feat(onboarding): unified multi-target model + scan matrix foundation #134

Merged

sharang merged 2 commits from feat/onboarding-foundation into main 2026-07-10 13:41:26 +00:00

Conversation 0 Commits 2 Files Changed 10

+1085 -4

sharang commented 2026-07-10 10:24:23 +00:00

Owner

Copy Link

Copy Source

What

Backend foundation for the artifact-aware onboarding redesign (epic #118). Replaces the git-only TrackedRepository / DastTarget split with a single OnboardedTarget that is classified by what kind of software it is and carries the concrete artifacts provided for it.

This is steps 1–2 of the approved plan (full-unification, foundation-first). It is purely additive — no legacy scan path is touched, and the old models/collections stay in place. Nothing wires into the pipeline yet.

Changes

compliance-core

• models/onboarding.rs (new) — OnboardedTarget with TargetType (9 families: web, backend, desktop, Android, iOS, bare-metal firmware, RTOS firmware, Yocto, PLC/SPS) and ArtifactKind (8 kinds: git, source archive, firmware image, mobile package, container image, live URL, PLC project, plaintext). Artifact carries per-kind config + ArtifactAuth (folds TrackedRepository git auth and DastAuthConfig). Plus Classification, TargetScanConfig (reuses the existing PentestConfig / tracker config).
• scan_matrix.rs (new) — table-driven applicable_scans(target) / rules_for(type) / supports_pentest(type). The SAST umbrella + firmware/PLC/mobile/DAST scans are gated on which artifacts are actually present; a scan whose artifact is missing comes back with a blocked_reason.
• traits/classifier.rs (new) — TargetClassifier port, mirroring the existing Scanner trait.
• models/scan.rs — additive ScanType / ScanPhase variants (firmware-static, PLC control-logic, mobile-static, container). ScanType now derives Copy.

compliance-agent

• database.rs — onboarded_targets() collection accessor + 3 indexes (artifacts.source_ref, artifacts.kind, target_type).
• pipeline/patterns.rs — drop a now-redundant ScanType clone surfaced by the Copy derive.

Design notes

• Id-preservation strategy (for the later migration): OnboardedTarget._id is meant to occupy the same id-space as the legacy TrackedRepository / DastTarget _id, so downstream collections keyed by repo_id / target_id keep resolving with zero row rewrites. This PR only lays the model; the migration is a later step (#132).
• The unique-git_url guarantee moves from a DB unique index to an app-level check (a unique multikey index on an array field has null-collision caveats) — the artifacts.source_ref index here is intentionally non-unique.

Testing

17 new unit tests (serde/bson round-trip, enum display, artifact helpers, DastAuthConfig fold, and the applicable_scans truth table per target type). Verified against the exact CI commands:

• cargo fmt --all --check ✓
• cargo clippy -p compliance-agent -- -D warnings ✓
• cargo clippy -p compliance-dashboard --features server --no-default-features -- -D warnings ✓
• cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings ✓
• cargo clippy -p compliance-mcp -- -D warnings ✓
• cargo test -p compliance-core ✓ (19 pass)

Follow-ups (tracked)

Next: artifact ingest (#120) and the classifier impls + tramiton detector (#121), then the feature-flagged pipeline rewrite (#133) and migration (#132). Full breakdown in epic #118.

Refs #118, #119, #122, #121.

## What Backend **foundation** for the artifact-aware onboarding redesign (epic #118). Replaces the git-only `TrackedRepository` / `DastTarget` split with a single `OnboardedTarget` that is classified by *what kind of software* it is and carries the concrete artifacts provided for it. This is **steps 1–2** of the approved plan (full-unification, foundation-first). It is **purely additive** — no legacy scan path is touched, and the old models/collections stay in place. Nothing wires into the pipeline yet. ## Changes **compliance-core** - `models/onboarding.rs` (new) — `OnboardedTarget` with `TargetType` (9 families: web, backend, desktop, Android, iOS, bare-metal firmware, RTOS firmware, Yocto, PLC/SPS) and `ArtifactKind` (8 kinds: git, source archive, firmware image, mobile package, container image, live URL, PLC project, plaintext). `Artifact` carries per-kind config + `ArtifactAuth` (folds `TrackedRepository` git auth *and* `DastAuthConfig`). Plus `Classification`, `TargetScanConfig` (reuses the existing `PentestConfig` / tracker config). - `scan_matrix.rs` (new) — table-driven `applicable_scans(target)` / `rules_for(type)` / `supports_pentest(type)`. The SAST umbrella + firmware/PLC/mobile/DAST scans are gated on which artifacts are actually present; a scan whose artifact is missing comes back with a `blocked_reason`. - `traits/classifier.rs` (new) — `TargetClassifier` port, mirroring the existing `Scanner` trait. - `models/scan.rs` — additive `ScanType` / `ScanPhase` variants (firmware-static, PLC control-logic, mobile-static, container). `ScanType` now derives `Copy`. **compliance-agent** - `database.rs` — `onboarded_targets()` collection accessor + 3 indexes (`artifacts.source_ref`, `artifacts.kind`, `target_type`). - `pipeline/patterns.rs` — drop a now-redundant `ScanType` clone surfaced by the `Copy` derive. ## Design notes - **Id-preservation strategy** (for the later migration): `OnboardedTarget._id` is meant to occupy the same id-space as the legacy `TrackedRepository` / `DastTarget` `_id`, so downstream collections keyed by `repo_id` / `target_id` keep resolving with zero row rewrites. This PR only lays the model; the migration is a later step (#132). - The unique-`git_url` guarantee moves from a DB unique index to an app-level check (a unique multikey index on an array field has null-collision caveats) — the `artifacts.source_ref` index here is intentionally non-unique. ## Testing 17 new unit tests (serde/bson round-trip, enum display, artifact helpers, `DastAuthConfig` fold, and the `applicable_scans` truth table per target type). Verified against the exact CI commands: - `cargo fmt --all --check` ✓ - `cargo clippy -p compliance-agent -- -D warnings` ✓ - `cargo clippy -p compliance-dashboard --features server --no-default-features -- -D warnings` ✓ - `cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings` ✓ - `cargo clippy -p compliance-mcp -- -D warnings` ✓ - `cargo test -p compliance-core` ✓ (19 pass) ## Follow-ups (tracked) Next: artifact ingest (#120) and the classifier impls + tramiton detector (#121), then the feature-flagged pipeline rewrite (#133) and migration (#132). Full breakdown in epic #118. Refs #118, #119, #122, #121.

sharang added this to the Onboarding v1 milestone 2026-07-10 10:24:23 +00:00

sharang added the onboardingenhancement labels 2026-07-10 10:24:23 +00:00

sharang added 1 commit 2026-07-10 10:24:24 +00:00

feat(onboarding): unified multi-target model + scan matrix foundation ... def7371d6a

Backend foundation for the artifact-aware onboarding redesign (epic #118),
replacing the git-only TrackedRepository / DastTarget split with a unified
OnboardedTarget classified by target type and carrying its artifacts.

compliance-core:
- OnboardedTarget model: TargetType (9 families), ArtifactKind (8 kinds),
  Artifact with per-kind config, ArtifactAuth (folds git auth + DastAuthConfig),
  Classification, TargetScanConfig (reuses pentest + tracker config).
- Table-driven scan-applicability matrix: applicable_scans / rules_for /
  supports_pentest, with SAST umbrella + firmware/PLC/mobile/DAST gated on
  artifact presence.
- TargetClassifier port trait, mirroring the Scanner trait.
- Additive ScanType/ScanPhase variants (firmware/PLC/mobile/container);
  ScanType is now Copy.

compliance-agent:
- onboarded_targets collection accessor + indexes (artifacts.source_ref,
  artifacts.kind, target_type).
- Drop a now-redundant ScanType clone surfaced by the Copy derive.

Foundation only (steps 1-2 of the approved plan); legacy scan paths untouched.
17 new unit tests; passes fmt + clippy -D warnings (agent, dashboard, mcp).

Refs #118, #119, #122, #121.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang referenced this pull request 2026-07-10 10:53:11 +00:00

feat(onboarding): artifact ingest + classifier + suite-integration seams #138

sharang added 1 commit 2026-07-10 13:30:48 +00:00

fix(audit): bump crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204) ... e99c34630e

Invalid pointer dereference in the `fmt::Pointer` impl for `Atomic`/`Shared`
when the underlying pointer is invalid. Lockfile-only bump; no code changes.

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 675c4ef699 into main 2026-07-10 13:41:26 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels enhancement onboarding

Milestone

No items

No Milestone Onboarding v1

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#134