {
+            Some(Some(resp)) => {
+                let total_pages = resp.total.unwrap_or(0).div_ceil(20).max(1);
+                rsx! {
+                    div { class: "card",
+                        div { class: "table-wrapper",
+                            table {
+                                thead {
+                                    tr {
+                                        th { "Name" }
+                                        th { "Git URL" }
+                                        th { "Branch" }
+                                        th { "Findings" }
+                                        th { "Last Scanned" }
+                                        th { "Actions" }
+                                    }
+                                }
+                                tbody {
+                                    for repo in &resp.data {
+                                        {
+                                            let repo_id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
+                                            let repo_id_scan = repo_id.clone();
+                                            let repo_id_del = repo_id.clone();
+                                            let repo_id_edit = repo_id.clone();
+                                            let repo_name_del = repo.name.clone();
+                                            let edit_repo_data = repo.clone();
+                                            let is_scanning = scanning_ids().contains(&repo_id);
+                                            rsx! {
+                                                tr {
+                                                    td { "{repo.name}" }
+                                                    td {
+                                                        style: "font-size: 12px; font-family: monospace;",
+                                                        "{repo.git_url}"
+                                                    }
+                                                    td { "{repo.default_branch}" }
+                                                    td { "{repo.findings_count}" }
+                                                    td {
+                                                        {
+                                                            let now = chrono::Utc::now();
+                                                            let diff = now.signed_duration_since(repo.updated_at);
+                                                            let label = if diff.num_minutes() < 1 {
+                                                                "just now".to_string()
+                                                            } else if diff.num_hours() < 1 {
+                                                                format!("{}m ago", diff.num_minutes())
+                                                            } else if diff.num_days() < 1 {
+                                                                format!("{}h ago", diff.num_hours())
+                                                            } else if diff.num_days() < 30 {
+                                                                format!("{}d ago", diff.num_days())
+                                                            } else {
+                                                                repo.updated_at.format("%Y-%m-%d").to_string()
+                                                            };
+                                                            rsx! { span { style: "font-size: 12px;", "{label}" } }
+                                                        }
+                                                    }
+                                                    td { style: "display: flex; gap: 4px;",
+                                                        button {
+                                                            class: if graph_repo_id().as_deref() == Some(repo_id.as_str()) { "btn btn-ghost btn-active" } else { "btn btn-ghost" },
+                                                            title: "View graph",
+                                                            onclick: {
+                                                                let rid = repo_id.clone();
+                                                                move |_| {
+                                                                    if graph_repo_id().as_deref() == Some(rid.as_str()) {
+                                                                        graph_repo_id.set(None);
+                                                                    } else {
+                                                                        graph_repo_id.set(Some(rid.clone()));
+                                                                    }
+                                                                }
+                                                            },
+                                                            Icon { icon: BsDiagram3, width: 16, height: 16 }
+                                                        }
+                                                        button {
+                                                            class: "btn btn-ghost",
+                                                            title: "Edit repository",
+                                                            onclick: move |_| {
+                                                                edit_name.set(edit_repo_data.name.clone());
+                                                                edit_branch.set(edit_repo_data.default_branch.clone());
+                                                                edit_tracker_type.set(
+                                                                    edit_repo_data.tracker_type.as_ref().map(|t| t.to_string()).unwrap_or_default()
+                                                                );
+                                                                edit_tracker_owner.set(edit_repo_data.tracker_owner.clone().unwrap_or_default());
+                                                                edit_tracker_repo.set(edit_repo_data.tracker_repo.clone().unwrap_or_default());
+                                                                edit_tracker_token.set(String::new());
+                                                                edit_webhook_secret.set(None);
+                                                                edit_webhook_tracker.set(String::new());
+                                                                edit_repo_id.set(Some(repo_id_edit.clone()));
+                                                                // Fetch webhook config in background
+                                                                let rid = repo_id_edit.clone();
+                                                                spawn(async move {
+                                                                    if let Ok(cfg) = crate::infrastructure::repositories::fetch_webhook_config(rid).await {
+                                                                        edit_webhook_secret.set(cfg.webhook_secret);
+                                                                        edit_webhook_tracker.set(cfg.tracker_type);
+                                                                    }
+                                                                });
+                                                            },
+                                                            Icon { icon: BsPencil, width: 16, height: 16 }
+                                                        }
+                                                        button {
+                                                            class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
+                                                            title: "Trigger scan",
+                                                            disabled: is_scanning,
+                                                            onclick: move |_| {
+                                                                let id = repo_id_scan.clone();
+                                                                // Add to scanning set
+                                                                let mut ids = scanning_ids();
+                                                                ids.push(id.clone());
+                                                                scanning_ids.set(ids);
+                                                                spawn(async move {
+                                                                    match crate::infrastructure::repositories::trigger_repo_scan(id.clone()).await {
+                                                                        Ok(_) => {
+                                                                            toasts.push(ToastType::Success, "Scan triggered");
+                                                                            // Poll until scan completes
+                                                                            loop {
+                                                                                async_sleep_5s().await;
+                                                                                match crate::infrastructure::repositories::check_repo_scanning(id.clone()).await {
+                                                                                    Ok(false) => break,
+                                                                                    Ok(true) => continue,
+                                                                                    Err(_) => break,
+                                                                                }
+                                                                            }
+                                                                            toasts.push(ToastType::Success, "Scan complete");
+                                                                            repos.restart();
+                                                                        }
+                                                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
+                                                                    }
+                                                                    // Remove from scanning set
+                                                                    let mut ids = scanning_ids();
+                                                                    ids.retain(|i| i != &id);
+                                                                    scanning_ids.set(ids);
+                                                                });
+                                                            },
+                                                            if is_scanning {
+                                                                span { class: "spinner" }
+                                                            } else {
+                                                                Icon { icon: BsPlayCircle, width: 16, height: 16 }
+                                                            }
+                                                        }
+                                                        button {
+                                                            class: "btn btn-ghost btn-ghost-danger",
+                                                            title: "Delete repository",
+                                                            onclick: move |_| {
+                                                                confirm_delete.set(Some((repo_id_del.clone(), repo_name_del.clone())));
+                                                            },
+                                                            Icon { icon: BsTrash, width: 16, height: 16 }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        Pagination {
+                            current_page: page(),
+                            total_pages: total_pages,
+                            on_page_change: move |p| page.set(p),
+                        }
+                    }
+
+                    // Inline graph explorer
+                    if let Some(rid) = graph_repo_id() {
+                        div { class: "card", style: "margin-top: 16px;",
+                            div { class: "card-header", style: "display: flex; justify-content: space-between; align-items: center;",
+                                span { "Code Graph" }
+                                button {
+                                    class: "btn btn-sm btn-ghost",
+                                    title: "Close graph",
+                                    onclick: move |_| { graph_repo_id.set(None); },
+                                    Icon { icon: BsX, width: 18, height: 18 }
+                                }
+                            }
+                            GraphExplorerInline { repo_id: rid }
+                        }
+                    }
+                }
+            },
+            Some(None) => rsx! {
+                div { class: "card", p { "Failed to load repositories." } }
+            },
+            None => rsx! {
+                div { class: "loading", "Loading repositories..." }
+            },
+        }
+    }
+}
@@ -28,9 +28,9 @@ pub fn SbomPage() -> Element {
    let mut diff_repo_a = use_signal(String::new);
    let mut diff_repo_b = use_signal(String::new);

-    // ── Targets for dropdowns ──
+    // ── Repos for dropdowns ──
    let repos = use_resource(|| async {
-        crate::infrastructure::onboarding::fetch_targets()
+        crate::infrastructure::repositories::fetch_repositories(1)
            .await
            .ok()
    });
@@ -114,14 +114,14 @@ pub fn SbomPage() -> Element {
                select {
                    class: "sbom-filter-select",
                    onchange: move |e| { repo_filter.set(e.value()); page.set(1); },
-                    option { value: "", "All Targets" }
+                    option { value: "", "All Repositories" }
                    {
                        match &*repos.read() {
                            Some(Some(resp)) => rsx! {
                                for repo in &resp.data {
                                    {
-                                        let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                        let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                        let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
+                                        let name = repo.name.clone();
                                        rsx! { option { value: "{id}", "{name}" } }
                                    }
                                }
@@ -476,8 +476,8 @@ pub fn SbomPage() -> Element {
                                    Some(Some(resp)) => rsx! {
                                        for repo in &resp.data {
                                            {
-                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
+                                                let name = repo.name.clone();
                                                rsx! { option { value: "{id}", "{name}" } }
                                            }
                                        }
@@ -498,8 +498,8 @@ pub fn SbomPage() -> Element {
                                    Some(Some(resp)) => rsx! {
                                        for repo in &resp.data {
                                            {
-                                                let id = repo.get("_id").and_then(|o| o.get("$oid")).and_then(|s| s.as_str()).unwrap_or_default().to_string();
-                                                let name = repo.get("name").and_then(|n| n.as_str()).unwrap_or_default().to_string();
+                                                let id = repo.id.as_ref().map(|id| id.to_hex()).unwrap_or_default();
+                                                let name = repo.name.clone();
                                                rsx! { option { value: "{id}", "{name}" } }
                                            }
                                        }
@@ -1,544 +0,0 @@
-//! Targets page — lists onboarded targets (the unified `OnboardedTarget`
-//! records the wizard creates) and lets the user run a scan, inspect the
-//! classification / applicable scans, or delete a target.
-//!
-//! Creation lives in the Onboard wizard (`/onboard`); this page is the
-//! "where is my target, and what did the scan find" surface.
-
-use dioxus::prelude::*;
-use dioxus_free_icons::icons::bs_icons::*;
-use dioxus_free_icons::Icon;
-
-use crate::components::page_header::PageHeader;
-use crate::components::toast::{ToastType, Toasts};
-use crate::infrastructure::onboarding::{
-    delete_target, fetch_applicable_scans, fetch_targets, trigger_target_scan, update_target,
-    validate_artifact_ref, validate_target_name, ArtifactInputDto,
-};
-
-/// The nine target families (value, label) for the edit form's type selector.
-const TARGET_TYPES: &[(&str, &str)] = &[
-    ("web_app", "Web Application"),
-    ("backend_service", "Backend / API"),
-    ("desktop_app", "Desktop App"),
-    ("android_app", "Android App"),
-    ("ios_app", "iOS App"),
-    ("firmware_bare_metal", "Firmware — bare metal"),
-    ("firmware_rtos", "Firmware — RTOS"),
-    ("embedded_linux_yocto", "Embedded Linux / Yocto"),
-    ("plc_sps", "PLC / SPS"),
-];
-
-/// The artifact kinds (value, label) for the edit form.
-const ARTIFACT_KINDS: &[(&str, &str)] = &[
-    ("git_repo", "Git repository"),
-    ("source_archive", "Source archive (zip)"),
-    ("firmware_image", "Firmware image"),
-    ("mobile_package", "Mobile package (APK/IPA)"),
-    ("container_image", "Container image"),
-    ("live_url", "Live URL"),
-    ("plc_project", "PLC project"),
-    ("plaintext_description", "Description (text)"),
-];
-
-/// Prettify a snake_case target-type value into a human label.
-fn pretty_type(v: &str) -> String {
-    match v {
-        "web_app" => "Web Application".into(),
-        "backend_service" => "Backend / API".into(),
-        "desktop_app" => "Desktop App".into(),
-        "android_app" => "Android App".into(),
-        "ios_app" => "iOS App".into(),
-        "firmware_bare_metal" => "Firmware — bare metal".into(),
-        "firmware_rtos" => "Firmware — RTOS".into(),
-        "embedded_linux_yocto" => "Embedded Linux / Yocto".into(),
-        "plc_sps" => "PLC / SPS".into(),
-        other => other.replace('_', " "),
-    }
-}
-
-fn str_at<'a>(v: &'a serde_json::Value, key: &str) -> &'a str {
-    v.get(key).and_then(|x| x.as_str()).unwrap_or("")
-}
-
-fn target_id(t: &serde_json::Value) -> String {
-    t.get("_id")
-        .and_then(|o| o.get("$oid"))
-        .and_then(|s| s.as_str())
-        .unwrap_or_default()
-        .to_string()
-}
-
-/// The applicable-scans matrix for one target, fetched on expand.
-#[component]
-fn TargetScans(id: String) -> Element {
-    let scan_id = id.clone();
-    let scans = use_resource(move || {
-        let id = scan_id.clone();
-        async move { fetch_applicable_scans(id).await.ok() }
-    });
-
-    let snapshot = scans.read().clone();
-    match &snapshot {
-        Some(Some(resp)) => {
-            let rows = resp.data.scans.clone();
-            let pentest = resp.data.pentest_supported;
-            rsx! {
-                div { style: "margin-top: 8px;",
-                    if rows.is_empty() {
-                        div { style: "opacity: 0.6;", "No scans available (no code / URL / firmware artifact present)." }
-                    }
-                    for s in rows {
-                        {
-                            let name = str_at(&s, "scan").to_string();
-                            let rationale = str_at(&s, "rationale").to_string();
-                            let blocked = s.get("blocked_reason").and_then(|b| b.as_str()).map(String::from);
-                            let default_on = s.get("default_on").and_then(|b| b.as_bool()).unwrap_or(false);
-                            let badge = if blocked.is_some() {
-                                "badge badge-info"
-                            } else if default_on {
-                                "badge badge-success"
-                            } else {
-                                "badge"
-                            };
-                            rsx! {
-                                div { style: "display: flex; gap: 8px; align-items: center; padding: 4px 0;",
-                                    span { class: "{badge}", "{name}" }
-                                    span { style: "opacity: 0.8; font-size: 0.9em;", "{rationale}" }
-                                    if let Some(b) = blocked {
-                                        span { style: "opacity: 0.6; font-style: italic; font-size: 0.9em;", "— {b}" }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                    if pentest {
-                        div { style: "margin-top: 6px; opacity: 0.75; font-size: 0.85em;",
-                            "Active pentest is supported for this target type."
-                        }
-                    }
-                }
-            }
-        }
-        Some(None) => rsx! { div { style: "opacity: 0.6;", "Failed to load applicable scans." } },
-        None => rsx! { div { style: "opacity: 0.6;", "Loading scans..." } },
-    }
-}
-
-#[component]
-pub fn TargetsPage() -> Element {
-    let mut toasts = use_context::<Toasts>();
-    let mut scanning_ids = use_signal(Vec::<String>::new);
-    let mut expanded_ids = use_signal(Vec::<String>::new);
-    let mut confirm_delete = use_signal(|| Option::<(String, String)>::None);
-
-    // Edit-target modal state.
-    let mut edit_id = use_signal(|| Option::<String>::None);
-    let mut edit_name = use_signal(String::new);
-    let mut edit_type = use_signal(String::new);
-    let mut edit_arts = use_signal(Vec::<ArtifactInputDto>::new);
-    let mut edit_saving = use_signal(|| false);
-    // In-modal "add artifact" mini-form.
-    let mut e_kind = use_signal(|| "git_repo".to_string());
-    let mut e_source = use_signal(String::new);
-    let mut e_branch = use_signal(|| "main".to_string());
-
-    let mut targets = use_resource(move || async move { fetch_targets().await.ok() });
-
-    rsx! {
-        PageHeader {
-            title: "Targets",
-            description: "Onboarded targets and what their scans found. Add new targets from Onboard.",
-        }
-
-        div { style: "margin-bottom: 16px; display: flex; gap: 8px;",
-            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
-                "+ Onboard a target"
-            }
-            button {
-                class: "btn btn-secondary",
-                onclick: move |_| targets.restart(),
-                "Refresh"
-            }
-        }
-
-        // ── Delete confirmation ──
-        if let Some((del_id, del_name)) = confirm_delete() {
-            div { class: "modal-overlay",
-                div { class: "modal-dialog",
-                    h3 { "Delete Target" }
-                    p { "Delete " strong { "{del_name}" } "?" }
-                    p { class: "modal-warning",
-                        "This permanently removes the target and its findings, SBOM entries, scan runs, and CVE alerts."
-                    }
-                    div { class: "modal-actions",
-                        button {
-                            class: "btn btn-secondary",
-                            onclick: move |_| confirm_delete.set(None),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-danger",
-                            onclick: move |_| {
-                                let id = del_id.clone();
-                                let name = del_name.clone();
-                                confirm_delete.set(None);
-                                spawn(async move {
-                                    match delete_target(id).await {
-                                        Ok(_) => {
-                                            toasts.push(ToastType::Success, format!("{name} deleted"));
-                                            targets.restart();
-                                        }
-                                        Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                    }
-                                });
-                            },
-                            "Delete"
-                        }
-                    }
-                }
-            }
-        }
-
-        // ── Edit target ──
-        if let Some(eid) = edit_id() {
-            {
-            let name_err = validate_target_name(&edit_name());
-            let e_source_err = if e_source().is_empty() {
-                None
-            } else {
-                validate_artifact_ref(&e_kind(), &e_source())
-            };
-            rsx! {
-                div { class: "modal-overlay",
-                    div { class: "modal-dialog",
-                        h3 { "Edit target" }
-                        div { class: "form-group",
-                            label { "Name" }
-                            input {
-                                r#type: "text",
-                                value: "{edit_name}",
-                                oninput: move |e| edit_name.set(e.value()),
-                            }
-                            if !edit_name().is_empty() {
-                                if let Some(err) = name_err.clone() {
-                                    div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
-                                }
-                            }
-                        }
-                        div { class: "form-group",
-                            label { "Type" }
-                            select {
-                                value: "{edit_type}",
-                                oninput: move |e| edit_type.set(e.value()),
-                                for (v, l) in TARGET_TYPES.iter().copied() {
-                                    option { value: "{v}", "{l}" }
-                                }
-                            }
-                        }
-                        label { style: "font-weight: 600;", "Artifacts" }
-                        for (i, a) in edit_arts().iter().enumerate() {
-                            div { style: "display: flex; justify-content: space-between; align-items: center; padding: 4px 0;",
-                                span { style: "font-size: 0.9em;",
-                                    span { style: "opacity: 0.7;", "{a.kind}: " }
-                                    span { style: "font-family: monospace;", "{a.source_ref}" }
-                                }
-                                button {
-                                    class: "btn btn-ghost btn-ghost-danger btn-sm",
-                                    onclick: move |_| { edit_arts.write().remove(i); },
-                                    "Remove"
-                                }
-                            }
-                        }
-                        div { style: "display: flex; gap: 8px; align-items: flex-end; margin-top: 8px;",
-                            div { class: "form-group", style: "margin: 0;",
-                                label { "Kind" }
-                                select {
-                                    value: "{e_kind}",
-                                    oninput: move |e| e_kind.set(e.value()),
-                                    for (v, l) in ARTIFACT_KINDS.iter().copied() {
-                                        option { value: "{v}", "{l}" }
-                                    }
-                                }
-                            }
-                            div { class: "form-group", style: "margin: 0; flex: 1;",
-                                label { "Reference" }
-                                input {
-                                    r#type: "text",
-                                    value: "{e_source}",
-                                    oninput: move |e| e_source.set(e.value()),
-                                }
-                            }
-                            if e_kind() == "git_repo" {
-                                div { class: "form-group", style: "margin: 0;",
-                                    label { "Branch" }
-                                    input {
-                                        r#type: "text",
-                                        value: "{e_branch}",
-                                        oninput: move |e| e_branch.set(e.value()),
-                                    }
-                                }
-                            }
-                            button {
-                                class: "btn btn-secondary",
-                                disabled: e_source().trim().is_empty() || e_source_err.is_some(),
-                                onclick: move |_| {
-                                    let kind = e_kind();
-                                    if !e_source().trim().is_empty()
-                                        && validate_artifact_ref(&kind, &e_source()).is_none()
-                                    {
-                                        let branch = if kind == "git_repo" { Some(e_branch()) } else { None };
-                                        edit_arts.write().push(ArtifactInputDto {
-                                            kind,
-                                            source_ref: e_source(),
-                                            branch,
-                                            plc_format: None,
-                                        });
-                                        e_source.set(String::new());
-                                    }
-                                },
-                                "+ Add"
-                            }
-                        }
-                        if let Some(err) = e_source_err.clone() {
-                            div { style: "color: var(--danger, #d33); font-size: 0.85em;", "{err}" }
-                        }
-                        div { class: "modal-actions",
-                            button {
-                                class: "btn btn-secondary",
-                                onclick: move |_| edit_id.set(None),
-                                "Cancel"
-                            }
-                            button {
-                                class: "btn btn-primary",
-                                disabled: edit_saving() || name_err.is_some(),
-                                onclick: move |_| {
-                                    let id = eid.clone();
-                                    let nm = edit_name();
-                                    let tt = edit_type();
-                                    let arts = edit_arts();
-                                    edit_saving.set(true);
-                                    spawn(async move {
-                                        match update_target(id, Some(nm), Some(tt), Some(arts)).await {
-                                            Ok(_) => {
-                                                toasts.push(ToastType::Success, "Target updated");
-                                                targets.restart();
-                                                edit_id.set(None);
-                                            }
-                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                        }
-                                        edit_saving.set(false);
-                                    });
-                                },
-                                if edit_saving() { "Saving..." } else { "Save" }
-                            }
-                        }
-                    }
-                }
-            }
-            }
-        }
-
-        {
-        let targets_snapshot = targets.read().clone();
-        match &targets_snapshot {
-            Some(Some(resp)) => {
-                let rows = resp.data.clone();
-                if rows.is_empty() {
-                    rsx! {
-                        div { class: "card", style: "padding: 24px; text-align: center;",
-                            p { style: "opacity: 0.7;", "No targets yet." }
-                            Link { to: crate::app::Route::OnboardingPage {}, class: "btn btn-primary",
-                                "Onboard your first target"
-                            }
-                        }
-                    }
-                } else {
-                    rsx! {
-                        div { class: "card",
-                            div { class: "table-wrapper",
-                                table {
-                                    thead {
-                                        tr {
-                                            th { "Name" }
-                                            th { "Type" }
-                                            th { "Detected" }
-                                            th { "Artifacts" }
-                                            th { "Findings" }
-                                            th { "Actions" }
-                                        }
-                                    }
-                                    tbody {
-                                        for t in rows {
-                                            {
-                                                let id = target_id(&t);
-                                                let name = str_at(&t, "name").to_string();
-                                                let ttype = pretty_type(str_at(&t, "target_type"));
-                                                let suggested = t
-                                                    .get("classification")
-                                                    .and_then(|c| c.get("suggested"))
-                                                    .and_then(|s| s.as_str())
-                                                    .map(pretty_type);
-                                                let artifacts = t
-                                                    .get("artifacts")
-                                                    .and_then(|a| a.as_array())
-                                                    .cloned()
-                                                    .unwrap_or_default();
-                                                let findings = t
-                                                    .get("findings_count")
-                                                    .and_then(|n| n.as_u64())
-                                                    .unwrap_or(0);
-                                                let facts = t
-                                                    .get("classification")
-                                                    .and_then(|c| c.get("facts"))
-                                                    .and_then(|f| f.as_array())
-                                                    .cloned()
-                                                    .unwrap_or_default();
-                                                let is_scanning = scanning_ids().contains(&id);
-                                                let is_expanded = expanded_ids().contains(&id);
-                                                let id_scan = id.clone();
-                                                let id_exp = id.clone();
-                                                let id_del = id.clone();
-                                                let id_edit = id.clone();
-                                                let name_del = name.clone();
-                                                let name_edit = name.clone();
-                                                let ttype_raw = str_at(&t, "target_type").to_string();
-                                                let artifacts_detail = artifacts.clone();
-                                                let artifacts_edit = artifacts.clone();
-                                                rsx! {
-                                                    tr {
-                                                        td { strong { "{name}" } }
-                                                        td { "{ttype}" }
-                                                        td {
-                                                            if let Some(sug) = suggested.clone() {
-                                                                span { class: "badge badge-success", "{sug}" }
-                                                            } else {
-                                                                span { style: "opacity: 0.5;", "—" }
-                                                            }
-                                                        }
-                                                        td { "{artifacts.len()}" }
-                                                        td { "{findings}" }
-                                                        td { style: "display: flex; gap: 4px;",
-                                                            button {
-                                                                class: "btn btn-ghost",
-                                                                title: "Details",
-                                                                onclick: move |_| {
-                                                                    let mut ids = expanded_ids();
-                                                                    if ids.contains(&id_exp) {
-                                                                        ids.retain(|i| i != &id_exp);
-                                                                    } else {
-                                                                        ids.push(id_exp.clone());
-                                                                    }
-                                                                    expanded_ids.set(ids);
-                                                                },
-                                                                Icon { icon: BsInfoCircle, width: 16, height: 16 }
-                                                            }
-                                                            button {
-                                                                class: "btn btn-ghost",
-                                                                title: "Edit target",
-                                                                onclick: move |_| {
-                                                                    edit_name.set(name_edit.clone());
-                                                                    edit_type.set(ttype_raw.clone());
-                                                                    let arts: Vec<ArtifactInputDto> = artifacts_edit
-                                                                        .iter()
-                                                                        .map(|a| ArtifactInputDto {
-                                                                            kind: str_at(a, "kind").to_string(),
-                                                                            source_ref: str_at(a, "source_ref").to_string(),
-                                                                            branch: a
-                                                                                .get("git")
-                                                                                .and_then(|g| g.get("default_branch"))
-                                                                                .and_then(|b| b.as_str())
-                                                                                .map(String::from),
-                                                                            plc_format: None,
-                                                                        })
-                                                                        .collect();
-                                                                    edit_arts.set(arts);
-                                                                    e_source.set(String::new());
-                                                                    edit_id.set(Some(id_edit.clone()));
-                                                                },
-                                                                Icon { icon: BsPencil, width: 16, height: 16 }
-                                                            }
-                                                            button {
-                                                                class: if is_scanning { "btn btn-ghost btn-scanning" } else { "btn btn-ghost" },
-                                                                title: "Run scan",
-                                                                disabled: is_scanning,
-                                                                onclick: move |_| {
-                                                                    let id = id_scan.clone();
-                                                                    let mut ids = scanning_ids();
-                                                                    ids.push(id.clone());
-                                                                    scanning_ids.set(ids);
-                                                                    spawn(async move {
-                                                                        match trigger_target_scan(id.clone()).await {
-                                                                            Ok(_) => toasts.push(ToastType::Success, "Scan triggered — findings appear as it runs. Use Refresh."),
-                                                                            Err(e) => toasts.push(ToastType::Error, e.to_string()),
-                                                                        }
-                                                                        let mut ids = scanning_ids();
-                                                                        ids.retain(|i| i != &id);
-                                                                        scanning_ids.set(ids);
-                                                                    });
-                                                                },
-                                                                if is_scanning {
-                                                                    span { class: "spinner" }
-                                                                } else {
-                                                                    Icon { icon: BsPlayCircle, width: 16, height: 16 }
-                                                                }
-                                                            }
-                                                            button {
-                                                                class: "btn btn-ghost btn-ghost-danger",
-                                                                title: "Delete target",
-                                                                onclick: move |_| {
-                                                                    confirm_delete.set(Some((id_del.clone(), name_del.clone())));
-                                                                },
-                                                                Icon { icon: BsTrash, width: 16, height: 16 }
-                                                            }
-                                                        }
-                                                    }
-                                                    if is_expanded {
-                                                        tr {
-                                                            td { colspan: "6",
-                                                                div { style: "padding: 12px 8px;",
-                                                                    h4 { style: "margin: 0 0 6px;", "Artifacts" }
-                                                                    if artifacts_detail.is_empty() {
-                                                                        div { style: "opacity: 0.6;", "No artifacts." }
-                                                                    }
-                                                                    for a in artifacts_detail {
-                                                                        div { style: "font-size: 0.9em; padding: 2px 0;",
-                                                                            span { style: "opacity: 0.7;", "{str_at(&a, \"kind\")}: " }
-                                                                            span { style: "font-family: monospace;", "{str_at(&a, \"source_ref\")}" }
-                                                                        }
-                                                                    }
-                                                                    if !facts.is_empty() {
-                                                                        h4 { style: "margin: 12px 0 6px;", "Detected facts" }
-                                                                        for f in facts {
-                                                                            div { style: "font-size: 0.9em; padding: 2px 0;",
-                                                                                span { style: "font-family: monospace;", "{str_at(&f, \"key\")}={str_at(&f, \"value\")}" }
-                                                                                span { style: "opacity: 0.5;", " ({str_at(&f, \"source\")})" }
-                                                                            }
-                                                                        }
-                                                                    }
-                                                                    h4 { style: "margin: 12px 0 6px;", "Applicable scans" }
-                                                                    TargetScans { id: id.clone() }
-                                                                }
-                                                            }
-                                                        }
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            Some(None) => rsx! {
-                div { class: "card", p { "Failed to load targets." } }
-            },
-            None => rsx! {
-                div { class: "loading", "Loading targets..." }
-            },
-        }
-        }
-    }
-}
@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2021"

 [dependencies]
-compliance-core = { workspace = true, features = ["mongodb", "axum"] }
+compliance-core = { workspace = true, features = ["mongodb"] }
 rmcp = { version = "0.16", features = ["server", "macros", "transport-io", "transport-streamable-http-server"] }
 tokio = { workspace = true }
 serde = { workspace = true }
@@ -19,6 +19,3 @@ bson = { version = "2", features = ["chrono-0_4"] }
 schemars = "1.0"
 axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }
-sha2 = { workspace = true }
-hex = { workspace = true }
-dashmap = { workspace = true }
@@ -1,129 +0,0 @@
-//! Bearer-token authentication for incoming MCP HTTP requests.
-//!
-//! LLM clients (Claude Desktop / Cursor / ChatGPT / etc.) can't run
-//! Keycloak OIDC, so the MCP server uses opaque static tokens minted
-//! per-tenant via the agent's `POST /api/v1/mcp-tokens` endpoint.
-//!
-//! Flow per request:
-//! 1. Extract `Authorization: Bearer <token>`. Missing → 401.
-//! 2. SHA-256 hash the token.
-//! 3. Look up the hash in `<prefix>__admin.mcp_tokens`. Missing or
-//!    revoked → 401.
-//! 4. Fire-and-forget update of `last_used_at` so the dashboard can
-//!    show staleness without blocking the handler.
-//! 5. Stash the tenant_id in [`TENANT_ID`] (a `tokio::task_local`) so
-//!    the MCP tool handlers can read it without modifying rmcp's
-//!    handler signatures.
-//!
-//! The `task_local` is scoped around the inner service call via
-//! [`bearer_auth`], so every handler invoked downstream sees the
-//! tenant_id without us having to thread it through the macro-
-//! generated tool router.
-
-use axum::body::Body;
-use axum::extract::{Request, State};
-use axum::http::StatusCode;
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use mongodb::bson::doc;
-use sha2::{Digest, Sha256};
-
-use crate::database::DatabasePool;
-
-tokio::task_local! {
-    /// Tenant id resolved from the bearer for this request. Set by
-    /// [`bearer_auth`] before the inner service runs; read by the
-    /// MCP tool handlers via [`current_tenant_id`].
-    pub static TENANT_ID: String;
-}
-
-/// Mongo collection name in `<prefix>__admin`.
-const COLLECTION: &str = "mcp_tokens";
-
-/// Returns the tenant_id set by the auth middleware. `None` outside a
-/// request scope (e.g. unit tests that bypass the middleware).
-pub fn current_tenant_id() -> Option<String> {
-    TENANT_ID.try_with(|s| s.clone()).ok()
-}
-
-/// Axum middleware: validate bearer → set [`TENANT_ID`] → call inner.
-pub async fn bearer_auth(
-    State(pool): State<DatabasePool>,
-    request: Request,
-    next: Next,
-) -> Response {
-    let Some(token) = extract_bearer(&request) else {
-        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
-    };
-    if !token.starts_with("mcpt_") {
-        return (StatusCode::UNAUTHORIZED, "Invalid token format").into_response();
-    }
-    let token_hash = sha256_hex(&token);
-
-    let col = pool.admin_db().collection::<TokenLookup>(COLLECTION);
-    let found = match col
-        .find_one(doc! { "token_hash": &token_hash, "revoked": false })
-        .await
-    {
-        Ok(Some(t)) => t,
-        Ok(None) => {
-            return (StatusCode::UNAUTHORIZED, "Invalid or revoked token").into_response();
-        }
-        Err(e) => {
-            tracing::error!("MCP token lookup failed: {e}");
-            return (StatusCode::INTERNAL_SERVER_ERROR, "Token lookup error").into_response();
-        }
-    };
-
-    // Fire-and-forget last_used_at update — never block the handler.
-    let col2 = pool.admin_db().collection::<TokenLookup>(COLLECTION);
-    let hash_for_update = token_hash.clone();
-    tokio::spawn(async move {
-        let _ = col2
-            .update_one(
-                doc! { "token_hash": &hash_for_update },
-                doc! { "$set": { "last_used_at": mongodb::bson::DateTime::now() } },
-            )
-            .await;
-    });
-
-    let tenant_id = found.tenant_id;
-    let inner = next.run(request);
-    TENANT_ID.scope(tenant_id, inner).await
-}
-
-/// Bare-bones projection — we don't need the whole `McpToken` here,
-/// just enough to route and confirm validity.
-#[derive(serde::Deserialize)]
-struct TokenLookup {
-    tenant_id: String,
-}
-
-fn extract_bearer(req: &Request<Body>) -> Option<String> {
-    req.headers()
-        .get(axum::http::header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|s| s.strip_prefix("Bearer "))
-        .map(|s| s.trim().to_string())
-        .filter(|s| !s.is_empty())
-}
-
-fn sha256_hex(s: &str) -> String {
-    let mut h = Sha256::new();
-    h.update(s.as_bytes());
-    hex::encode(h.finalize())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn sha256_known_value() {
-        // python -c 'import hashlib; print(hashlib.sha256(b"mcpt_known").hexdigest())'
-        assert_eq!(
-            sha256_hex("mcpt_known"),
-            "27cf6cf678a44244106863c1c031be8e57b84c2b3019d742f755f8e7afa75dfd"
-        );
-    }
-}
@@ -1,127 +1,19 @@
-//! Per-tenant Mongo broker for the MCP server.
-//!
-//! Mirror of the agent's `compliance_agent::database::DatabasePool` —
-//! duplicated here rather than lifted into `compliance-core` to keep
-//! this PR focused. If a third consumer ever needs it, lift then.
-//!
-//! Bearer tokens (validated by the auth middleware) carry a tenant_id
-//! and the handler resolves the per-tenant database via
-//! [`DatabasePool::for_tenant_id`]. The admin database
-//! (`<db_prefix>__admin`) holds the cross-tenant `mcp_tokens`
-//! collection that the middleware queries on every request.
-
-use std::sync::Arc;
-
-use dashmap::DashMap;
-use mongodb::{bson::doc, Client, Collection};
-use sha2::{Digest, Sha256};
+use mongodb::{Client, Collection};

 use compliance_core::models::*;

-/// 63-byte Mongo db-name cap; same invariant as the agent's pool.
-const MAX_DB_NAME_LEN: usize = 63;
-/// 16-byte SHA-256 truncation, hex-encoded → 32 chars.
-const HASH_HEX_LEN: usize = 32;
-const MAX_PREFIX_LEN: usize = MAX_DB_NAME_LEN - 1 - HASH_HEX_LEN;
-
-#[derive(Clone, Debug)]
-pub struct DatabasePool {
-    client: Client,
-    db_prefix: String,
-    /// Tenants we've handed out a [`Database`] for. The MCP server
-    /// doesn't ensure indexes (the agent owns that side of the
-    /// schema), so the marker exists only to satisfy the parallel
-    /// shape — current code never reads it.
-    #[allow(dead_code)]
-    seen: Arc<DashMap<String, ()>>,
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum DbError {
-    #[error("db_prefix '{prefix}' is {len} chars; max is {max} so the hash-fallback DB name fits Mongo's 63-byte cap")]
-    PrefixTooLong {
-        prefix: String,
-        len: usize,
-        max: usize,
-    },
-    #[error(transparent)]
-    Mongo(#[from] mongodb::error::Error),
-}
-
-impl DatabasePool {
-    pub async fn connect(uri: &str, db_prefix: &str) -> Result<Self, DbError> {
-        if db_prefix.len() > MAX_PREFIX_LEN {
-            return Err(DbError::PrefixTooLong {
-                prefix: db_prefix.to_string(),
-                len: db_prefix.len(),
-                max: MAX_PREFIX_LEN,
-            });
-        }
-        let client = Client::with_uri_str(uri).await?;
-        client
-            .database("admin")
-            .run_command(doc! { "ping": 1 })
-            .await?;
-        tracing::info!(
-            "MCP MongoDB cluster reachable; per-tenant pool ready (db prefix '{db_prefix}')"
-        );
-        Ok(Self {
-            client,
-            db_prefix: db_prefix.to_string(),
-            seen: Arc::new(DashMap::new()),
-        })
-    }
-
-    /// Read-only handle to the tenant's database. No indexes are
-    /// ensured here — the agent owns writes, MCP only reads.
-    pub fn for_tenant_id(&self, tenant_id: &str) -> Database {
-        let db_name = self.tenant_db_name(tenant_id);
-        self.seen.insert(tenant_id.to_string(), ());
-        Database::new(self.client.database(&db_name))
-    }
-
-    /// Cross-tenant admin DB — holds the `mcp_tokens` collection that
-    /// the auth middleware queries to map bearer → tenant_id.
-    pub fn admin_db(&self) -> mongodb::Database {
-        self.client.database(&format!("{}__admin", self.db_prefix))
-    }
-
-    pub fn tenant_db_name(&self, tenant_id: &str) -> String {
-        let sanitized = sanitize_tenant_id(tenant_id);
-        let natural = format!("{}_{}", self.db_prefix, sanitized);
-        if natural.len() <= MAX_DB_NAME_LEN {
-            natural
-        } else {
-            let mut h = Sha256::new();
-            h.update(tenant_id.as_bytes());
-            let digest = h.finalize();
-            let suffix = hex::encode(&digest[..HASH_HEX_LEN / 2]);
-            format!("{}_{}", self.db_prefix, suffix)
-        }
-    }
-}
-
-fn sanitize_tenant_id(tenant_id: &str) -> String {
-    tenant_id
-        .chars()
-        .map(|c| match c {
-            '/' | '\\' | '.' | '"' | '$' | ' ' | '\0' => '_',
-            c => c,
-        })
-        .collect()
-}
-
-/// Typed accessors for the MCP-readable collections in a tenant DB.
-/// Matches the agent's `Database` shape but only exposes what the MCP
-/// tool handlers actually need.
 #[derive(Clone, Debug)]
 pub struct Database {
    inner: mongodb::Database,
 }

 impl Database {
-    pub(crate) fn new(inner: mongodb::Database) -> Self {
-        Self { inner }
+    pub async fn connect(uri: &str, db_name: &str) -> Result<Self, mongodb::error::Error> {
+        let client = Client::with_uri_str(uri).await?;
+        let db = client.database(db_name);
+        db.run_command(mongodb::bson::doc! { "ping": 1 }).await?;
+        tracing::info!("MCP server connected to MongoDB '{db_name}'");
+        Ok(Self { inner: db })
    }

    pub fn findings(&self) -> Collection<Finding> {
@@ -1,11 +1,10 @@
-mod auth;
 mod database;
 mod server;
 mod tools;

 use std::sync::Arc;

-use database::DatabasePool;
+use database::Database;
 use rmcp::transport::{
    streamable_http_server::session::local::LocalSessionManager, StreamableHttpServerConfig,
    StreamableHttpService,
@@ -25,60 +24,36 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {

    let mongo_uri =
        std::env::var("MONGODB_URI").unwrap_or_else(|_| "mongodb://localhost:27017".to_string());
-    // MONGODB_DATABASE is reused as the per-tenant DB-name prefix —
-    // same convention as the agent so `<prefix>__admin.mcp_tokens`
-    // and `<prefix>_<tenant_id>` line up across services.
-    let db_prefix =
+    let db_name =
        std::env::var("MONGODB_DATABASE").unwrap_or_else(|_| "compliance_scanner".to_string());

-    let pool = DatabasePool::connect(&mongo_uri, &db_prefix).await?;
+    let db = Database::connect(&mongo_uri, &db_name).await?;

-    // HTTP transport: bind a small axum router with bearer-auth in
-    // front of the rmcp service. `/health` stays public for orca's
-    // container probe.
+    // If MCP_PORT is set, run as Streamable HTTP server; otherwise use stdio.
    if let Ok(port_str) = std::env::var("MCP_PORT") {
        let port: u16 = port_str.parse()?;
        tracing::info!("Starting MCP server on HTTP port {port}");

-        let pool_for_factory = pool.clone();
+        let db_clone = db.clone();
        let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
+            move || Ok(ComplianceMcpServer::new(db_clone.clone())),
            Arc::new(LocalSessionManager::default()),
            StreamableHttpServerConfig::default(),
        );

        let router = axum::Router::new()
            .route("/health", axum::routing::get(|| async { "ok" }))
-            .nest_service(
-                "/mcp",
-                axum::Router::new().fallback_service(service).layer(
-                    axum::middleware::from_fn_with_state(pool.clone(), auth::bearer_auth),
-                ),
-            );
+            .nest_service("/mcp", service);
        let listener = tokio::net::TcpListener::bind(("0.0.0.0", port)).await?;
        tracing::info!("MCP HTTP server listening on 0.0.0.0:{port}");
        axum::serve(listener, router).await?;
    } else {
-        // stdio transport — used when run as a local MCP server next
-        // to the LLM client. There's no HTTP layer to do bearer auth,
-        // so we synthesize a tenant_id from STDIO_TENANT_ID for local
-        // development. NEVER use this in production.
        tracing::info!("Starting MCP server on stdio");
-        let synth_tenant = std::env::var("STDIO_TENANT_ID").unwrap_or_else(|_| "dev".to_string());
-        tracing::warn!(
-            tenant_id = %synth_tenant,
-            "stdio transport — using synthetic tenant id; DO NOT use in production"
-        );
-        let server = ComplianceMcpServer::new(pool);
+        let server = ComplianceMcpServer::new(db);
        let transport = rmcp::transport::stdio();
        use rmcp::ServiceExt;
-        auth::TENANT_ID
-            .scope(synth_tenant, async {
-                let handle = server.serve(transport).await?;
-                handle.waiting().await?;
-                Ok::<_, Box<dyn std::error::Error>>(())
-            })
-            .await?;
+        let handle = server.serve(transport).await?;
+        handle.waiting().await?;
    }

    Ok(())
@@ -2,37 +2,20 @@ use rmcp::{
    handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
 };

-use crate::auth::current_tenant_id;
-use crate::database::{Database, DatabasePool};
+use crate::database::Database;
 use crate::tools::{dast, findings, pentest, sbom};

 pub struct ComplianceMcpServer {
-    pool: DatabasePool,
+    db: Database,
    #[allow(dead_code)]
    tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
 }

-impl ComplianceMcpServer {
-    /// Resolve the per-tenant `Database` from the bearer-set
-    /// `task_local`. Every tool handler calls this; missing context
-    /// surfaces as `internal_error` because it means the auth
-    /// middleware was misconfigured (handler ran without scope).
-    fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
-        let tenant_id = current_tenant_id().ok_or_else(|| {
-            rmcp::ErrorData::internal_error(
-                "no tenant context — bearer middleware not in chain".to_string(),
-                None,
-            )
-        })?;
-        Ok(self.pool.for_tenant_id(&tenant_id))
-    }
-}
-
 #[tool_router]
 impl ComplianceMcpServer {
-    pub fn new(pool: DatabasePool) -> Self {
+    pub fn new(db: Database) -> Self {
        Self {
-            pool,
+            db,
            tool_router: Self::tool_router(),
        }
    }
@@ -46,8 +29,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<findings::ListFindingsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        findings::list_findings(&db, params).await
+        findings::list_findings(&self.db, params).await
    }

    #[tool(description = "Get a single finding by its ID")]
@@ -55,8 +37,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<findings::GetFindingParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        findings::get_finding(&db, params).await
+        findings::get_finding(&self.db, params).await
    }

    #[tool(description = "Get a summary of findings counts grouped by severity and status")]
@@ -64,8 +45,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<findings::FindingsSummaryParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        findings::findings_summary(&db, params).await
+        findings::findings_summary(&self.db, params).await
    }

    // ── SBOM ──────────────────────────────────────────────
@@ -77,8 +57,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<sbom::ListSbomPackagesParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        sbom::list_sbom_packages(&db, params).await
+        sbom::list_sbom_packages(&self.db, params).await
    }

    #[tool(
@@ -88,8 +67,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<sbom::SbomVulnReportParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        sbom::sbom_vuln_report(&db, params).await
+        sbom::sbom_vuln_report(&self.db, params).await
    }

    // ── DAST ──────────────────────────────────────────────
@@ -101,8 +79,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<dast::ListDastFindingsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        dast::list_dast_findings(&db, params).await
+        dast::list_dast_findings(&self.db, params).await
    }

    #[tool(description = "Get a summary of recent DAST scan runs and finding counts")]
@@ -110,8 +87,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<dast::DastScanSummaryParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        dast::dast_scan_summary(&db, params).await
+        dast::dast_scan_summary(&self.db, params).await
    }

    // ── Pentest ─────────────────────────────────────────────
@@ -123,8 +99,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::ListPentestSessionsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        pentest::list_pentest_sessions(&db, params).await
+        pentest::list_pentest_sessions(&self.db, params).await
    }

    #[tool(description = "Get a single AI pentest session by its ID")]
@@ -132,8 +107,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::GetPentestSessionParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        pentest::get_pentest_session(&db, params).await
+        pentest::get_pentest_session(&self.db, params).await
    }

    #[tool(
@@ -143,8 +117,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::GetAttackChainParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        pentest::get_attack_chain(&db, params).await
+        pentest::get_attack_chain(&self.db, params).await
    }

    #[tool(description = "Get chat messages from a pentest session")]
@@ -152,8 +125,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::GetPentestMessagesParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        pentest::get_pentest_messages(&db, params).await
+        pentest::get_pentest_messages(&self.db, params).await
    }

    #[tool(
@@ -163,8 +135,7 @@ impl ComplianceMcpServer {
        &self,
        Parameters(params): Parameters<pentest::PentestStatsParams>,
    ) -> Result<CallToolResult, rmcp::ErrorData> {
-        let db = self.tenant_db()?;
-        pentest::pentest_stats(&db, params).await
+        pentest::pentest_stats(&self.db, params).await
    }
 }

@@ -178,7 +149,7 @@ impl ServerHandler for ComplianceMcpServer {
                .build(),
            server_info: Implementation::from_build_env(),
            instructions: Some(
-                "Compliance Scanner MCP server. Query security findings, SBOM data, DAST results, and AI pentest sessions for your tenant."
+                "Compliance Scanner MCP server. Query security findings, SBOM data, DAST results, and AI pentest sessions."
                    .to_string(),
            ),
        }
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-# Seed the nix store on first start, then run the agent.
-#
-# The firmware-SBOM pipeline drives a real `nix` build (tramiton NixBackend).
-# The image ships the store as a bootstrap tarball rather than baking /nix, so a
-# persistent /nix volume (mounted empty on first deploy) gets populated once and
-# then survives redeploys. Seeding is best-effort: if it fails, the agent still
-# starts and firmware SBOMs fall back to analysis-only.
-if [ ! -e /nix/store ]; then
-  echo "agent-entrypoint: seeding /nix store from image bootstrap..."
-  mkdir -p /nix
-  if tar -C / -xzf /opt/nix-bootstrap.tar.gz; then
-    echo "agent-entrypoint: /nix store seeded."
-  else
-    echo "agent-entrypoint: WARN nix seed failed; firmware SBOM will use analysis-only fallback."
-  fi
-fi
-
-exec compliance-agent "$@"