[ccf-lisa]

Place in the stack

SSP templates (feature 2 of ssp-templates.md), PR B4 of 5. Base: B3 (#524, feat/ssp-templates-3-planner). Below it: B2 (#523), B1 (#522) and the SSP scope stack (#516–#520). The design's B4 is split in two to stay under 1000 lines. This PR is discovery. B5 (feat/ssp-templates-5-routes) adds the run route, the instances list (stale, key-hash, skipped-entries) and the forget route.

What it adds

• ssptemplates.Discovery runs the B3 planner against the latest evidence and applies it:

  • New group: creates the SSP through B2's sspservice in a transaction holding the template's advisory lock, records the instance, and learns the scope (sspscope.Service.Learn, origin template).

    • The SSP id is uuid.NewSHA1(namespace, templateID || keyHash).
    • metadata.title is the rendered title and metadata.version is 1.0.
    • Props are the rendered props plus ssp-template=<template id>.
    • system-name is the title, the description is rendered (or falls back to the title), and status is under-development.

    Profiles are attached after that transaction commits. A failed attach is recorded in last_error and profiles_pending, and the next run retries it.

  • Existing group: refreshes last_seen_at and learns new scope entries. Learn already skips exceptions and existing entries.

  • Deleted SSP (instance ssp_id null): left alone, never recreated.

  • At most MaxNewSSPsPerRun (100) new SSPs per template per run; the next run creates the rest.

  • Learned entries the scope cannot hold (from the planner, and LearnResult.Skipped) go into new instance columns skipped_entries and skipped_sample (up to 5).

  • A failing group gets last_error and the run's error; the other groups still apply. last_run_at is set when the run finishes. This is the contract addition from review: B1 exposes it as last-run-at, null until this job sets it.

• River worker and periodic job ssp_template_discovery on the scheduler queue. Empty args run every enabled template, loading the evidence once; args with template_id run one template, for B5's run route.
• The worker reuses the ProfileControlResolver that cmd/run.go already injects (the oscal handler's control resolution), adapted to sspservice.ControlResolver.
• Config: CCF_SSP_TEMPLATE_DISCOVERY_SCHEDULE (default hourly, 0 37 * * * *) and CCF_SSP_TEMPLATE_STALE_AFTER (default 168h, used by B5), in internal/config and .env.example.

How it was tested

• Integration (ssptemplates/discovery_integration_test.go, testcontainers):
  • the SSP is created with the evidence's casing, the deterministic id, title, description, props, the template's profile and its implemented requirements; scope entries have origin template and the template id; last_run_at is set;
  • runs are idempotent (one SSP, last_seen_at refreshed);
  • later runs learn new values (evidence in other casing joins the same SSP) and respect exceptions;
  • a deleted SSP is never recreated;
  • the 100-per-run cap: 101 groups give 100, then 1;
  • a failed profile attach is recorded and then retried successfully;
  • disabled templates are skipped;
  • invalid learned entries are counted and sampled.
• Unit: the config loader, the schedule fallback, and the resolver adapter's case-insensitive de-duplication.
• Gate on this branch:
  • make swag (no doc change), make lint (only the existing SA1019), make test, go vet -tags integration ./...;
  • integration suites of internal/service/worker, ssptemplates, internal/service, internal/service/relational, internal/config;
  • make check-diff.

Changed lines excluding generated swagger: 762.

Deviations from design

• The design's B4 is split into B4 (discovery) and B5 (routes).
• New instance columns, not in the design's model:
  • profiles_pending: retry an attach only while one failed, so a profile a user removed is never re-attached;
  • skipped_entries / skipped_sample: the design's "skipped count and a sample".
• The ssp-template prop uses the existing relational.CCFOSCALNamespace (https://compliance-framework.github.io/ns/oscal), not …/ns.
• Rendered prop values that come out empty are dropped, because OSCAL props need a value.
• plan.InvalidEntry is now an alias of relational.SkippedScopeEntry.

Open questions for reviewers

• An existing SSP whose evidence drops under min-streams is not refreshed, so it can be reported stale even though some evidence remains. Should min-streams apply only to creating SSPs?
• The ssp-template prop namespace: the existing …/ns/oscal constant, or the design's …/ns?

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9cea4713-11ca-4840-a96e-62c29145911e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

ccf-review: APPROVE

no findings.

Stack (gh stack 521): #516 → #517 → #518 → #519 → #520 → #522 → #523 → #524 → #525 → #526