| --- |
| title: IaC-SecFix |
| colorFrom: red |
| colorTo: green |
| sdk: gradio |
| sdk_version: 5.29.0 |
| app_file: app.py |
| pinned: false |
| license: apache-2.0 |
| --- |
| |
| # IaC-SecFix |
|
|
| Scanner-verified Infrastructure-as-Code remediation demo for the AMD Developer Hackathon. |
|
|
| This Space is designed to be publishable without access to the AMD 192GB GPU. It defaults to deterministic demo playback from notebook artifacts and can optionally call a live Qwen/vLLM endpoint when GPU access is available. |
|
|
| This Space has two modes: |
|
|
| - `Demo playback`: reliable precomputed scanner artifacts from the notebook run. |
| - `Live Qwen endpoint`: calls a public OpenAI-compatible vLLM endpoint serving `Qwen/Qwen3.5-9B`. |
|
|
| The complete benchmark-backed system is B3 zero-shot + RAG. B5 is included as promising partial multi-agent loop evidence. |
|
|
| ## Model Access |
|
|
| The fine-tuned LoRA adapter should be published as a separate Hugging Face model repo. The CPU Space does not host Qwen3.5-9B directly. Live inference requires one of: |
|
|
| - a public OpenAI-compatible vLLM endpoint |
| - a paid GPU Space with enough VRAM |
| - a Hugging Face Inference Endpoint |
| - another external GPU service |
|
|
| ## Operating Pattern |
|
|
| The UI follows the submission operating pattern: |
|
|
| 1. Graph node = one responsibility. |
| 2. Agent output = typed Pydantic model. |
| 3. All side effects = tools with validation + approval. |
| 4. All runs = usage-limited + traced + persisted. |
|
|
| Each run writes a typed artifact under `runs/<run_id>.json` containing: |
|
|
| - request |
| - ingest result |
| - safety decision |
| - policy context |
| - tool approvals |
| - candidate patch |
| - validation result |
| - approval decision |
| - graph trace |
|
|
| The Space never applies infrastructure changes. Patches remain human-review artifacts. |
|
|
| ## Project Structure |
|
|
| `app.py` is only the Space launcher. The application logic lives in `iac_secfix_space/`: |
|
|
| - `schemas.py`: typed Pydantic contracts for requests, graph state, candidates, validation, approvals, and traces. |
| - `agents.py`: narrow Pydantic AI worker wrapper for the live `PatchAgent` typed output. |
| - `graph.py`: deterministic control plane that owns routing, joins, fallbacks, approval flow, and persistence. |
| - `nodes.py`: one-responsibility graph nodes for ingest, safety, routing, policy context, validation, and approval. |
| - `tools.py`: side-effect boundary for demo playback and live Qwen calls, with usage limits and approval records. |
| - `persistence.py`: per-run JSON artifacts and usage counters. |
| - `rendering.py`: UI-safe report/trace rendering. |
| - `ui.py`: Gradio interface composition only. |
|
|
| The graph layer is isolated from the UI and tools so the orchestration can be upgraded to `pydantic_graph.beta` without rewriting the security or validation contracts. |
|
|
| ## Required Space Secrets |
|
|
| Set these in the Space Settings page when using live inference: |
|
|
| - `IAC_SECFIX_BASE_URL`: public HTTPS URL ending in `/v1` |
| - `IAC_SECFIX_API_KEY`: vLLM API key |
| - `IAC_SECFIX_MODEL`: served model name, for example `iac-secfix-base` |
|
|
| If these are missing, the app still works in demo playback mode. |
|
|
| See `docs/architecture.md` for the graph/node/tool contract and `docs/huggingface_deployment_guide.md` for deployment steps. |
|
|
