Implements #164 (part of the CODESYS-on-Yocto tracker #167).
A PLC/SPS device is a composite: the control applicationand the device
it runs on (firmware/OS + reachable runtime services). Previously PlcSps offered
only PlcControlLogic, so a CODESYS-on-Yocto device's firmware and network attack
surface was invisible to onboarding.
Changes
scan_matrix: PlcSps now offers FirmwareStatic + Sbom + Cve (require a
firmware image) and Dast (require a running endpoint, e.g. WebVisu), and supports_pentest(PlcSps) is now true.
PlcControlLogic stays default-on; the device-level scans are offered but
opt-in (default-off). Firmware-image SBOM/CVE execution is shared with the
firmware families and still landing (#151/#128), so they must not silently
auto-run — declaring them keeps the wizard honest without phantom no-ops.
orchestrator: the PLC branch no longer early-returns; a PLC device with a
reachable endpoint now also runs DAST (the already-wired path) after the
control-logic scan.
Implements **#164** (part of the CODESYS-on-Yocto tracker **#167**).
A PLC/SPS device is a composite: the **control application** *and* the **device**
it runs on (firmware/OS + reachable runtime services). Previously `PlcSps` offered
only `PlcControlLogic`, so a CODESYS-on-Yocto device's firmware and network attack
surface was invisible to onboarding.
## Changes
- **`scan_matrix`**: `PlcSps` now offers `FirmwareStatic` + `Sbom` + `Cve` (require a
firmware image) and `Dast` (require a running endpoint, e.g. WebVisu), and
`supports_pentest(PlcSps)` is now `true`.
- `PlcControlLogic` stays **default-on**; the device-level scans are **offered but
opt-in** (default-off). Firmware-image SBOM/CVE *execution* is shared with the
firmware families and still landing (#151/#128), so they must not silently
auto-run — declaring them keeps the wizard honest without phantom no-ops.
- **`orchestrator`**: the PLC branch no longer early-returns; a PLC device with a
reachable endpoint now also runs **DAST** (the already-wired path) after the
control-logic scan.
## Tests
- New: `plc_composite_lights_up_device_scans_with_firmware_and_url`,
`plc_control_logic_is_default_on_and_device_scans_block_without_artifacts`.
- Updated `pentest_support_matches_reachable_families` (PlcSps + Yocto).
- Full `compliance-core` + `compliance-agent` lib suites green; fmt + clippy
(agent/mcp) clean.
## Follow-ups (tracked, not in this PR)
- Firmware-**image** SBOM/CVE execution for device targets → #151 / #128.
- ICS DAST/pentest depth (11740 / OPC UA / Modbus, soft-PLC harness) → #148 / #149.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
A PLC/SPS device is two layers — the control application and the device it
runs on (firmware/OS + reachable runtime services). Previously PlcSps offered
only PlcControlLogic, so a CODESYS-on-Yocto device's firmware and network
attack surface was invisible.
- scan_matrix: PlcSps now offers FirmwareStatic + Sbom + Cve (require a firmware
image) and Dast (require a running endpoint, e.g. WebVisu), and
supports_pentest(PlcSps) is now true. Control-logic stays default-on; the
device-level scans are offered but opt-in (default-off) — firmware-image
SBOM/CVE execution is shared with the firmware families and still landing
(#151/#128), so they must not silently auto-run.
- orchestrator: the PLC branch no longer early-returns, so a PLC device with a
reachable endpoint also runs DAST (the wired path) after the control-logic scan.
Part of the CODESYS-on-Yocto coverage tracker (#167). Closes#164.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang
merged commit 3a53a1d7f2 into main2026-07-16 10:56:36 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #164 (part of the CODESYS-on-Yocto tracker #167).
A PLC/SPS device is a composite: the control application and the device
it runs on (firmware/OS + reachable runtime services). Previously
PlcSpsofferedonly
PlcControlLogic, so a CODESYS-on-Yocto device's firmware and network attacksurface was invisible to onboarding.
Changes
scan_matrix:PlcSpsnow offersFirmwareStatic+Sbom+Cve(require afirmware image) and
Dast(require a running endpoint, e.g. WebVisu), andsupports_pentest(PlcSps)is nowtrue.PlcControlLogicstays default-on; the device-level scans are offered butopt-in (default-off). Firmware-image SBOM/CVE execution is shared with the
firmware families and still landing (#151/#128), so they must not silently
auto-run — declaring them keeps the wizard honest without phantom no-ops.
orchestrator: the PLC branch no longer early-returns; a PLC device with areachable endpoint now also runs DAST (the already-wired path) after the
control-logic scan.
Tests
plc_composite_lights_up_device_scans_with_firmware_and_url,plc_control_logic_is_default_on_and_device_scans_block_without_artifacts.pentest_support_matches_reachable_families(PlcSps + Yocto).compliance-core+compliance-agentlib suites green; fmt + clippy(agent/mcp) clean.
Follow-ups (tracked, not in this PR)
🤖 Generated with Claude Code