refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a) #208

2026-07-17T12:25:44Z

sharang commented

2026-07-17 12:25:44 +00:00

Foundation for the Werkbank Docker executor (sharang/werkbank#5). The dynamic-execution logic has to be usable by the runner (a separate repo), so this lifts it out of compliance-agent into a shared crate. Pure move + rename — no behaviour change.

New crate `werkbank-exec`

git mv preserves history:

src/ics/* — the read-only industrial-protocol probe (Modbus / OPC-UA / EtherNet-IP / portscan).
src/plc/* — ephemeral soft-PLC provisioning (DockerSoftPlc), the OpenPLC program-load client, and provision_and_test / extract_program.
src/error.rs — a crate-local ExecError replacing the agent's AgentError.
src/fingerprint.rs — compute_fingerprint, copied from the agent's dedup.

Depends only on compliance-core + compliance-dast, so the runner can pull it without the agent's server stack (mongodb/axum/etc.).

`compliance-agent` consumes it

AgentError gains Exec(#[from] werkbank_exec::ExecError).
The orchestrator's ICS-probe and provision-and-test call sites point at werkbank_exec::{ics,plc}; the old pipeline::ics and plc::runtime modules are removed (the static PLC scanner stays in the agent).
CI now clippy-checks and tests werkbank-exec.

Verification

27 moved tests pass in the new crate; 283 agent lib tests pass; clippy (-D warnings) + fmt clean; full workspace compiles.

Foundation for the Werkbank Docker executor (sharang/werkbank#5). The dynamic-execution logic has to be usable by the runner (a **separate repo**), so this lifts it out of `compliance-agent` into a shared crate. **Pure move + rename — no behaviour change.** ## New crate `werkbank-exec` `git mv` preserves history: - **`src/ics/*`** — the read-only industrial-protocol probe (Modbus / OPC-UA / EtherNet-IP / portscan). - **`src/plc/*`** — ephemeral soft-PLC provisioning (`DockerSoftPlc`), the OpenPLC program-load client, and `provision_and_test` / `extract_program`. - **`src/error.rs`** — a crate-local `ExecError` replacing the agent's `AgentError`. - **`src/fingerprint.rs`** — `compute_fingerprint`, copied from the agent's `dedup`. Depends only on `compliance-core` + `compliance-dast`, so the runner can pull it without the agent's server stack (mongodb/axum/etc.). ## `compliance-agent` consumes it - `AgentError` gains `Exec(#[from] werkbank_exec::ExecError)`. - The orchestrator's ICS-probe and provision-and-test call sites point at `werkbank_exec::{ics,plc}`; the old `pipeline::ics` and `plc::runtime` modules are removed (the **static** PLC scanner stays in the agent). - CI now clippy-checks and tests `werkbank-exec`. ## Verification 27 moved tests pass in the new crate; **283 agent lib tests pass**; clippy (`-D warnings`) + fmt clean; full workspace compiles. ## Next werkbank's Docker executor (`impl Executor` → `werkbank_exec::plc::provision_and_test` → `JobResult`), once this crate is on `main` for the runner repo to depend on. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-07-17 12:25:45 +00:00

refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a)

CI / Check (pull_request) Successful in 6m19s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

e5f4b562c3

Prep for the Werkbank Docker executor (sharang/werkbank#5): the dynamic-execution
logic has to be usable by the runner (a separate repo), so lift it out of the
agent into a shared crate.

New crate `werkbank-exec` (git-mv preserves history):
- src/ics/*        — the read-only industrial-protocol probe (Modbus/OPC-UA/
                     EtherNet-IP/portscan), moved verbatim.
- src/plc/*        — ephemeral soft-PLC provisioning (DockerSoftPlc), the OpenPLC
                     program-load client, and provision_and_test/extract_program.
- src/error.rs     — a crate-local ExecError, replacing the agent's AgentError.
- src/fingerprint.rs — compute_fingerprint (copied from the agent's dedup).
Depends only on compliance-core + compliance-dast, so the runner can pull it
without the agent's server stack.

compliance-agent consumes it:
- AgentError gains `Exec(#[from] werkbank_exec::ExecError)`.
- The orchestrator's ICS-probe + provision-and-test call sites point at
  werkbank_exec::{ics,plc}; the old pipeline::ics and plc::runtime modules are
  removed (the static PLC scanner stays).
- CI clippy-checks + tests the new crate.

Pure move + rename — no behaviour change. 27 moved tests pass in the new crate;
283 agent lib tests pass; clippy + fmt clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 70a4ee55ab into main

2026-07-17 12:56:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#208

refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a) #208

New crate werkbank-exec

compliance-agent consumes it

Verification

Next

New crate `werkbank-exec`

`compliance-agent` consumes it