feat(analyze): one analysis command; serve/investigate/report share the run - #27
Merged
Conversation
…he run
- internal/analysis: Run() orchestrates normalize (only when missing/stale),
endpoint + shell-history correlation before detection, streaming detections,
rule packs, MCP audit (+ gateway), provenance; writes detections/{findings,
mcp-audit,provenance,corroboration,analysis}.json de-duplicated and
severity-sorted; earlier correlation results survive re-analysis unless the
overlay is re-parsed; Stale()/Ensure() for consumers.
- cli: `analyze` (triage = alias) with --endpoint/--shell-history/--gateway-*/
--rules/--honeytokens/--renormalize/--json; serve, investigate, report call
analysis.Ensure and render the persisted run; help text regrouped by
workflow step in plain language.
- serve UI: empty extras sections hidden; message no longer tells the user to
run other commands.
- tests: all stages produce their files; states and correlation findings kept
across re-runs; renormalize invalidates; Ensure no-op; sorted output.
- docs: README four-step quick start, CHANGELOG; version 0.13.0-dev.
efij
force-pushed
the
feat/analyze-orchestration
branch
from
September 2, 2026 21:25
514cfdd to
396b3a4
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See CHANGELOG [Unreleased]. RCA: analysis stages were separate order-dependent commands; serve showed 'run X and reload'; triage re-normalized and wiped corroboration states. Fix: internal/analysis orchestrates every stage once; consumers Ensure() it. No feature removed — single-stage commands stay as aliases/scripting. Verified: analysis tests (all stage files, states + findings preserved, renormalize invalidates), serve/report tests updated, binary E2E: analyze --endpoint → 6 findings; triage re-run keeps CONTRADICTED and correlation findings; serve extras populated; report reflects states. go test -race green.