-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathaudit_template.py
More file actions
45 lines (38 loc) · 1.75 KB
/
Copy pathaudit_template.py
File metadata and controls
45 lines (38 loc) · 1.75 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
"""Finder pool -> adversarial verify -> rank. The canonical review workflow.
flow run examples/audit_template.py \
--args '{"target":"./src","lenses":["correctness","security","performance"]}' \
--budget '{"max_usd":2}'
"""
FINDING = {
"type": "object", "required": ["title", "severity", "evidence"],
"properties": {
"title": {"type": "string"},
"severity": {"type": "string", "enum": ["critical", "high", "medium", "low"]},
"evidence": {"type": "string"},
"fix": {"type": "string"},
},
}
VERDICT = {"type": "object", "required": ["real", "reason"],
"properties": {"real": {"type": "boolean"}, "reason": {"type": "string"}}}
def run(wf, args):
target = args["target"]
lenses = args.get("lenses", ["correctness", "security", "operations"])
wf.phase("find")
found = wf.parallel([
(lambda l=l: wf.agent(f"Audit {target} through the {l} lens. Worst finding only, with evidence.",
label=f"find:{l}", schema=FINDING, tier="quality", required=False))
for l in lenses
])
findings = [f for f in found if f]
wf.phase("verify")
verified = wf.parallel([
(lambda f=f: {"finding": f, "verdict": wf.agent(
f"Adversarially verify. Default real=false if unsure. Finding: {f}",
label="verify", schema=VERDICT, tier="cheap", required=False)})
for f in findings
])
confirmed = [v["finding"] for v in verified if v and v.get("verdict") and v["verdict"].get("real")]
wf.phase("rank")
ranking = wf.agent(f"Rank by fix priority, one action each: {confirmed}",
label="rank", tier="quality", required=False)
return {"confirmed": confirmed, "ranking": ranking, "spend": wf.spend()}