feat(oscal): assessment-results emitter + finding->control linker #211

2026-07-20T16:26:31Z

sharang commented

2026-07-20 16:26:31 +00:00

What

The assessment half of the CRA/OSCAL loop: assess our findings against the ingested catalog controls and emit a standard OSCAL 1.1 assessment-results document.

Builds on #210 (ingest). Their platform owns the catalog (domain content); we own the assessment.

What's in it

ControlLinker — maps a Finding's CWE to catalog control-ids. The CRA seed mirrors breakpilot's _CWE_TO_REQ (798→cra-ai-8, 327→cra-ai-13, 319→cra-ai-15, 89/79/78→cra-ai-20, …); extensible via ControlLinker::new.
assess(controls, findings, linker, at) — builds the OSCAL assessment-results doc: an observation per linked finding (with file:line evidence), a per-control finding with not-satisfied status + related observations, and reviewed-controls covering the full catalog set.
The OSCAL assessment-results serialize types.

Design

Deterministic: stable uuid5 ids (adds the uuid v5 feature) + caller-supplied timestamp → reproducible output.
Pure: no DB, no network. Consumes our Finding model + the catalog Controls from #210's provider.
Not yet wired into a scan run — that lands with the control-driven router (PR-4).

Testing

cargo clippy -p compliance-core -- -D warnings + cargo fmt --all --check: clean.
cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib: 287 + 47 + 27 pass, 0 failures.

Next (PR-4)

Control-driven router (control evidence-type / method → SAST / secret / DAST or a code-side LLM evidence-finder) + startup wiring + BreakpilotConfig; surface the assessment-results through compliance-mcp for breakpilot's scanner_mcp_client — closing the loop.

## What The **assessment half** of the CRA/OSCAL loop: assess our findings against the ingested catalog controls and emit a standard **OSCAL 1.1 assessment-results** document. Builds on #210 (ingest). Their platform owns the catalog (domain content); we own the assessment. ## What's in it - **`ControlLinker`** — maps a `Finding`'s CWE to catalog control-ids. The CRA seed mirrors breakpilot's `_CWE_TO_REQ` (`798→cra-ai-8`, `327→cra-ai-13`, `319→cra-ai-15`, `89/79/78→cra-ai-20`, …); extensible via `ControlLinker::new`. - **`assess(controls, findings, linker, at)`** — builds the OSCAL assessment-results doc: an `observation` per linked finding (with `file:line` evidence), a per-control `finding` with `not-satisfied` status + related observations, and `reviewed-controls` covering the full catalog set. - The OSCAL assessment-results serialize types. ## Design - **Deterministic:** stable `uuid5` ids (adds the `uuid` `v5` feature) + caller-supplied timestamp → reproducible output. - **Pure:** no DB, no network. Consumes our `Finding` model + the catalog `Control`s from #210's provider. - **Not yet wired into a scan run** — that lands with the control-driven router (PR-4). ## Testing - `cargo clippy -p compliance-core -- -D warnings` + `cargo fmt --all --check`: clean. - `cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib`: **287 + 47 + 27 pass, 0 failures.** ## Next (PR-4) Control-driven router (control evidence-type / method → SAST / secret / DAST **or** a code-side LLM evidence-finder) + startup wiring + `BreakpilotConfig`; surface the assessment-results through `compliance-mcp` for breakpilot's `scanner_mcp_client` — closing the loop.

sharang added 1 commit 2026-07-20 16:26:31 +00:00

feat(core): OSCAL assessment-results emitter + finding->control linker

CI / Check (pull_request) Successful in 7m21s

Details

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

CI / Check (push) Skipped

d5ff60d55a

Assess our findings against catalog controls and emit a standard OSCAL 1.1
assessment-results document — the assessment half of the loop (their catalog,
our assessment).

- ControlLinker maps a Finding's CWE -> catalog control-ids (CRA seed mirrors
  breakpilot's _CWE_TO_REQ; extensible via ControlLinker::new)
- assess() builds an observation per linked finding + a per-control
  'not-satisfied' finding; reviewed-controls covers the full catalog set
- deterministic: stable uuid5 ids (adds uuid "v5" feature) + caller-supplied
  timestamp; pure (no DB/network)
- 3 lib tests

Not yet wired into a scan run — that lands with the control-driven router (PR-4).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit ca4e31cb65 into main

2026-07-20 16:53:40 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#211