feat(oscal): live assessment endpoint POST /api/v1/oscal/assess #212

2026-07-20T17:08:59Z

sharang commented

2026-07-20 17:08:59 +00:00

What

Makes the OSCAL loop live: POST /api/v1/oscal/assess on the agent pulls the control catalog for a target's frameworks, loads the target's findings from the tenant DB, and returns a standard OSCAL 1.1 assessment-results document linking findings to controls.

Completes the chain: breakpilot-compliance#128 (export) → #210 (ingest) → #211 (assess) → this (the live endpoint).

What's in it

BreakpilotConfig (base_url / token / snapshot_dir) from BREAKPILOT_* env; the endpoint returns 503 when base_url is unset.
handlers::oscal::assess_target on the authenticated, tenant-scoped router: provider.load(frameworks) + DB findings + assess() → OSCAL.
Test helpers updated for the new config field.

Verified live (not just unit tests)

Ran the built agent against a local Mongo + a local catalog server + two seeded findings:

POST /api/v1/oscal/assess {"target_id":"demo-target"} → HTTP 200, OSCAL 1.1.2 assessment-results
cra-ai-8 (Keine Default-Passwörter) → not-satisfied ← [semgrep] Hardcoded credential @ src/auth.rs:42 (CWE-798)
cra-ai-13 (Verschlüsselung sensibler Daten) → not-satisfied ← [semgrep] Weak cipher (DES) @ src/crypto.rs:88 (CWE-327)
40 reviewed controls, 2 observations, deterministic uuids.

Testing

cargo clippy -p compliance-agent -- -D warnings + cargo fmt --all --check: clean.
cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib: 287 + 47 + 27 pass.

Next (PR-5)

Control-driven direction (run scans / a code-side LLM evidence-finder per control) + surface the assessment-results through compliance-mcp for breakpilot's scanner_mcp_client (the pull-flow they already wrote a client for).

## What Makes the OSCAL loop **live**: `POST /api/v1/oscal/assess` on the agent pulls the control catalog for a target's frameworks, loads the target's findings from the tenant DB, and returns a standard **OSCAL 1.1 assessment-results** document linking findings to controls. Completes the chain: `breakpilot-compliance#128` (export) → `#210` (ingest) → `#211` (assess) → **this** (the live endpoint). ## What's in it - **`BreakpilotConfig`** (`base_url` / `token` / `snapshot_dir`) from `BREAKPILOT_*` env; the endpoint returns `503` when `base_url` is unset. - **`handlers::oscal::assess_target`** on the authenticated, tenant-scoped router: `provider.load(frameworks)` + DB findings + `assess()` → OSCAL. - Test helpers updated for the new config field. ## Verified live (not just unit tests) Ran the built agent against a local Mongo + a local catalog server + two seeded findings: - `POST /api/v1/oscal/assess {"target_id":"demo-target"}` → **HTTP 200**, OSCAL 1.1.2 assessment-results - `cra-ai-8` (*Keine Default-Passwörter*) → **not-satisfied** ← `[semgrep] Hardcoded credential @ src/auth.rs:42` (CWE-798) - `cra-ai-13` (*Verschlüsselung sensibler Daten*) → **not-satisfied** ← `[semgrep] Weak cipher (DES) @ src/crypto.rs:88` (CWE-327) - 40 reviewed controls, 2 observations, deterministic uuids. ## Testing - `cargo clippy -p compliance-agent -- -D warnings` + `cargo fmt --all --check`: clean. - `cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib`: **287 + 47 + 27 pass.** ## Next (PR-5) Control-driven direction (run scans / a code-side LLM evidence-finder *per control*) + surface the assessment-results through `compliance-mcp` for breakpilot's `scanner_mcp_client` (the pull-flow they already wrote a client for).

sharang added 1 commit 2026-07-20 17:08:59 +00:00

feat(agent): live OSCAL assessment endpoint POST /api/v1/oscal/assess

CI / Check (pull_request) Successful in 6m5s

Details

CI / Check (push) Skipped

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

2d20ad7a6e

Wires ingest (OscalControlsProvider) + assessment (assess) behind an agent
endpoint: pulls the catalog for the target's frameworks (default CRA), loads the
target's findings from the tenant DB, and returns an OSCAL assessment-results
document linking findings to controls.

- BreakpilotConfig (base_url/token/snapshot_dir) from BREAKPILOT_* env; endpoint
  returns 503 when base_url is unset
- handlers::oscal::assess_target on the authenticated (tenant-scoped) router
- test helpers updated for the new config field

clippy -D warnings + fmt + CI test cmd (287+47+27) clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

sharang merged commit 5285fb67ae into main

2026-07-20 19:13:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#212