Sharang ParnerkarandClaude Fable 5
69bce2f07c
CI / Check (pull_request) Has been cancelled
CI / Detect Changes (pull_request) Has been cancelled
CI / Deploy Agent (pull_request) Has been cancelled
CI / Deploy Dashboard (pull_request) Has been cancelled
CI / Deploy Docs (pull_request) Has been cancelled
CI / Deploy MCP (pull_request) Has been cancelled
Completes the provision-and-test loop's dynamic coverage (sub-tasks 3 + 4):
- provision_and_test now returns a ProvisionOutcome { ics findings, DAST run }.
After the Modbus probe it runs a bounded, best-effort DAST scan against the
provisioned web endpoint (independently timed out so it can't consume the whole
instance lifetime), and the orchestrator persists the DAST scan run + findings
linked to the scan run. Kept as a plain data return so the whole run is
portable to a remote execution backend. On the OpenPLC substrate the web
endpoint is OpenPLC's own UI (fidelity caveat documented); the CODESYS-runtime
follow-up raises this to a real WebVisu.
- ICS Modbus probe now enumerates the exposed process surface (read-only): a Read
Coils and a Read Holding Registers of the first block. Coils and holding
registers are read/write process points, so an exposed block is an
unauthenticated *write* surface — reported as `ics-modbus-exposed-points`
(High). Read-only to detect (we never write), so it is safe on the live probe
too, not just the provisioned instance.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>