sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(agent): semantic control mapping — embedding index + region->control retrieval #215

Merged
sharang merged 2 commits from feat/semantic-control-mapping into main 2026-07-21 10:50:22 +00:00
Conversation 0 Commits 2 Files Changed 5
+365 -33
2 Commits
Author SHA1 Message Date
Sharang ParnerkarandClaude Fable 5 95c18e7683 feat(agent): C4 — semantic_stamp_findings + provider load_master_controls
CI / Check (push) Skipped
CI / Check (pull_request) Successful in 6m3s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details 
Wires the semantic mapping into a callable scan pass:
- OscalControlsProvider: token-based fetch refactor + load_master_controls()
  (pulls ?framework=master-controls)
- semantic_stamp_findings(): build the ControlIndex from the master-controls
  catalog, then per finding embed its code region, retrieve the top-K nearest
  master controls, grounded-judge confirm, and stamp the confirmed ids onto
  control_refs (alongside the CRA CWE-LUT refs).

Opt-in — the orchestrator doesn't auto-run it, and it rebuilds the corpus index
per call (production should cache it). Live-verifiable once breakpilot #129 deploys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-21 12:43:58 +02:00
Sharang ParnerkarandClaude Fable 5 30487e4d8f feat(agent): semantic control mapping — embedding index + region->control retrieval
CI / Check (push) Skipped
CI / Check (pull_request) Successful in 6m7s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details 
The scale mechanism for the master-control corpus (which carries no CWE to LUT
on): ControlIndex embeds each control's requirement text and returns the top-K
nearest to a code region (cosine); SemanticControlChecker retrieves those K,
judges each with the grounded judge, and grounds the verdicts -> control_refs.

The region->control direction (vs the CWE-LUT's finding->control) is what scales
to ~13.6k: the LLM only ever judges a handful of retrieved candidates, and every
survivor is still anchored to real code by the grounding gate. Reuses judge +
ground gate. Stub-tested (cosine ranking, retrieve->ground, ungrounded dropped).

Not yet wired into the scan (needs the master-controls catalog live, breakpilot #129).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-21 12:35:30 +02:00