Repository navigation
Share the reachable-only triage policy; add whitebox --reachable-only - #168
Merged
Merged
Conversation
…le-only Gray-box and white-box already share the code-graph engine; the only remaining divergence was gray-box's reachable-only triage policy (spend AI tokens only on findings an endpoint reaches, cap the rest offline). Lift that policy into one shared helper, `offat_triage.reachable_triage`, so both pipelines use the same implementation: - graybox.analyze now delegates to it (keeping its gray-box prompt/block). - whitebox gains `--reachable-only`, the same token-discipline policy on the SAST pass, so the flows converge to: shared engine + a reachability policy flag (gray-box additionally emits the full endpoint inventory). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Answers "why does gray-box have a different flow?" by removing the last real divergence.
Since the code-graph work, gray-box and white-box already share the engine (both call
offat_wb.cpg.analyze+merge_with_patterns). The only thing left that differed was gray-box's reachable-only triage policy: spend AI tokens only on findings an exposed endpoint can reach, and triage the rest offline capped atinconclusive.This lifts that policy into one shared helper —
offat_triage.reachable_triage— so both pipelines use the same implementation instead of a gray-box-only copy:graybox.analyzenow delegates to it (keeping the gray-box system prompt and reachability-aware finding block).offat-whiteboxgains--reachable-only: the same token-discipline policy on the SAST pass.The flows now converge to: shared engine + a reachability policy flag. Gray-box is white-box with
--reachable-onlyon, plus the full endpoint inventory (endpoints.json).Test plan
triager/tests/test_reachable.pycovers the shared policy (reachable → triaged, unreachable → capped + annotated)offat-whitebox --reachable-onlyon the fixture: 18/19 reachable, 1 capped to inconclusive🤖 Generated with Claude Code