From 2de25913622f49fa5b88e7e66c2b14fc52601405 Mon Sep 17 00:00:00 2001 From: "secopsai-blog-ops[bot]" <115749095+Techris93@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:06:22 +0300 Subject: [PATCH] feat: deepen research intelligence output --- docs/implementation-checkpoints.md | 8 ++++++++ docs/intelligence-integrations.md | 2 ++ secopsai/codex_bridge.py | 13 ++++++++++++ secopsai/intelligence.py | 12 +++++++---- tests/test_intelligence.py | 33 ++++++++++++++++++++++++++++++ 5 files changed, 64 insertions(+), 4 deletions(-) diff --git a/docs/implementation-checkpoints.md b/docs/implementation-checkpoints.md index 7e1ff98..4358879 100644 --- a/docs/implementation-checkpoints.md +++ b/docs/implementation-checkpoints.md @@ -1,5 +1,13 @@ # Implementation Checkpoints +## 109 Full Intelligence Result Review + +Status: implementation complete; Mission Control release and live browser acceptance are pending. + +Expanded research prompts so frontier models produce comprehensive, evidence-led assessments rather than generic summaries. The bridge now requests investigation scope, method, 5-12 supported facts where available, explicit fact/inference/unsupported-claim separation, contradictions, missing proof, prioritized evidence-closing actions, verdict rationale, technical article structure, and publication/disclosure risk analysis. Schema-adjacent nested analyst briefs from Kimi, Grok, and Gemini are normalized into the canonical result instead of collapsing to placeholder text. + +The safety boundary is unchanged: models receive normalized evidence, cannot browse or execute package code through this action, and cannot submit sandbox artifacts, send disclosure, change customer controls, or publish content. + ## 108 Guarded Agent Research Completion Status: complete in the local pilot and merged. diff --git a/docs/intelligence-integrations.md b/docs/intelligence-integrations.md index 75588ad..44023ae 100644 --- a/docs/intelligence-integrations.md +++ b/docs/intelligence-integrations.md @@ -15,6 +15,8 @@ ChatGPT authentication pays for and identifies the model session. SecOpsAI OAuth SecOpsAI can use your local OpenCodex proxy so research analysis is not locked to one ChatGPT account. +Research actions request evidence-led structured output rather than a chat-style paragraph. A completed case analysis includes an executive summary, confirmed facts, inferences, unsupported claims, contradictions, missing evidence, prioritized next steps, a confidence-scored verdict, evidence references, limitations, and publication risks. Mission Control presents these fields separately and retains the complete normalized result and job history. + Configured on this machine: - `kimi/kimi-k2.7-code` diff --git a/secopsai/codex_bridge.py b/secopsai/codex_bridge.py index 7afdf92..8943a7a 100644 --- a/secopsai/codex_bridge.py +++ b/secopsai/codex_bridge.py @@ -703,6 +703,19 @@ def _normalize_bridge_result(payload: dict[str, Any]) -> dict[str, Any]: items must become readable strings for human review cards. """ result = dict(payload) + analyst_brief = result.get("analyst_brief") + if isinstance(analyst_brief, dict): + nested_map = { + "executive_summary": "summary", + "facts": "confirmed_facts", + "inferences": "inferences", + "limitations": "limitations", + "recommended_actions": "recommended_actions", + "next_steps": "recommended_actions", + } + for source, destination in nested_map.items(): + if not _present(result.get(destination)) and _present(analyst_brief.get(source)): + result[destination] = analyst_brief[source] list_fields = ( "confirmed_facts", "inferences", diff --git a/secopsai/intelligence.py b/secopsai/intelligence.py index 08fd757..7e5591d 100644 --- a/secopsai/intelligence.py +++ b/secopsai/intelligence.py @@ -266,17 +266,20 @@ def _bridge_context(action: Action, inputs: dict[str, Any], db_path: str | None) def _bridge_instructions(action: Action) -> str: action_guidance = { "analyze_research_case": ( - "Also return confirmed_facts, inferences, unsupported_claims, contradictions, and missing_evidence as arrays. " + "Produce a comprehensive defensive research assessment, not a generic alert summary. Summarize the scope, method, strongest evidence, and conclusion in clear prose. " + "Return 5-12 confirmed_facts when evidence supports them, plus inferences, unsupported_claims, contradictions, and missing_evidence as arrays. " "A confirmed fact must cite supplied normalized evidence; otherwise classify it as an inference or unsupported claim. " + "Return prioritized recommended_actions that would close the most important evidence gaps, including static, registry, IOC, comparison, or sandbox steps as applicable. " "Return verdict_recommendation as credible, likely, inconclusive, not_substantiated, or benign; " "verdict_confidence as 0-100; verdict_rationale; and verdict_evidence_refs using only supplied evidence or pipeline step identifiers. " "Never downgrade a package merely because local exposure was not observed. " ), "generate_analyst_brief": ( - "Also return an article_outline array. Keep it suitable for a technical draft, not publication-ready copy. " + "Write a substantial analyst brief with an executive summary, investigation scope, methodology, confirmed findings, implications, limitations, and prioritized next steps in the available schema fields. " + "Also return an article_outline array with 6-12 specific sections suitable for a technical research draft, not publication-ready copy. " ), "review_publication_safety": ( - "Also return publication_risks as an array and disclosure_draft as review-only text. Do not approve or send either. " + "Assess evidentiary, attribution, privacy, operational, legal, disclosure, and reproducibility risks. Return specific publication_risks, corrective recommended_actions, and a detailed disclosure_draft as review-only text. Do not approve or send either. " ), }.get(action.name, "") return ( @@ -285,7 +288,8 @@ def _bridge_instructions(action: Action) -> str: "Do not execute commands, access files, browse, contact external parties, change product state, or approve publication. " f"{action_guidance}For actions other than analyze_research_case, set verdict_recommendation to inconclusive, " "verdict_confidence to 0, verdict_rationale to 'Verdict not assessed by this action', and verdict_evidence_refs to an empty array. " - "Return concise JSON matching the required output schema. Model output is evidence-bounded and subject to SecOpsAI guardrails." + "Use the available output limits fully when evidence warrants detail, while avoiding repetition. Return JSON matching the required output schema. " + "Model output is evidence-bounded and subject to SecOpsAI guardrails." ) diff --git a/tests/test_intelligence.py b/tests/test_intelligence.py index 825cc27..f335334 100644 --- a/tests/test_intelligence.py +++ b/tests/test_intelligence.py @@ -409,3 +409,36 @@ def test_bridge_normalizes_kimi_style_structured_result(): assert normalized["limitations"] == ["Runtime behavior was not observed."] validated = validate_bridge_result("analyze_research_case", normalized, provider="opencodex:kimi") assert validated["provider"] == "opencodex:kimi" + + +def test_bridge_promotes_nested_analyst_brief_fields(): + from secopsai.codex_bridge import _normalize_bridge_result + + normalized = _normalize_bridge_result( + { + "analyst_brief": { + "executive_summary": "A detailed evidence-led executive summary.", + "facts": ["Fact one", "Fact two"], + "inferences": ["Inference one"], + "limitations": ["Runtime behavior was not observed."], + "next_steps": ["Run approved isolated analysis."], + }, + "missing_evidence": ["Sandbox telemetry"], + } + ) + assert normalized["summary"] == "A detailed evidence-led executive summary." + assert normalized["confirmed_facts"] == ["Fact one", "Fact two"] + assert normalized["inferences"] == ["Inference one"] + assert normalized["limitations"] == ["Runtime behavior was not observed."] + assert normalized["recommended_actions"] == ["Run approved isolated analysis."] + + +def test_research_bridge_prompt_requests_evidence_led_depth(): + from secopsai.intelligence import ACTIONS, _bridge_instructions + + action = ACTIONS["analyze_research_case"] + prompt = _bridge_instructions(action) + assert "comprehensive defensive research assessment" in prompt + assert "5-12 confirmed_facts" in prompt + assert "prioritized recommended_actions" in prompt + assert "Use the available output limits fully" in prompt