docs(features): compliance control-mapping pipeline #223

2026-07-22T07:23:18Z

sharang commented

2026-07-22 07:23:18 +00:00

Extensive VitePress feature doc (docs/features/control-mapping.md) for the control-mapping engine, grounded in the live C5 results:

Core principle — deterministic tools detect; the LLM only judges + grounds, never detects.
Coverage model — the CRA hybrid (13 covered / 8 needs_tooling / 19 not_code_checkable) + the ~2,882 master controls.
Three mapping paths — LUT triage (5b), semantic retrieval (5c), grounded surface checks (5d) — with a mermaid flow and the shared grounding gate.
Semantic retrieval detail — corpus embedding + caching, and the query-enrichment tuning (retrieve on finding intent, not raw region).
Two worked examples from the live run — the auth-file tuning story and four topically-distinct vulns, with the actual matched controls.
Known limitations — absence findings, catch-all controls (security_code_review), corpus classification noise.
Config + an appendix documenting the master-controls data war-story (dump-triplication → migration 160 dedup; 502 → 200).

Builds clean (npm run build, mermaid + nav verified).

🤖 Generated with Claude Code

Extensive VitePress feature doc (`docs/features/control-mapping.md`) for the control-mapping engine, grounded in the live C5 results: - **Core principle** — deterministic tools detect; the LLM only judges + grounds, never detects. - **Coverage model** — the CRA hybrid (13 covered / 8 needs_tooling / 19 not_code_checkable) + the ~2,882 master controls. - **Three mapping paths** — LUT triage (5b), semantic retrieval (5c), grounded surface checks (5d) — with a mermaid flow and the shared grounding gate. - **Semantic retrieval detail** — corpus embedding + caching, and the query-enrichment tuning (retrieve on finding *intent*, not raw region). - **Two worked examples** from the live run — the auth-file tuning story and four topically-distinct vulns, with the actual matched controls. - **Known limitations** — absence findings, catch-all controls (`security_code_review`), corpus classification noise. - **Config** + an **appendix** documenting the master-controls data war-story (dump-triplication → migration 160 dedup; 502 → 200). Builds clean (`npm run build`, mermaid + nav verified). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-07-22 07:23:19 +00:00

docs(features): control mapping pipeline (grounded in the C5 live results)

CI / Check (push) Skipped

CI / Check (pull_request) Successful in 5m53s

Details

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

d03f027fa1

Extensive feature doc for the compliance control-mapping engine:
- core principle (tools detect, LLM judges/grounds — never detects)
- coverage model + the CRA hybrid (4 semgrep / 8 grounded / 4 not-code-checkable)
- the three mapping paths (LUT 5b / semantic 5c / grounded-surface 5d) with a
  mermaid flow, and the shared grounding gate
- semantic retrieval detail incl. the query-enrichment tuning
- two worked examples from the live C5 run (auth file + varied vulns)
- known limitations (absence findings, catch-all controls, corpus noise)
- config flags + an appendix on the master-controls data pipeline war-story
  (dump-triplication -> migration 160 dedup; 502 -> 200)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 182dec69b8 into main

2026-07-22 07:30:11 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#223