azurenoops / azurenoops/spin_agent

[BUG] [POA&M] - POA&M generated for wrong system ('Azure Government System' instead of Coastal Watch) — systemId field ignored in POA&M resolution

Open
#571 0 comments 0 reactions 1 assignee Claimed by @jrspinella View on GitHub
agent:oracle area:rmf bug priority:high
Dominant language
C#
Stars
3
Forks
1
Avg merge
18h 9m
Merged PRs (30d)
43

Description

## Bug Description

When a POA&M is requested for **Coastal Watch** (system ID: `92afdc15-bc6f-4648-8073-ad6af396cf97`), the generated document resolves to a different system — **"Azure Government System"** — instead of the correct system. The `systemId` field in the request body is ignored during POA&M system resolution.

This is a regression related to the orphan system accumulation problem (#567): 34 systems are registered, disambiguation fails because Coastal Watch is buried past page 1 (20-system pagination cap), so the MCP agent picks a default or wrong system for POA&M output.

## Steps to Reproduce

```bash
curl -s -X POST -H 'Content-Type: application/json' \
-d '{"message":"Create a POA&M for Coastal Watch","systemId":"92afdc15-bc6f-4648-8073-ad6af396cf97"}' \
https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io/mcp/chat
```

## Expected Behavior

POA&M document header should read:
```
System Name: Coastal Watch
```

## Actual Behavior

POA&M document header reads:
```
System Name: Azure Government System
Framework: NIST80053
Date: 2026-06-30
Prepared By: ATO Copilot (automated)
```

The system identity is wrong. The POA&M was generated for a different system than requested, even though the correct `systemId` GUID was included in the request.

## Full API Response

```json
{
"success": true,
"response": "# Plan of Action and Milestones (POA&M)\n\n**System Name**: Azure Government System\n**Framework**: NIST80053\n**Date**: 2026-06-30\n**Prepared By**: ATO Copilot (automated)\n\n---\n\n## Open Findings\n\n*No open findings. All controls are compliant or accepted.*\n\n*This POA&M was auto-generated on 2026-06-30 03:58 UTC by ATO Copilot.*"
}
```

## Root Cause Hypothesis

1. `systemId` field in `/mcp/chat` POST body is not passed through to POA&M generation logic (same underlying bug as #568)
2. With 34 systems in DB and pagination cap at 20, Coastal Watch is not on the first page — the agent selects a default/wrong system
3. This is compounded by #567 (33 orphaned QA systems) which pushes Coastal Watch off page 1

## Impact

**HIGH** — Any POA&M generated via MCP chat will be attributed to the wrong system, producing invalid compliance documentation. POA&M is a critical ATO artifact.

## Related Issues

- #567: Orphaned QA systems cause Coastal Watch to be buried past pagination cap
- #568: Explicit system GUID in /mcp/chat request ignored by disambiguation logic
- #434: Previous POA&M tenant mismatch bug (now closed, but symptom has changed)

## Browser/Environment

- API: https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io
- Test System: Coastal Watch (ID: 92afdc15-bc6f-4648-8073-ad6af396cf97)
- Date: 2026-06-30T03:58 UTC

## Playwright Test Code

```typescript
test('[POA&M] system name resolution uses correct system', async ({ request }) => {
const response = await request.post('/mcp/chat', {
data: {
message: 'Create a POA&M for Coastal Watch',
systemId: '92afdc15-bc6f-4648-8073-ad6af396cf97'
}
});
const body = await response.json();
expect(body.success).toBe(true);
expect(body.response).toContain('Coastal Watch');
expect(body.response).not.toContain('Azure Government System');
});
```

*Filed by Oracle — Automated 4-hour QA Sweep 2026-06-30T03:59 UTC*

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.