ONB-01 · Target taxonomy + unified data model (OnboardedTarget/TargetType/Artifact) #119

New Issue

2026-07-10T08:34:41Z

sharang commented

2026-07-10 08:34:41 +00:00

Part of #118.

Context

Three target models exist today with no shared abstraction: TrackedRepository (SAST path), DastTarget (DAST path), and the pentest target/PentestSession. None captures what kind of software the target is, nor which artifacts it has.

Scope

Add TargetType enum: WebApp, BackendService, DesktopApp, AndroidApp, IosApp, FirmwareBareMetal, FirmwareRtos, EmbeddedLinuxYocto, PlcSps.
Add ArtifactKind enum: GitRepo, SourceArchive, FirmwareImage, MobilePackage (APK/AAB/IPA), ContainerImage, LiveUrl, PlcProject, PlaintextDescription.
Add OnboardedTarget aggregate: id, name, target_type, Vec<Artifact>, enabled scan configs, environment, timestamps. Artifact { kind, location/ref, metadata, detected_facts }.
Mongo repository (CRUD + list/paginate), following the existing repo/model conventions in compliance-core/src/models/ and the Mongo repo layer.
Keep TrackedRepository/DastTarget compiling (migration handled in ONB-14).

Acceptance criteria

Models serialize/deserialize (bson round-trip test in compliance-core/tests/models.rs).
Repo layer has create/get/list/update/delete with pagination.
No behavior change to existing scan paths yet.

Depends on

None (foundational — do first).

Part of #118. ## Context Three target models exist today with no shared abstraction: `TrackedRepository` (SAST path), `DastTarget` (DAST path), and the pentest target/`PentestSession`. None captures *what kind of software* the target is, nor which artifacts it has. ## Scope - Add `TargetType` enum: `WebApp`, `BackendService`, `DesktopApp`, `AndroidApp`, `IosApp`, `FirmwareBareMetal`, `FirmwareRtos`, `EmbeddedLinuxYocto`, `PlcSps`. - Add `ArtifactKind` enum: `GitRepo`, `SourceArchive`, `FirmwareImage`, `MobilePackage` (APK/AAB/IPA), `ContainerImage`, `LiveUrl`, `PlcProject`, `PlaintextDescription`. - Add `OnboardedTarget` aggregate: id, name, `target_type`, `Vec<Artifact>`, enabled scan configs, environment, timestamps. `Artifact { kind, location/ref, metadata, detected_facts }`. - Mongo repository (CRUD + list/paginate), following the existing repo/model conventions in `compliance-core/src/models/` and the Mongo repo layer. - Keep `TrackedRepository`/`DastTarget` compiling (migration handled in ONB-14). ## Acceptance criteria - Models serialize/deserialize (bson round-trip test in `compliance-core/tests/models.rs`). - Repo layer has create/get/list/update/delete with pagination. - No behavior change to existing scan paths yet. ## Depends on None (foundational — do first).

sharang added this to the Onboarding v1 milestone 2026-07-10 08:34:41 +00:00

sharang added the enhancement onboarding labels 2026-07-10 08:34:41 +00:00

sharang referenced this issue

2026-07-10 08:41:02 +00:00

ONB-Epic · Multi-target artifact-aware onboarding wizard #118

sharang referenced this issue

2026-07-10 09:02:05 +00:00

ONB-15 · Unified scan-pipeline rewrite (feature-flagged run_target path) #133

sharang referenced this issue from a commit

2026-07-10 10:23:59 +00:00

feat(onboarding): unified multi-target model + scan matrix foundation

sharang referenced this issue