update

README.md

@@ -1,6 +1,6 @@
 ---
-title: Text OSINT AI
-emoji: 🛡️
+title: TextScout
+emoji: 🛰️
 colorFrom: indigo
 colorTo: blue
 sdk: docker
@@ -9,39 +9,41 @@ pinned: false
 license: bigscience-openrail-m
 ---
 
-# Text OSINT AI — demo
+# TextScout — red-team threat-intel chatbot
 
-Live demo of the fine-tuned **Text OSINT AI** model: a Llama-3.2-3B LoRA adapter
-(`Maximuz23/Text-OSINT`) for red-team threat intelligence. It extracts IOCs,
-profiles threat actors, and maps MITRE ATT&CK from a supplied record — and
-**refuses to fabricate** when the lookup is empty (evidence-gated honesty).
+Ask in plain language. TextScout **retrieves** the matching real record (MITRE ATT&CK
+groups / techniques / software, CISA KEV + NVD CVEs) and analyzes it with a fine-tuned
+Llama-3.2-3B (LoRA adapter `Maximuz23/Text-OSINT`). When no record is found — an unknown
+actor or a non-existent CVE — it **refuses to fabricate** (evidence-gated honesty).
 
-This is a **Docker** Space. Files: `Dockerfile`, `app.py`, `requirements.txt`,
-`examples.json`. The container installs deps and runs
-`streamlit run app.py` on port 8501.
+## How it works (RAG)
+1. Your message is routed to an entity: actor / CVE / technique / malware / report.
+2. The matching record is retrieved from the bundled corpus (`corpus.json`, built from
+   real MITRE ATT&CK + CISA KEV/NVD data) and formatted into the exact template the model
+   was trained on.
+3. TextScout analyzes that record. Empty lookup → honest refusal.
 
-## Pushing updates
-From the `osint-project` root, with the `hf` CLI authenticated:
+## Files
+`Dockerfile` · `app.py` · `requirements.txt` · `corpus.json` (retrieval data).
+
+## Push updates
+With the `hf` CLI authenticated, from the `osint-project` root:
 ```bash
-hf upload <user>/<space> demo . --type space
+hf upload Maximuz23/TextScout demo . --type space --commit-message update
 ```
-If the adapter repo `Maximuz23/Text-OSINT` is **private**, add a Space secret
-`HF_TOKEN` (Settings → Variables and secrets) with a read token.
+The adapter `Maximuz23/Text-OSINT` is public, so no Space secret is needed.
 
 ## CPU vs GPU
-- **Free CPU** runs the 3B model; the first generation is ~30–60s (model load),
-  then faster. Lower *Max new tokens* in the sidebar for a snappier live demo.
-- For instant responses, switch the Space hardware to **T4 small** (~$0.40/hr),
-  change the `Dockerfile` base to an NVIDIA CUDA image, and uncomment
-  `bitsandbytes` in `requirements.txt` (the GPU path uses the 4-bit base).
-  **Pause the Space after the demo** so you stop paying.
+Free CPU runs the 3B model in bf16 (~6 GB) — the first generation is ~30–60s (model load),
+then faster; lower *Max new tokens* for snappier replies. For instant responses use a
+**T4 small** (~$0.40/hr): switch the `Dockerfile` base to a CUDA image and uncomment
+`bitsandbytes` in `requirements.txt`. Pause the Space after the demo.
 
 ## Contract — do not drift
-`app.py` mirrors `ai-test.ipynb` exactly: the system prompt, chat template,
-greedy decoding (`do_sample=False`), and 384 max new tokens. If you retrain and
-the eval contract changes, update both together or the model goes off-distribution.
+`app.py`'s `SYSTEM_PROMPT` and record templates mirror `ai-test.ipynb` c03 and
+`scripts/build_grounded_records.py`. If you retrain and the contract changes, update both
+or the model goes off-distribution.
 
 ## Phase 2 (optional)
-Add live-API enrichment: user types a CVE id / actor name → fetch NVD / CISA KEV /
-MITRE → build the record in this same format → feed the model. Keeps the demo on
-"current ground truth" instead of pasted records. Needs NVD/OTX keys as secrets.
+Swap the bundled `corpus.json` for **live** retrieval (NVD / CISA KEV / MITRE APIs) so the
+demo reflects current ground truth instead of a snapshot. Needs NVD/OTX keys as secrets.

app.py

@@ -1,34 +1,33 @@
 """
-Text OSINT AI — live demo (Streamlit, for Hugging Face Spaces).
+TextScout — red-team threat-intel chatbot (Streamlit, for Hugging Face Spaces).
 
-Loads the fine-tuned LoRA adapter `Maximuz23/Text-OSINT` on Llama-3.2-3B-Instruct
-and reproduces the EXACT inference contract from ai-test.ipynb (system prompt,
-chat template, greedy decoding, 384 new tokens). Keep these in sync with the
-notebook — any drift puts the model off-distribution and the demo looks broken.
+Flow per turn: user asks in natural language -> RAG step retrieves the matching
+real record from the bundled corpus (MITRE ATT&CK groups/techniques/software,
+CISA KEV/NVD CVEs) -> builds the EXACT training-format prompt -> TextScout
+(Llama-3.2-3B + LoRA adapter Maximuz23/Text-OSINT) analyzes it. If retrieval is
+empty (unknown actor / non-existent CVE) the record is an empty lookup and the
+model refuses instead of fabricating — evidence-gated honesty, shown live.
 
-The point of the demo is the honesty differentiator: the model extracts/structures
-intel from a real record, and *refuses* (instead of hallucinating) when the lookup
-is empty — fake CVE id, unknown actor, etc.
+The record templates below mirror scripts/build_grounded_records.py byte-for-byte;
+the SYSTEM_PROMPT mirrors ai-test.ipynb c03. Do not drift either or the model
+goes off-distribution.
 """
 import os
+import re
 import json
-import time
 import pathlib
-import re
 
 import streamlit as st
 import torch
 from transformers import AutoModelForCausalLM, AutoTokenizer
 from peft import PeftModel
 
-# --- contract (mirror ai-test.ipynb cells 1 & 3) --------------------------------
+# --- model contract (mirror ai-test.ipynb cells 1 & 3) --------------------------
 HF_REPO = "Maximuz23/Text-OSINT"
 USE_GPU = torch.cuda.is_available()
-# GPU Space -> the 4-bit base used in training (needs bitsandbytes).
-# Free CPU Space -> the 16-bit base (ungated); the adapter applies to either.
 BASE_MODEL = "unsloth/Llama-3.2-3B-Instruct-bnb-4bit" if USE_GPU else "unsloth/Llama-3.2-3B-Instruct"
 MAX_NEW_TOKENS_DEFAULT = 384
-HF_TOKEN = os.environ.get("HF_TOKEN")  # set as a Space secret if the adapter repo is private
+HF_TOKEN = os.environ.get("HF_TOKEN")
 
 SYSTEM_PROMPT = (
     "You are an expert cybersecurity analyst specializing in Text OSINT and threat "
@@ -40,24 +39,16 @@ SYSTEM_PROMPT = (
     "details. Judge by the evidence in the input, not by whether a name looks familiar."
 )
 
-# Light heuristic only for the on-screen badge (NOT the eval scorer).
 REFUSAL_HINTS = re.compile(
-    r"no record (?:for|of|found)|won'?t fabricat|returns? no data|not indexed|"
-    r"no authoritative record|cannot produce an assessment|no matching group",
+    r"no record (?:for|of|found)|won'?t fabricat|returns? no data|not indexed|no authoritative "
+    r"record|cannot produce an assessment|no matching group|i cannot profile",
     re.I,
 )
 
-EXAMPLES_PATH = pathlib.Path(__file__).parent / "examples.json"
-EXAMPLE_LABELS = {
-    "real_cve":   "Real CVE — Log4Shell  →  expect: structured assessment",
-    "fake_cve":   "Fake CVE — CVE-9999-987654  →  expect: refusal",
-    "real_actor": "Real actor — APT28  →  expect: threat profile",
-    "fake_actor": "Fake actor — APT-Lyrebird-77  →  expect: refusal",
-    "raw_report": "Raw report — abuse.ch malware URL  →  expect: IOC extraction",
-}
-
+CORPUS_PATH = pathlib.Path(__file__).parent / "corpus.json"
 
-@st.cache_resource(show_spinner="Loading Llama-3.2-3B + Text-OSINT adapter (first load is slow)…")
+# --- model -----------------------------------------------------------------------
+@st.cache_resource(show_spinner="Loading TextScout (Llama-3.2-3B + adapter)… first load is slow.")
 def load_model():
     tok = AutoTokenizer.from_pretrained(BASE_MODEL, token=HF_TOKEN)
     if tok.pad_token is None:
@@ -67,8 +58,7 @@ def load_model():
     if USE_GPU:
         kwargs.update(device_map={"": 0}, torch_dtype=torch.float16)
     else:
-        # bf16 halves RAM vs fp32 (~6GB for 3B, fits the free 16GB CPU Space) and,
-        # unlike fp16, runs on CPU. low_cpu_mem_usage avoids a 2x spike at load.
+        # bf16 ~6GB (fits the free 16GB CPU Space) and runs on CPU, unlike fp16.
         kwargs.update(torch_dtype=torch.bfloat16, low_cpu_mem_usage=True)
     base = AutoModelForCausalLM.from_pretrained(BASE_MODEL, **kwargs)
     base.config.use_cache = True
@@ -77,103 +67,248 @@ def load_model():
     return tok, model
 
 
-def _device(model):
-    return next(model.parameters()).device
-
-
-def generate(prompt, use_adapter=True, max_new_tokens=MAX_NEW_TOKENS_DEFAULT):
+def generate(user_prompt, max_new_tokens=MAX_NEW_TOKENS_DEFAULT):
     tok, model = load_model()
     messages = [
         {"role": "system", "content": SYSTEM_PROMPT},
-        {"role": "user", "content": prompt},
+        {"role": "user", "content": user_prompt},
     ]
     inputs = tok.apply_chat_template(
         messages, tokenize=True, add_generation_prompt=True,
         return_tensors="pt", return_dict=True,
     )
-    inputs = {k: v.to(_device(model)) for k, v in inputs.items()}
-    gen_kwargs = dict(max_new_tokens=max_new_tokens, do_sample=False, pad_token_id=tok.eos_token_id)
+    dev = next(model.parameters()).device
+    inputs = {k: v.to(dev) for k, v in inputs.items()}
     with torch.no_grad():
-        if use_adapter:
-            out = model.generate(**inputs, **gen_kwargs)
-        else:
-            with model.disable_adapter():
-                out = model.generate(**inputs, **gen_kwargs)
-    in_len = inputs["input_ids"].shape[1]
-    return tok.decode(out[0][in_len:], skip_special_tokens=True).strip()
-
-
-def badge(text):
-    if REFUSAL_HINTS.search(text):
-        st.warning("🛡️ **Refused** — no source record (honesty guardrail held)")
-    else:
-        st.success("✅ **Extracted** from the record")
+        out = model.generate(**inputs, max_new_tokens=max_new_tokens,
+                             do_sample=False, pad_token_id=tok.eos_token_id)
+    return tok.decode(out[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True).strip()
+
+
+# --- record templates (mirror scripts/build_grounded_records.py) -----------------
+def t_actor(a):
+    aliases = ", ".join(a["aliases"]) if a.get("aliases") else "none recorded"
+    techs = a.get("top_techniques") or []
+    tb = "; ".join(f"{t['id']} {t['name']}" for t in techs) if techs else "none recorded"
+    return ("Use only the MITRE ATT&CK record below to produce a red-team threat profile. "
+            "Do not add any actor, technique, or attribution not present in the record.\n\n"
+            "[MITRE ATT&CK Group lookup]\n"
+            f"Name: {a['name']} ({a['attack_id']})\n"
+            f"Aliases: {aliases}\n"
+            f"Attributed techniques: {tb}\n"
+            f"Description: {a['description']}")
+
+
+def t_actor_empty(name):
+    return ("Use only the MITRE ATT&CK record below to produce a red-team threat profile. "
+            "Do not add any actor, technique, or attribution not present in the record.\n\n"
+            "[MITRE ATT&CK Group lookup]\n"
+            f"Query: {name}\n"
+            "Result: no matching group found.")
+
+
+def t_cve(c):
+    desc = c.get("nvd_description") or c.get("kev_description") or ""
+    cwes = ", ".join(c.get("cwes") or []) or "see description"
+    vp = f"{c.get('vendor') or ''} {c.get('product') or ''}".strip()
+    return ("Assess this CVE for offensive relevance using only the record below. "
+            "Do not add details not present.\n\n"
+            "[CVE Record]\n"
+            f"CVE: {c['cve_id']}\n"
+            f"Name: {c.get('name') or ''}\n"
+            f"Vendor/Product: {vp}\n"
+            f"Description: {desc}\n"
+            f"CVSS: {c.get('cvss') or ''}\n"
+            f"CWE: {cwes}\n"
+            f"KEV ransomware use: {c.get('ransomware_use') or ''}\n"
+            f"Required action: {c.get('required_action') or ''}")
+
+
+def t_cve_empty(cid):
+    return ("Assess this CVE for offensive relevance using only the record below.\n\n"
+            "[CVE Record]\n"
+            f"CVE: {cid}\n"
+            "NVD lookup: no record found.\n"
+            "CISA KEV: not listed.")
+
+
+def t_tech(t):
+    return ("Explain this MITRE ATT&CK technique and its offensive relevance. "
+            "Use only the record provided.\n\n"
+            "[MITRE ATT&CK Technique]\n"
+            f"ID: {t['attack_id']}\n"
+            f"Name: {t['name']}\n"
+            f"Tactics: {', '.join(t.get('tactics') or []) or 'not specified'}\n"
+            f"Platforms: {', '.join(t.get('platforms') or []) or 'not specified'}\n"
+            f"Description: {t['description']}")
+
+
+def t_soft(s):
+    g = s.get("used_by_groups") or []
+    return ("Explain this malware/tool and identify which threat actors use it. "
+            "Use only the record provided.\n\n"
+            "[MITRE ATT&CK Software]\n"
+            f"ID: {s['attack_id']}\n"
+            f"Name: {s['name']}\n"
+            f"Type: {s.get('type') or ''}\n"
+            f"Platforms: {', '.join(s.get('platforms') or []) or 'not specified'}\n"
+            f"Description: {s['description']}\n"
+            f"Documented user groups: {', '.join(g) if g else 'none recorded'}")
+
+
+# --- retrieval (RAG) -------------------------------------------------------------
+IOC_RE = re.compile(r"hxxp|https?://|\b\d{1,3}\[?\.\]?\d{1,3}\[?\.\]?\d{1,3}\[?\.\]?\d{1,3}\b|\b[a-f0-9]{32,64}\b", re.I)
+ACTOR_KW = re.compile(r"\b(actor|group|apt|adversary|profile|who is|what did|techniques does|ttps|campaign)\b", re.I)
+REPORT_KW = re.compile(r"\b(extract|report|ioc|indicator|infrastructure|c2|c&c|phish)\b", re.I)
+
+
+def _name_regex(names):
+    uniq = sorted({n for n in names if len(n) >= 3}, key=len, reverse=True)
+    return re.compile(r"(?<!\w)(" + "|".join(re.escape(n) for n in uniq) + r")(?!\w)", re.I)
+
+
+@st.cache_resource(show_spinner=False)
+def load_corpus():
+    c = json.loads(CORPUS_PATH.read_text(encoding="utf-8"))
+    actor_idx, soft_idx = {}, {}
+    for a in c["actors"]:
+        for key in [a["name"], *a.get("aliases", [])]:
+            actor_idx.setdefault(key.lower(), a)
+    for s in c["software"]:
+        if len(s["name"]) >= 5:          # drop short/common tool names (net, at, Reg…)
+            soft_idx.setdefault(s["name"].lower(), s)
+    cve_idx = {x["cve_id"].upper(): x for x in c["cves"]}
+    tech_idx = {x["attack_id"].upper(): x for x in c["techniques"]}
+    actor_re = _name_regex(list(actor_idx))
+    soft_re = _name_regex(list(soft_idx))
+    return actor_idx, cve_idx, tech_idx, soft_idx, actor_re, soft_re
 
 
-# --- UI -------------------------------------------------------------------------
-st.set_page_config(page_title="Text OSINT AI", page_icon="🛡️", layout="wide")
-st.title("🛡️ Text OSINT AI — red-team threat-intel assistant")
+def _longest(rx, q):
+    best = None
+    for m in rx.finditer(q):
+        if best is None or len(m.group(1)) > len(best):
+            best = m.group(1)
+    return best
+
+
+def _guess_name(q):
+    m = re.search(r"APT[\s\-]?[\w-]+", q, re.I)
+    if m:
+        return m.group(0)
+    m = re.search(r"(?:actor|group|profile|about)\s+([A-Z][\w\- ]{2,40})", q)
+    if m:
+        return m.group(1).strip(" ?.")
+    caps = re.findall(r"\b[A-Z][\w-]+\b", q)
+    return " ".join(caps[:3]) if caps else q.strip()[:40]
+
+
+HELP = (
+    "I'm **TextScout** — I answer from retrieved threat-intel records. Try: "
+    "**profile an actor** (APT28), **assess a CVE** (CVE-2021-44228), **explain a technique** "
+    "(T1059.001), **identify malware** (Cobalt Strike), or **extract IOCs from a report**. "
+    "Pick a suggestion to see it."
+)
+
+
+def route(q):
+    """Return (user_prompt, retrieved_record_or_None, source_label, help_or_None)."""
+    actor_idx, cve_idx, tech_idx, soft_idx, actor_re, soft_re = load_corpus()
+
+    m = re.search(r"CVE-\d{4}-\d{4,}", q, re.I)
+    if m:
+        cid = m.group(0).upper()
+        if cid in cve_idx:
+            rec = cve_idx[cid]; p = rec.get("_prompt") or t_cve(rec)
+            return p, p, "NVD + CISA KEV", None
+        p = t_cve_empty(cid); return p, p, "NVD + CISA KEV (no record)", None
+
+    m = re.search(r"\bT\d{4}(?:\.\d{3})?\b", q)
+    if m and m.group(0).upper() in tech_idx:
+        p = t_tech(tech_idx[m.group(0).upper()]); return p, p, "MITRE ATT&CK", None
+
+    if IOC_RE.search(q):                       # report extraction — no external lookup
+        return q, None, "the report you provided", None
+
+    a = _longest(actor_re, q)
+    s = _longest(soft_re, q)
+    if a or s:
+        if len(s or "") > len(a or ""):
+            p = t_soft(soft_idx[s.lower()]); return p, p, "MITRE ATT&CK Software", None
+        rec = actor_idx[a.lower()]; p = rec.get("_prompt") or t_actor(rec)
+        return p, p, "MITRE ATT&CK", None
+
+    if ACTOR_KW.search(q):                      # actor intent, no corpus match -> honest refusal
+        p = t_actor_empty(_guess_name(q)); return p, p, "MITRE ATT&CK (no record)", None
+    if REPORT_KW.search(q):
+        return q, None, "the report you provided", None
+    return None, None, None, HELP
+
+
+# --- UI --------------------------------------------------------------------------
+st.set_page_config(page_title="TextScout", page_icon="🛰️", layout="centered")
+st.title("🛰️ TextScout")
 st.caption(
-    "Fine-tuned Llama-3.2-3B (LoRA adapter `Maximuz23/Text-OSINT`). It extracts IOCs, "
-    "profiles actors, and maps MITRE ATT&CK from a supplied record — and **refuses to "
-    "fabricate** when the lookup is empty (fake CVE, unknown actor). Evidence-gated honesty."
+    "Red-team threat-intel assistant. Ask in plain language — TextScout retrieves the matching "
+    "MITRE ATT&CK / CVE record and analyzes it, and **refuses to fabricate** when there's no record."
 )
 
 with st.sidebar:
     st.subheader("Model")
-    st.markdown(
-        f"- **Base:** `{BASE_MODEL}`\n"
-        f"- **Adapter:** `{HF_REPO}`\n"
-        f"- **Device:** `{'GPU' if USE_GPU else 'CPU (free)'}`"
-    )
+    st.markdown(f"- **Base:** `{BASE_MODEL}`\n- **Adapter:** `{HF_REPO}`\n- **Device:** `{'GPU' if USE_GPU else 'CPU (free)'}`")
     st.divider()
-    max_tokens = st.slider(
-        "Max new tokens", 128, 512, MAX_NEW_TOKENS_DEFAULT, 32,
-        help="384 matches the eval. Lower it for faster CPU demos.",
-    )
-    show_base = st.checkbox(
-        "Also run the BASE model (show what fine-tuning fixed)", value=False,
-        help="Doubles latency. Best on a fake input: base waffles, fine-tune refuses.",
-    )
-    st.caption("Inputs use the same record format the model was trained on — load an example to see it.")
-
-examples = json.loads(EXAMPLES_PATH.read_text())
-st.session_state.setdefault("input_text", examples["fake_cve"])
-
-col_in, col_pick = st.columns([3, 1])
-with col_pick:
-    choice = st.selectbox("Try an example", list(EXAMPLE_LABELS), format_func=lambda k: EXAMPLE_LABELS[k])
-    if st.button("⤵ Load example", use_container_width=True):
-        st.session_state.input_text = examples[choice]
-with col_in:
-    prompt = st.text_area("Record / report to analyze", key="input_text", height=240)
-
-if st.button("🔍 Analyze", type="primary"):
-    if not prompt.strip():
-        st.error("Paste a record or load an example first.")
-        st.stop()
-
-    if show_base:
-        col_ft, col_base = st.columns(2)
-        with col_ft:
-            st.markdown("#### Fine-tuned (Text-OSINT)")
-            with st.spinner("Generating…"):
-                t0 = time.time()
-                out = generate(prompt, use_adapter=True, max_new_tokens=max_tokens)
-            badge(out)
-            st.code(out, language="markdown")
-            st.caption(f"{time.time() - t0:.1f}s")
-        with col_base:
-            st.markdown("#### Base Llama-3.2-3B (no adapter)")
-            with st.spinner("Generating…"):
-                t0 = time.time()
-                out_b = generate(prompt, use_adapter=False, max_new_tokens=max_tokens)
-            st.code(out_b, language="markdown")
-            st.caption(f"{time.time() - t0:.1f}s")
+    max_tokens = st.slider("Max new tokens", 128, 512, MAX_NEW_TOKENS_DEFAULT, 32,
+                           help="Lower for snappier CPU responses.")
+    if st.button("🗑️ Clear chat", use_container_width=True):
+        st.session_state.messages = []
+        st.rerun()
+
+SUGGESTIONS = {
+    "🎯 Profile the actor APT28": "Profile the threat actor APT28",
+    "🧬 What does Kimsuky do?": "What techniques does the threat actor Kimsuky use?",
+    "🛠️ Who uses Cobalt Strike?": "Which threat actors use the Cobalt Strike tool?",
+    "📖 Explain technique T1059.001": "Explain MITRE ATT&CK technique T1059.001",
+    "🔓 Assess CVE-2021-44228": "Assess CVE-2021-44228 for offensive relevance",
+    "🌐 Extract IOCs from a report": ("Extract the IOCs from this abuse.ch report and assess red "
+                                       "team relevance: hxxp://27.204.192.167:41628/i was flagged "
+                                       "as a malware_download host."),
+}
+
+if "messages" not in st.session_state:
+    st.session_state.messages = []
+
+# empty-state suggestion chips
+clicked = None
+if not st.session_state.messages:
+    st.markdown("##### Try one of these 👇")
+    cols = st.columns(2)
+    for i, (label, text) in enumerate(SUGGESTIONS.items()):
+        if cols[i % 2].button(label, use_container_width=True):
+            clicked = text
+
+# render history
+for msg in st.session_state.messages:
+    with st.chat_message(msg["role"], avatar="🛰️" if msg["role"] == "assistant" else None):
+        if msg.get("retrieved"):
+            with st.expander(f"🔎 RAG — record retrieved from {msg.get('source','source')}"):
+                st.code(msg["retrieved"])
+        if msg.get("badge"):
+            st.caption(msg["badge"])
+        st.markdown(msg["content"])
+
+user_input = st.chat_input("Ask TextScout… e.g. profile APT28, assess CVE-2021-44228") or clicked
+
+if user_input:
+    st.session_state.messages.append({"role": "user", "content": user_input})
+    prompt, retrieved, source, help_text = route(user_input)
+    if help_text:
+        answer, badge = help_text, None
     else:
-        with st.spinner("Generating…"):
-            t0 = time.time()
-            out = generate(prompt, use_adapter=True, max_new_tokens=max_tokens)
-        badge(out)
-        st.code(out, language="markdown")
-        st.caption(f"{time.time() - t0:.1f}s")
+        with st.chat_message("assistant", avatar="🛰️"):
+            with st.spinner(f"🔎 Retrieving from {source} → TextScout analyzing…"):
+                answer = generate(prompt, max_new_tokens=max_tokens)
+        badge = ("🛡️ No record retrieved → refused (honesty guardrail)"
+                 if REFUSAL_HINTS.search(answer) else "✅ Grounded in the retrieved record")
+    st.session_state.messages.append({"role": "assistant", "content": answer,
+                                      "retrieved": retrieved, "source": source, "badge": badge})
+    st.rerun()

examples.json

@@ -1,7 +0,0 @@
-{
- "real_cve": "[CVE Record]\nCVE: CVE-2021-44228\nName: Apache Log4j2 Remote Code Execution Vulnerability\nVendor/Product: Apache Log4j2\nDescription: Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.\nCISA KEV: listed (confirmed exploited in the wild)\nRequired action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.\n\nAssess this CVE for offensive relevance.",
- "fake_cve": "[CVE Record]\nCVE: CVE-9999-987654\nNVD: this identifier is not indexed.\nKEV: not present.\n\nAssess this CVE for offensive relevance.",
- "real_actor": "[MITRE ATT&CK Group lookup]\nName: APT28 (G0007)\nAliases: APT28, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit, Sofacy, Pawn Storm, Fancy Bear, STRONTIUM, Tsar Team, Threat Group-4127, TG-4127, Forest Blizzard, FROZENLAKE, GruesomeLarch\nAttributed techniques: T1001.001, T1003, T1003.001, T1003.003, T1005, T1014, T1021.002, T1025, T1027.013, T1030, T1036, T1036.005\nDescription: APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, t\n\nProfile this threat actor and summarize how they operate.",
- "fake_actor": "[MITRE ATT&CK Group lookup]\nQuery: APT-Lyrebird-77\nResult: query returned no results.\n\nProfile this threat actor.",
- "raw_report": "This URL was reported to abuse.ch as a malware distribution point. Extract IOCs and explain its threat relevance:\n\nhxxps://wash8siteview.felo7wave[.]surf/software-distribution-dxnp2c7/meta-verify.index malware_download"
-}

src/streamlit_app.py

@@ -1,40 +0,0 @@
-import altair as alt
-import numpy as np
-import pandas as pd
-import streamlit as st
-
-"""
-# Welcome to Streamlit!
-
-Edit `/streamlit_app.py` to customize this app to your heart's desire :heart:.
-If you have any questions, checkout our [documentation](https://docs.streamlit.io) and [community
-forums](https://discuss.streamlit.io).
-
-In the meantime, below is an example of what you can do with just a few lines of code:
-"""
-
-num_points = st.slider("Number of points in spiral", 1, 10000, 1100)
-num_turns = st.slider("Number of turns in spiral", 1, 300, 31)
-
-indices = np.linspace(0, 1, num_points)
-theta = 2 * np.pi * num_turns * indices
-radius = indices
-
-x = radius * np.cos(theta)
-y = radius * np.sin(theta)
-
-df = pd.DataFrame({
-    "x": x,
-    "y": y,
-    "idx": indices,
-    "rand": np.random.randn(num_points),
-})
-
-st.altair_chart(alt.Chart(df, height=700, width=700)
-    .mark_point(filled=True)
-    .encode(
-        x=alt.X("x", axis=None),
-        y=alt.Y("y", axis=None),
-        color=alt.Color("idx", legend=None, scale=alt.Scale()),
-        size=alt.Size("rand", legend=None, scale=alt.Scale(range=[1, 150])),
-    ))