azurenoops / azurenoops/spin_agent
[BUG] [POA&M] - POA&M generated for wrong system ('Azure Government System' instead of Coastal Watch) — systemId field ignored in POA&M resolution
- Dominant language
- C#
- Stars
- 3
- Forks
- 1
- Avg merge
- 18h 9m
- Merged PRs (30d)
- 43
Description
## Bug Description
When a POA&M is requested for **Coastal Watch** (system ID: `92afdc15-bc6f-4648-8073-ad6af396cf97`), the generated document resolves to a different system — **"Azure Government System"** — instead of the correct system. The `systemId` field in the request body is ignored during POA&M system resolution.
This is a regression related to the orphan system accumulation problem (#567): 34 systems are registered, disambiguation fails because Coastal Watch is buried past page 1 (20-system pagination cap), so the MCP agent picks a default or wrong system for POA&M output.
## Steps to Reproduce
```bash
curl -s -X POST -H 'Content-Type: application/json' \
-d '{"message":"Create a POA&M for Coastal Watch","systemId":"92afdc15-bc6f-4648-8073-ad6af396cf97"}' \
https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io/mcp/chat
```
## Expected Behavior
POA&M document header should read:
```
System Name: Coastal Watch
```
## Actual Behavior
POA&M document header reads:
```
System Name: Azure Government System
Framework: NIST80053
Date: 2026-06-30
Prepared By: ATO Copilot (automated)
```
The system identity is wrong. The POA&M was generated for a different system than requested, even though the correct `systemId` GUID was included in the request.
## Full API Response
```json
{
"success": true,
"response": "# Plan of Action and Milestones (POA&M)\n\n**System Name**: Azure Government System\n**Framework**: NIST80053\n**Date**: 2026-06-30\n**Prepared By**: ATO Copilot (automated)\n\n---\n\n## Open Findings\n\n*No open findings. All controls are compliant or accepted.*\n\n*This POA&M was auto-generated on 2026-06-30 03:58 UTC by ATO Copilot.*"
}
```
## Root Cause Hypothesis
1. `systemId` field in `/mcp/chat` POST body is not passed through to POA&M generation logic (same underlying bug as #568)
2. With 34 systems in DB and pagination cap at 20, Coastal Watch is not on the first page — the agent selects a default/wrong system
3. This is compounded by #567 (33 orphaned QA systems) which pushes Coastal Watch off page 1
## Impact
**HIGH** — Any POA&M generated via MCP chat will be attributed to the wrong system, producing invalid compliance documentation. POA&M is a critical ATO artifact.
## Related Issues
- #567: Orphaned QA systems cause Coastal Watch to be buried past pagination cap
- #568: Explicit system GUID in /mcp/chat request ignored by disambiguation logic
- #434: Previous POA&M tenant mismatch bug (now closed, but symptom has changed)
## Browser/Environment
- API: https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io
- Test System: Coastal Watch (ID: 92afdc15-bc6f-4648-8073-ad6af396cf97)
- Date: 2026-06-30T03:58 UTC
## Playwright Test Code
```typescript
test('[POA&M] system name resolution uses correct system', async ({ request }) => {
const response = await request.post('/mcp/chat', {
data: {
message: 'Create a POA&M for Coastal Watch',
systemId: '92afdc15-bc6f-4648-8073-ad6af396cf97'
}
});
const body = await response.json();
expect(body.success).toBe(true);
expect(body.response).toContain('Coastal Watch');
expect(body.response).not.toContain('Azure Government System');
});
```
*Filed by Oracle — Automated 4-hour QA Sweep 2026-06-30T03:59 UTC*
Contributor guide
Assessment
This issue has not been assessed yet.