1 Release 2 Tags

RSS Feed

• v0.3.0 effc3080e0

  Compare

  v0.3.0 — Control-Mapped Compliance, Dynamic Execution & OT/PLC

  sharang released this 2026-07-22 17:06:22 +00:00

  The release that closes the compliance loop end to end: deterministic scan
  findings are now mapped to real compliance controls (CRA + breakpilot's
  master controls), grounded by an LLM false-positive filter, and emitted as
  OSCAL over MCP — proven live against PLC targets. Also lands the Werkbank
  dynamic-execution runner and first-class OT/PLC (IEC 61131-3) security scanning.

  Highlights

  • Control mapping loop: deterministic tools detect, an authored LUT maps a
    finding to the control it evidences, and the LLM enters last as a
    grounded (temperature-0, verbatim-anchored) false-positive filter — never
    the detector. Three paths converge on one grounding gate:
    • LUT triage — (tool, cwe / rule_id) -> CRA control
    • Semantic retrieval — embed finding intent + code region -> top-K of
      breakpilot's ~2,882 code-checkable master controls (bge-multilingual-
      gemma2, cached index)
    • Grounded surface checks — presence/absence controls with no syntactic
      pattern (no rate limiting, no security logging, no update signature…)
  • OSCAL: ingest breakpilot's OSCAL catalog (CRA + master-controls) and emit
    assessment-results. Mapped findings target their controls via control_refs;
    unmapped findings are reported as-is as observations, so nothing is lost.
  • MCP: oscal_assessment tool (per repo_id) — the surface breakpilot pulls via
    /v1/cra/oscal-from-scanner. Multi-tenant, bearer-authenticated.
  • CRA coverage: 21 covered / 0 needs_tooling / 19 not_code_checkable, resolved
    as a hybrid of 4 custom semgrep detectors + 8 grounded surface checks.
  • Werkbank: a separate/on-prem execution runner so dynamic tests run where the
    customer's data already lives. Mongo-backed job queue with lease + visibility
    timeout, runner queue endpoints, result persistence, artifact serve/fetch.
  • OT / PLC (IEC 61131-3): control-logic security scanner for Structured Text
    and graphical logic (FBD/LD from PLCopen XML); CODESYS project + .projectarchive
    ingest; control-application SBOM + CODESYS-runtime CVE matching by CPE; dynamic
    Modbus/TCP, OPC UA and EtherNet/IP probes + OT service-discovery port scan;
    dynamic testing via an ephemeral soft-PLC (OpenPLC).
  • Unified onboarding: one multi-target model + scan matrix, onboarding wizard UI
    and endpoints, artifact ingest + classifier, backfill migration, opt-in scans
    from the wizard.
  • Firmware SBOM via tramiton reproducible builds (real nix, sandbox=false).

  Notable fixes

  • MCP tenant context was lost across rmcp's Streamable-HTTP task spawn — bind the
    tenant to the per-session server instance so tool calls resolve their tenant DB.
  • run_pipeline and run_plc_scan now refresh control_refs on re-scan instead of
    insert-only, so newly-enabled or re-tuned mappings land without a delete/re-add.
  • Semantic embedding requests chunk at 16 (backend caps input arrays at 25).

  Configuration (new)

  • BREAKPILOT_BASE_URL — breakpilot-compliance root; enables control ingest + all
    mapping passes. Unset disables control mapping (findings produced without refs).
  • BREAKPILOT_SEMANTIC_MAPPING / BREAKPILOT_GROUNDED_CHECKS — default on (validated
    live); each no-ops if BREAKPILOT_BASE_URL is unset or the catalog is unreachable.
  • BREAKPILOT_SNAPSHOT_DIR — OSCAL catalog snapshots + cached control-embedding index.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)