feat(oscal): ingest breakpilot OSCAL catalog via OscalControlsProvider #210

2026-07-20T16:03:57Z

sharang commented

2026-07-20 16:03:57 +00:00

What

The ingest half of the CRA/OSCAL controls loop: pull breakpilot-compliance's OSCAL catalog and map it into our controls corpus.

Pairs with breakpilot-compliance#128 (the OSCAL export endpoint, merged). This is the import/consume side.

Commits

feat(core): OSCAL 1.1 catalog types + mapping to controls corpus — pure serde (compliance-core/models/oscal.rs). OscalDocument::to_controls() flattens the catalog into the framework-agnostic traits::Control; framework() / content_hash() accessors. Fixture-tested against the real 40-control CRA catalog.
feat(agent): OscalControlsProvider (pull + snapshot) — implements ControlsProvider; fetches GET /api/compliance/v1/oscal/catalog?framework=<fw> (bearer-optional), snapshots the exact bytes, and falls back to the last snapshot on fetch failure so scans still run offline; naive context ranking + truncate.

Design

Boundary: their catalog (domain content) → our assessment. This PR is ingest only.
Deterministic / offline: snapshot the exact bytes, pin on content-hash; scans run without the network (on-prem / werkbank).
Not wired into startup yet — no ControlsProvider consumer exists until the assessment-plan router lands (next PR). Avoids dead wiring.

Testing

cargo clippy -p compliance-agent -- -D warnings: clean.
cargo fmt --all --check: clean.
cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib: 287 + 44 + 27 pass, 0 failures.

Next (PR-3)

Assessment-plan router (control evidence-type / MC-method → SAST/secret/DAST or a code-side LLM evidence-finder) + an assessment-results emitter keyed to cra-ai-*, surfaced through compliance-mcp for breakpilot's scanner_mcp_client; plus startup wiring + BreakpilotConfig.

## What The **ingest half** of the CRA/OSCAL controls loop: pull breakpilot-compliance's OSCAL catalog and map it into our controls corpus. Pairs with `breakpilot-compliance#128` (the OSCAL **export** endpoint, merged). This is the **import/consume** side. ## Commits - **`feat(core)`: OSCAL 1.1 catalog types + mapping to controls corpus** — pure serde (`compliance-core/models/oscal.rs`). `OscalDocument::to_controls()` flattens the catalog into the framework-agnostic `traits::Control`; `framework()` / `content_hash()` accessors. Fixture-tested against the real 40-control CRA catalog. - **`feat(agent)`: `OscalControlsProvider` (pull + snapshot)** — implements `ControlsProvider`; fetches `GET /api/compliance/v1/oscal/catalog?framework=<fw>` (bearer-optional), **snapshots the exact bytes**, and **falls back to the last snapshot on fetch failure** so scans still run offline; naive context ranking + truncate. ## Design - **Boundary:** their catalog (domain content) → our assessment. This PR is *ingest only*. - **Deterministic / offline:** snapshot the exact bytes, pin on `content-hash`; scans run without the network (on-prem / werkbank). - **Not wired into startup yet** — no `ControlsProvider` consumer exists until the assessment-plan router lands (next PR). Avoids dead wiring. ## Testing - `cargo clippy -p compliance-agent -- -D warnings`: clean. - `cargo fmt --all --check`: clean. - `cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib`: **287 + 44 + 27 pass, 0 failures.** ## Next (PR-3) Assessment-plan router (control evidence-type / MC-method → SAST/secret/DAST **or** a code-side LLM evidence-finder) + an assessment-results emitter keyed to `cra-ai-*`, surfaced through `compliance-mcp` for breakpilot's `scanner_mcp_client`; plus startup wiring + `BreakpilotConfig`.

sharang added 2 commits 2026-07-20 16:03:57 +00:00

feat(core): OSCAL 1.1 catalog types + mapping to controls corpus 0e5a2d7e43

Deserialise the OSCAL catalog served by breakpilot-compliance and flatten it
into the framework-agnostic traits::Control the mapping engine consumes. Pure
serde (no reqwest); exposes content-hash for snapshot/drift on the consumer side.
Fixture-tested against the real 40-control CRA catalog (3 lib tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(agent): OscalControlsProvider — pull + snapshot breakpilot OSCAL catalog

CI / Check (push) Skipped

CI / Check (pull_request) Successful in 5m48s

Details

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

51aae6665a

Implements ControlsProvider by fetching GET /api/compliance/v1/oscal/catalog from
breakpilot-compliance, snapshotting the exact bytes to disk, and mapping the
catalog into the corpus controls the mapping engine consumes. Deterministic /
offline-capable: on fetch failure it falls back to the last snapshot so scans
still run (matters for on-prem/werkbank).

- controls/oscal_provider.rs: HTTP fetch (bearer-optional) + atomic snapshot +
  offline fallback + naive context ranking; ControlsProvider impl ("breakpilot-oscal")
- controls/mod.rs + lib.rs: register module
- 3 lib tests: url/path building, context ranking, snapshot round-trip + fallback

Not yet wired into startup — no ControlsProvider consumer exists until the
assessment-plan router lands. clippy -D warnings + fmt --all --check clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit d4884cfe4f into main

2026-07-20 16:19:09 +00:00

sharang referenced this pull request

2026-07-20 16:26:31 +00:00

feat(oscal): assessment-results emitter + finding->control linker #211

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#210