CipherShift365 Compass CLI

cipher-shift compass <verb> [options]

cipher-shift compass scan  <project-path> [options]
cipher-shift compass diff  <project-path> --prior <cbom-path>
cipher-shift compass report <cbom-path>   [options]

dotnet tool install --global CipherShift365.Compass

dotnet tool update --global CipherShift365.Compass

cipher-shift --help

# Scan a project — text output to terminal
cipher-shift compass scan ./src/MyApp

# Scan with HTML report
cipher-shift compass scan ./src/MyApp -f html -o report.html

# Scan with JSON output (for scripts)
cipher-shift compass scan ./src/MyApp -f json

# Scan with migration plan
cipher-shift compass scan ./src/MyApp -p

# Diff against a prior scan
cipher-shift compass diff ./src/MyApp --prior baseline-2026-q1.cbom.json

# Generate a report from a CBOM
cipher-shift compass report scan-output.cbom.json -f md

cipher-shift compass scan <project-path> [options]

Scanning: ./src/MyApp
=== CipherShift365 Compass Analysis ===
Project:    ./src/MyApp
Duration:   2.34s
Score:      0.85
Findings:   12
  QuantumBroken:     4
  QuantumVulnerable: 3
  Mitigable:         2
  QuantumSafe:       3

  [QuantumBroken      ] RSA             Signature    AuthService.cs:42
  [QuantumBroken      ] ECDSA           Signature    TokenValidator.cs:100
  [QuantumVulnerable  ] AES-128         Symmetric    Storage.cs:15

=== Migration Plan (9 items, 34 person-days) ===
  [Critical  ] RSA      → ML-DSA-65     (5d)
  [High      ] ECDSA    → ML-DSA-65     (4d)

{
  "Success": true,
  "ProjectPath": "./src/MyApp",
  "FindingCount": 12,
  "QuantumBroken": 4,
  "QuantumVulnerable": 3,
  "SystemScore": "0.85",
  "PlanItems": 9,
  "TotalEffortDays": 34,
  "Findings": [
    {
      "Algorithm": "RSA",
      "Role": "Signature",
      "Risk": "QuantumBroken",
      "Confidence": "High",
      "Location": "AuthService.cs",
      "Line": 42
    }
  ],
  "Plan": [
    {
      "Algorithm": "RSA",
      "Target": "ML-DSA-65",
      "Urgency": "Critical",
      "EffortDays": 5
    }
  ]
}

cipher-shift compass diff <project-path> --prior <cbom-path>

=== CipherShift365 Incremental Diff ===
Incremental diff: 2 new, 1 resolved, 3 changed, 5 unchanged.

  [+] New        RSA             New finding: RSA at AuthManager.cs
  [+] New        ECDSA           New finding: ECDSA at TokenService.cs
  [✓] Resolved   MD5             Resolved: MD5 at LegacyHasher.cs
  [~] Changed    AES             Risk: QuantumVulnerable → QuantumSafe
  [~] Changed    SHA-256         Algorithm: SHA-256 → SHA-512

cipher-shift compass report <cbom-path> [options]

- name: CipherShift365 PQC Scan
  uses: CipherShift365/compass-action@v1
  with:
    project-path: './src'
    baseline: './cbom/baseline-2026-q1.cbom.json'
    format: 'html'
    output: 'pqc-report.html'
    fail-on-violation: 'true'

- name: Install Compass
  run: dotnet tool install --global CipherShift365.Compass

- name: Run PQC Scan
  run: cipher-shift compass scan ./src -f html -o pqc-report.html

- name: Upload Report
  uses: actions/upload-artifact@v4
  with:
    name: ciphershift-report
    path: pqc-report.html

- task: CipherShift365CompassScan@1
  inputs:
    projectPath: '$(Build.SourcesDirectory)/src'
    format: 'html'
    output: '$(Build.ArtifactStagingDirectory)/pqc-report.html'
    failOnViolation: true

# Fail the build on violations
cipher-shift compass scan ./src --format json || exit 1

# Report only, always pass
cipher-shift compass scan ./src --format html -o /tmp/report.html || true

CipherShift365.Compass
├── Program.cs                    # CLI entry point, argument parsing, command dispatch
├── Diff/
│   ├── IncrementalDiffEngine.cs  # Prior vs. current finding comparison
│   └── DiffResult.cs             # FindingDiff, IncrementalDiffResult, DiffStatus
├── Reports/
│   ├── HtmlReportGenerator.cs    # Self-contained HTML report builder
│   └── MarkdownReportGenerator.cs # GFM report builder
├── Ci/
│   ├── GitHub/
│   │   └── action.yml            # GitHub Action definition
│   └── AzureDevOps/
│       └── task.json             # Azure DevOps task extension
└── CipherShift365.Compass.csproj

Main(args)
  ├─► ScanAsync(args)     — for "scan" verb
  ├─► DiffAsync(args)     — for "diff" verb
  └─► ReportAsync(args)   — for "report" verb

private static (IKnowledgeBase, IIdentityService, IRiskModel,
    IPolicyEngine, IAnalysisEngine) CreatePipeline()
{
    var kb = new InMemoryKnowledgeBase(new KbVersion(1, 0, 0), new[]
    {
        new KbEntry("RSA", CryptoRole.Signature, RiskLevel.QuantumBroken, ...),
        new KbEntry("ECDSA", CryptoRole.Signature, RiskLevel.QuantumBroken, ...),
        new KbEntry("ECDH", CryptoRole.KeyExchange, RiskLevel.QuantumBroken, ...),
        new KbEntry("AES", CryptoRole.Symmetric, RiskLevel.QuantumVulnerable, ...),
        new KbEntry("SHA-256", CryptoRole.Hash, RiskLevel.Mitigable, ...),
    });
    // ...wire everything
}

cd src/Compass/CipherShift365.Compass
dotnet build
dotnet pack
dotnet tool install --global --add-source ./nupkg CipherShift365.Compass

# PowerShell: scan and parse JSON
$json = cipher-shift compass scan ./src -f json | ConvertFrom-Json
$broken =$json.Findings | Where-Object Risk -eq "QuantumBroken"
Write-Host "Broken algorithms: $($broken.Count)"

if ($json.SystemScore -gt 0.5) {
    Write-Warning "High risk score: $($json.SystemScore)"
}

# Bash: scan and extract score
SCORE=$(cipher-shift compass scan ./src -f json | jq '.SystemScore')
echo "System Score: $SCORE"

#!/bin/bash
# Run scan with baseline; fail on new violations
cipher-shift compass scan ./src \
  --baseline baseline.cbom.json \
  --format html \
  --output pqc-report.html

EXIT_CODE=$?
if [ $EXIT_CODE -eq 1 ]; then
  echo "::warning::New PQC violations detected. See pqc-report.html."
elif [ $EXIT_CODE -eq 2 ]; then
  echo "::error::Scan failed."
fi
exit $EXIT_CODE

# First scan — accept current state as baseline
cipher-shift compass scan ./src -o baseline.cbom.json -f json

# Later: diff against the baseline
cipher-shift compass diff ./src --prior baseline.cbom.json

# Generate HTML from a stored CBOM
cipher-shift compass report scan-2026-01-15.cbom.json -f html -o archive.html

# Generate Markdown for a wiki
cipher-shift compass report scan-2026-01-15.cbom.json -f md -o wiki-report.md

cipher-shift compass <verb> [options] [--help]

Verbs:
  scan    <project-path>  [-o|--output <path>] [-f|--format <fmt>]
                           [-b|--baseline <path>] [-p|--plan]
  diff    <project-path>  --prior <cbom-path>
  report  <cbom-path>     [-f|--format <fmt>] [-o|--output <path>]

cipher-shift --help

cipher-shift — CipherShift365 PQC Discovery CLI

Usage:
  cipher-shift compass scan  <project-path> [options]
  cipher-shift compass diff  <project-path> --prior <cbom-path>
  cipher-shift compass report <cbom-path>   [options]

Scan Options:
  -o, --output <path>    Write report to file
  -f, --format <fmt>     Output format: text, json, html, md (default: text)
  -b, --baseline <path>  Baseline CBOM for policy comparison
  -p, --plan             Show migration plan

Examples:
  cipher-shift compass scan ./src -f html -o report.html
  cipher-shift compass diff ./src --prior baseline.cbom.json
  cipher-shift compass report baseline.cbom.json -f md

Exit Codes:
  0   Success, policy compliant
  1   Policy violations found
  2   Error (scan failed, invalid input)