---
title: IaC-SecFix
colorFrom: red
colorTo: green
sdk: gradio
sdk_version: 5.29.0
app_file: app.py
pinned: false
license: apache-2.0
---

# IaC-SecFix

Scanner-verified Infrastructure-as-Code remediation demo for the AMD Developer Hackathon.

This Space is designed to be publishable without access to the AMD 192GB GPU. It defaults to deterministic demo playback from notebook artifacts and can optionally call a live Qwen/vLLM endpoint when GPU access is available.

This Space has two modes:

- `Demo playback`: reliable precomputed scanner artifacts from the notebook run.
- `Live Qwen endpoint`: calls a public OpenAI-compatible vLLM endpoint serving `Qwen/Qwen3.5-9B`.

The complete benchmark-backed system is B3 zero-shot + RAG. B5 is included as promising partial multi-agent loop evidence.

## Model Access

The fine-tuned LoRA adapter should be published as a separate Hugging Face model repo. The CPU Space does not host Qwen3.5-9B directly. Live inference requires one of:

- a public OpenAI-compatible vLLM endpoint
- a paid GPU Space with enough VRAM
- a Hugging Face Inference Endpoint
- another external GPU service

## Operating Pattern

The UI follows the submission operating pattern:

1. Graph node = one responsibility.
2. Agent output = typed Pydantic model.
3. All side effects = tools with validation + approval.
4. All runs = usage-limited + traced + persisted.

Each run writes a typed artifact under `runs/<run_id>.json` containing:

- request
- ingest result
- safety decision
- policy context
- tool approvals
- candidate patch
- validation result
- approval decision
- graph trace

The Space never applies infrastructure changes. Patches remain human-review artifacts.

## Project Structure

`app.py` is only the Space launcher. The application logic lives in `iac_secfix_space/`:

- `schemas.py`: typed Pydantic contracts for requests, graph state, candidates, validation, approvals, and traces.
- `agents.py`: narrow Pydantic AI worker wrapper for the live `PatchAgent` typed output.
- `graph.py`: deterministic control plane that owns routing, joins, fallbacks, approval flow, and persistence.
- `nodes.py`: one-responsibility graph nodes for ingest, safety, routing, policy context, validation, and approval.
- `tools.py`: side-effect boundary for demo playback and live Qwen calls, with usage limits and approval records.
- `persistence.py`: per-run JSON artifacts and usage counters.
- `rendering.py`: UI-safe report/trace rendering.
- `ui.py`: Gradio interface composition only.

The graph layer is isolated from the UI and tools so the orchestration can be upgraded to `pydantic_graph.beta` without rewriting the security or validation contracts.

## Required Space Secrets

Set these in the Space Settings page when using live inference:

- `IAC_SECFIX_BASE_URL`: public HTTPS URL ending in `/v1`
- `IAC_SECFIX_API_KEY`: vLLM API key
- `IAC_SECFIX_MODEL`: served model name, for example `iac-secfix-base`

If these are missing, the app still works in demo playback mode.

See `docs/architecture.md` for the graph/node/tool contract and `docs/huggingface_deployment_guide.md` for deployment steps.