code-analysis-openapi.json

{
  "openapi": "3.1.0",
  "info": {
    "title": "Agentic Vulnerability Analyzer",
    "summary": "Assess whether a component is affected by a CVE using dependency, version, and code reachability evidence.",
    "description": "The API runs a multi-step vulnerability assessment pipeline over a target component or repository. It can execute synchronously for immediate results or asynchronously via background jobs that can be polled later.",
    "contact": {
      "name": "Agentyzer Maintainers"
    },
    "license": {
      "name": "Proprietary"
    },
    "version": "1.0.22"
  },
  "paths": {
    "/health": {
      "get": {
        "tags": [
          "system"
        ],
        "summary": "Check service health",
        "description": "Lightweight liveness probe that confirms the API process is accepting requests.",
        "operationId": "health_health_get",
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthResponse"
                }
              }
            }
          }
        }
      }
    },
    "/configuration": {
      "get": {
        "tags": [
          "system"
        ],
        "summary": "Get service configuration",
        "description": "Return sanitized runtime configuration and backend information for API consumers. Repository credentials and raw authenticated URLs are never included.",
        "operationId": "configuration_configuration_get",
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HealthResponse"
                }
              }
            }
          }
        }
      }
    },
    "/prompts": {
      "get": {
        "tags": [
          "system"
        ],
        "summary": "Inspect configured prompt bundles",
        "description": "Return prompt bundle metadata and, when requested, the configured system prompt text. Prompt values are omitted by default.",
        "operationId": "prompts_prompts_get",
        "parameters": [
          {
            "name": "include_values",
            "in": "query",
            "required": false,
            "schema": {
              "type": "boolean",
              "description": "Include prompt text values in the response.",
              "default": false,
              "title": "Include Values"
            },
            "description": "Include prompt text values in the response."
          },
          {
            "name": "system_only",
            "in": "query",
            "required": false,
            "schema": {
              "type": "boolean",
              "description": "Limit values to system prompts.",
              "default": true,
              "title": "System Only"
            },
            "description": "Limit values to system prompts."
          }
        ],
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {}
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    },
    "/benchmark/compare": {
      "post": {
        "tags": [
          "benchmark"
        ],
        "summary": "Compare human and automated assessment artifacts",
        "description": "Probabilistically compare a human vulnerability assessment with an automated Agentyzer assessment result. This endpoint evaluates the assessment artifacts only; it does not run repository or source-code analysis.",
        "operationId": "benchmark_compare_benchmark_compare_post",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/BenchmarkCompareRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/BenchmarkCompareResponse"
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    },
    "/assess": {
      "post": {
        "tags": [
          "assessment"
        ],
        "summary": "Start a vulnerability assessment",
        "description": "Submit a vulnerability assessment request. By default the API enqueues a background job and returns a poll URL. Pass `sync=true` to wait for completion and receive the full assessment immediately.",
        "operationId": "assess_assess_post",
        "parameters": [
          {
            "name": "sync",
            "in": "query",
            "required": false,
            "schema": {
              "type": "boolean",
              "description": "When true, block until the assessment completes and return the result instead of a job handle.",
              "examples": [
                true
              ],
              "default": false,
              "title": "Sync"
            },
            "description": "When true, block until the assessment completes and return the result instead of a job handle."
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AssessRequest"
              },
              "examples": {
                "syncAssessment": {
                  "summary": "Synchronous assessment against a configured component",
                  "description": "Block until the pipeline finishes and return the full assessment in one response.",
                  "value": {
                    "vuln_id": "CVE-2024-49766",
                    "component_name": "benchmark",
                    "debug": true,
                    "focus_path": "/tmp/agentyzer-repos/vuln-benchmark-08dfa46a5b30",
                    "user_guidance": "Prioritize code paths reachable from HTTP request handlers."
                  }
                },
                "asyncAssessment": {
                  "summary": "Asynchronous assessment with dependency path hints",
                  "description": "Submit a background job and later poll for status or retrieve the completed result.",
                  "value": {
                    "vuln_id": "CVE-2024-49766",
                    "component_name": "benchmark",
                    "debug": false,
                    "dependency_paths": [
                      [
                        "flask",
                        "werkzeug"
                      ]
                    ]
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Assessment completed synchronously or a background job was accepted.",
            "content": {
              "application/json": {
                "schema": {
                  "anyOf": [
                    {
                      "$ref": "#/components/schemas/AssessResponse"
                    },
                    {
                      "$ref": "#/components/schemas/JobSubmittedResponse"
                    }
                  ],
                  "title": "Response Assess Assess Post"
                },
                "examples": {
                  "syncResult": {
                    "summary": "Completed synchronous assessment",
                    "value": {
                      "assessment": {
                        "affected": true,
                        "verdict": "Affected",
                        "confidence": "High",
                        "exposure": "direct",
                        "dependency_presence": {
                          "found": true,
                          "repo_found": true,
                          "sbom_attributed": true,
                          "presence_basis": "direct",
                          "direct": true,
                          "transitive": false,
                          "declared_in": [
                            "pyproject.toml"
                          ],
                          "lock_files": [
                            "uv.lock"
                          ],
                          "locked_version": "2.0.0"
                        },
                        "advisory_relevance": {
                          "relevant": true,
                          "status": "ok",
                          "source": "rules",
                          "reasons": [
                            "OSV ecosystem match: {'PyPI'} (project={'PyPI'})"
                          ]
                        },
                        "version_analysis": {
                          "detected_version": "2.0.0",
                          "version_source": "lock file",
                          "affected": true,
                          "note": "lock file \u2014 version 2.0.0 is in the explicit affected versions list",
                          "affected_ranges_summary": [
                            "SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)"
                          ],
                          "comparison_inputs": {
                            "component_name": "werkzeug",
                            "locked_version": "2.0.0",
                            "affected_ranges_summary": [
                              "ECOSYSTEM range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                              "Explicit affected versions: 2 listed"
                            ],
                            "affected_versions_count": 2
                          },
                          "comparison_trace": [
                            "Affected ranges: 1 SEMVER/ECOSYSTEM, 0 GIT, 2 explicit versions",
                            "  Explicit affected versions: ['2.0.0', '3.0.2']",
                            "  SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                            "version=2.0.0: MATCH in explicit affected versions list"
                          ],
                          "checked_versions": [
                            {
                              "ref": "LOCKED",
                              "ref_type": "lock",
                              "version": "2.0.0",
                              "affected": true,
                              "notes": "lock file \u2014 version 2.0.0 is in the explicit affected versions list"
                            },
                            {
                              "ref": "WORKTREE",
                              "ref_type": "worktree",
                              "version": "2.0.0",
                              "source": "manifest",
                              "affected": true,
                              "notes": "version is in the explicit affected versions list"
                            }
                          ],
                          "historical_affected": []
                        },
                        "executive_summary": {
                          "vulnerability": "CVE-2024-49766 \u00b7 werkzeug: crafted multipart form data can trigger excessive resource consumption.",
                          "assessment": "Disposition: Affected. Confidence: High. Exposure: direct. Audit: status pass; evidence consistency strong. Basis: the current detected version remains within the affected range. Required action: upgrade werkzeug to a fixed release.",
                          "why": [
                            "Advisory applicability: Applicable \u2014 the advisory matches the assessed dependency context.",
                            "Dependency evidence: werkzeug is a direct dependency; declared in pyproject.toml; resolved from uv.lock.",
                            "Version evidence: current dependency version 2.0.0 (lock file) is inside the advisory's affected range.",
                            "Direct reachability (current workspace): Reachable \u2014 an evidence-backed production path to the dependency was identified. The vulnerable multipart parser is called by the request handler.",
                            "Deep exploitability (current workspace): Exploitability: Yes; vulnerability-specific path: confirmed.",
                            "Audit assurance: status pass; evidence consistency strong."
                          ]
                        },
                        "researcher_view": {
                          "objective": "Find the weakness, determine exposure, and check whether the assessed application is actually affected.",
                          "target_outcome": "Prefer an evidence-backed Not Affected / low-info outcome when the current codebase can be excluded.",
                          "findings": [
                            "Advisory relevance: relevant via rules",
                            "Dependency presence: found as a direct dependency",
                            "Version check: 2.0.0 (lock file) is inside the advisory range",
                            "Direct reachability: reachable from production code",
                            "Deep analysis: confirmed=True, exploitable=YES"
                          ],
                          "conclusion": "The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code."
                        },
                        "remediation_view": {
                          "objective": "Reduce the finding to low/info when supportable, ideally by proving the current codebase is Not Affected.",
                          "status": "action_needed",
                          "summary": "The current assessment does not yet justify a low/info outcome. Use the recommended changes to eliminate reachability or move the assessed version outside the affected range.",
                          "recommendations": [
                            "Upgrade to 3.0.6",
                            "Upgrade, remove, or isolate the direct dependency and verify the vulnerable path is no longer reachable.",
                            "Rerun Agentyzer after remediation to confirm a Not Affected or low/info rescoring outcome."
                          ]
                        },
                        "audit_view": {
                          "objective": "Challenge the assessment and verify that the conclusion really matches the available evidence.",
                          "status": "pass",
                          "consistency": "strong",
                          "downgrade_target": false,
                          "downgrade_supported": true,
                          "checks": [
                            "Supports verdict: the current detected version remains within the affected range.",
                            "Supports verdict: direct production reachability was identified."
                          ],
                          "conclusion": "The available evidence is internally consistent with the current verdict. The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code."
                        },
                        "adjusted_cvss": {
                          "original_score": 6.3,
                          "adjusted_score": 6.3,
                          "original_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                          "adjusted_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A",
                          "version": "4.0",
                          "reasons": [
                            "version 2.0.0 (lock file) confirmed in affected range \u2014 lock file \u2014 version 2.0.0 is in the explicit affected versions list",
                            "LLM confirmed exploitable code path \u2192 E:A"
                          ],
                          "summary": "6.3 \u2192 6.3 (version 2.0.0 confirmed in affected range; LLM confirmed exploitable code path)",
                          "version_context": {
                            "detected_version": "2.0.0",
                            "version_source": "lock file",
                            "affected": true,
                            "note": "lock file \u2014 version 2.0.0 is in the explicit affected versions list",
                            "affected_ranges_summary": [
                              "SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)"
                            ],
                            "comparison_inputs": {
                              "component_name": "werkzeug",
                              "locked_version": "2.0.0",
                              "affected_ranges_summary": [
                                "ECOSYSTEM range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                                "Explicit affected versions: 2 listed"
                              ],
                              "affected_versions_count": 2
                            },
                            "comparison_trace": [
                              "Affected ranges: 1 SEMVER/ECOSYSTEM, 0 GIT, 2 explicit versions",
                              "  Explicit affected versions: ['2.0.0', '3.0.2']",
                              "  SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                              "version=2.0.0: MATCH in explicit affected versions list"
                            ]
                          }
                        },
                        "summary": "Direct dependency with reachable vulnerable code path.",
                        "reasoning": "The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code.",
                        "analysis": "EXPLOITABLE",
                        "justification": "NOT_SET",
                        "response": "UPDATE",
                        "details": "The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code.\nCVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A (score: 6.3)\nRescoring: LLM confirmed exploitable code path \u2192 E:A",
                        "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A",
                        "cvss_score": 6.3
                      },
                      "steps": [
                        {
                          "step": "scan_dependencies",
                          "title": "Scan dependency manifests and lock files",
                          "status": "pass",
                          "findings": {
                            "found": true,
                            "direct": true,
                            "locked_version": "2.0.0"
                          },
                          "evidence": [
                            "Found werkzeug in fixtures/python-direct-werkzeug/uv.lock",
                            "Locked version resolved to 2.0.0"
                          ]
                        }
                      ]
                    }
                  },
                  "asyncJob": {
                    "summary": "Accepted asynchronous assessment job",
                    "value": {
                      "job_id": "9f7e2c4b5a6d",
                      "status": "pending",
                      "poll_url": "/jobs/9f7e2c4b5a6d",
                      "configuration": {
                        "service_name": "Agentic Vulnerability Analyzer",
                        "service_version": "1.0.22",
                        "config_dir": "config",
                        "repos_config_path": "config/repos.yaml",
                        "repositories": {
                          "workspace_dir": "repos",
                          "component_count": 1,
                          "components": [
                            "benchmark"
                          ],
                          "aliases": [],
                          "default_template_configured": false,
                          "hot_reload": true
                        },
                        "features": {
                          "async_assessments": true,
                          "sync_assessments": true,
                          "bounded_async_execution": true,
                          "request_model_override": true,
                          "debug_responses": true,
                          "job_cancellation": true,
                          "job_logs": true,
                          "focus_path": true,
                          "repository_archive_inspection": true,
                          "repos_config_hot_reload": true
                        }
                      },
                      "backend": {
                        "llm": {
                          "provider": "ollama",
                          "backend": "OllamaClient",
                          "host": "http://localhost:11434",
                          "model": "mistral",
                          "healthy": true,
                          "supports_model_override": true
                        },
                        "repositories": {
                          "workspace_dir": "repos",
                          "reuse_strategy": "stable control repository plus detached per-analysis worktree",
                          "update_strategy": "cross-process repository lock around clone, fetch, and worktree creation",
                          "parallel_safety": "execution is bounded by AGENTYZER_MAX_CONCURRENT_JOBS; configured repositories use isolated worktrees, while focus_path concurrency is caller-managed"
                        },
                        "jobs": {
                          "job_store": "in_memory",
                          "execution_model": "bounded asyncio background tasks in this API process",
                          "known_jobs": 1,
                          "max_concurrent_jobs": 1,
                          "running_jobs": 0,
                          "queued_jobs": 1,
                          "available_slots": 1,
                          "status_counts": {
                            "pending": 1,
                            "running": 0,
                            "completed": 0,
                            "failed": 0,
                            "cancelled": 0
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    },
    "/jobs": {
      "get": {
        "tags": [
          "jobs"
        ],
        "summary": "List assessment jobs",
        "description": "Return all in-memory background jobs known to the current API process.",
        "operationId": "list_jobs_jobs_get",
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobListResponse"
                }
              }
            }
          }
        }
      }
    },
    "/jobs/{job_id}": {
      "get": {
        "tags": [
          "jobs"
        ],
        "summary": "Get job status",
        "description": "Retrieve the current state of a previously submitted asynchronous assessment job.",
        "operationId": "get_job_status_jobs__job_id__get",
        "parameters": [
          {
            "name": "job_id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "title": "Job Id"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobStatusResponse"
                }
              }
            }
          },
          "404": {
            "description": "The requested job ID does not exist.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      },
      "delete": {
        "tags": [
          "jobs"
        ],
        "summary": "Cancel or delete a job",
        "description": "Cancel a pending/running job or remove a completed, failed, or cancelled job from the in-memory job store.",
        "operationId": "delete_job_jobs__job_id__delete",
        "parameters": [
          {
            "name": "job_id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "title": "Job Id"
            }
          }
        ],
        "responses": {
          "204": {
            "description": "Successful Response"
          },
          "404": {
            "description": "The requested job ID does not exist.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "409": {
            "description": "The job cannot be cancelled or removed in its current state.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    },
    "/jobs/{job_id}/result": {
      "get": {
        "tags": [
          "jobs"
        ],
        "summary": "Fetch completed job result",
        "description": "Return the full assessment payload for a completed asynchronous job.",
        "operationId": "get_job_result_jobs__job_id__result_get",
        "parameters": [
          {
            "name": "job_id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "title": "Job Id"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AssessResponse"
                }
              }
            }
          },
          "404": {
            "description": "The requested job ID does not exist.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "409": {
            "description": "The job has not completed yet.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "500": {
            "description": "The job failed while running the pipeline.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    },
    "/jobs/{job_id}/compact": {
      "post": {
        "tags": [
          "jobs"
        ],
        "summary": "Compact a completed job for follow-up context",
        "description": "Return a concise structured context extracted from a completed assessment job.",
        "operationId": "compact_job_jobs__job_id__compact_post",
        "parameters": [
          {
            "name": "job_id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "title": "Job Id"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CompactContextResponse"
                }
              }
            }
          },
          "404": {
            "description": "The requested job ID does not exist.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "409": {
            "description": "The job has no result yet.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    },
    "/jobs/{job_id}/follow-up": {
      "post": {
        "tags": [
          "jobs"
        ],
        "summary": "Start a follow-up assessment from compacted parent context",
        "description": "Create a new asynchronous assessment job using the parent job request and compacted result context as guidance.",
        "operationId": "follow_up_job_jobs__job_id__follow_up_post",
        "parameters": [
          {
            "name": "job_id",
            "in": "path",
            "required": true,
            "schema": {
              "type": "string",
              "title": "Job Id"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/FollowUpRequest"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/JobSubmittedResponse"
                }
              }
            }
          },
          "404": {
            "description": "The requested parent job ID does not exist.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "409": {
            "description": "The parent job has no result yet.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "422": {
            "description": "Validation Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/HTTPValidationError"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "ActiveAgentStatus": {
        "properties": {
          "step": {
            "type": "string",
            "title": "Step",
            "description": "Stable machine-readable pipeline step identifier."
          },
          "title": {
            "type": "string",
            "title": "Title",
            "description": "Human-readable step title."
          },
          "agent": {
            "type": "string",
            "title": "Agent",
            "description": "Agent module currently handling the step."
          },
          "activity": {
            "type": "string",
            "title": "Activity",
            "description": "Short description of the work in progress."
          },
          "status": {
            "type": "string",
            "title": "Status",
            "description": "Current state of the active agent entry."
          }
        },
        "type": "object",
        "required": [
          "step",
          "title",
          "agent",
          "activity",
          "status"
        ],
        "title": "ActiveAgentStatus"
      },
      "AnalysisJustification": {
        "type": "string",
        "enum": [
          "CODE_NOT_PRESENT",
          "CODE_NOT_REACHABLE",
          "REQUIRES_CONFIGURATION",
          "REQUIRES_DEPENDENCY",
          "REQUIRES_ENVIRONMENT",
          "PROTECTED_BY_COMPILER",
          "PROTECTED_AT_RUNTIME",
          "PROTECTED_AT_PERIMETER",
          "PROTECTED_BY_MITIGATING_CONTROL",
          "NOT_SET"
        ],
        "title": "AnalysisJustification",
        "description": "Dependency-Track justification values for NOT_AFFECTED findings."
      },
      "AnalysisResponse": {
        "type": "string",
        "enum": [
          "CAN_NOT_FIX",
          "WILL_NOT_FIX",
          "UPDATE",
          "ROLLBACK",
          "WORKAROUND_AVAILABLE",
          "NOT_SET"
        ],
        "title": "AnalysisResponse",
        "description": "Dependency-Track analysis response values."
      },
      "AnalysisState": {
        "type": "string",
        "enum": [
          "EXPLOITABLE",
          "IN_TRIAGE",
          "FALSE_POSITIVE",
          "NOT_AFFECTED",
          "RESOLVED",
          "NOT_SET"
        ],
        "title": "AnalysisState",
        "description": "Dependency-Track analysis states (VEX)."
      },
      "AssessRequest": {
        "properties": {
          "vuln_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Vuln Id",
            "description": "Vulnerability identifier to assess, typically a CVE or GHSA.",
            "examples": [
              "CVE-2024-49766"
            ]
          },
          "cvss_vector": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cvss Vector",
            "description": "Optional CVSS vector string to rescore when advisory metadata does not already provide one.",
            "examples": [
              "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
            ]
          },
          "component_name": {
            "type": "string",
            "title": "Component Name",
            "description": "Logical component name from config/repos.yaml, or an ad-hoc name when focus_path is provided.",
            "examples": [
              "benchmark"
            ]
          },
          "project_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Project Name",
            "description": "Optional caller project name used to correlate and selectively clean assessment jobs.",
            "examples": [
              "ExampleApp"
            ]
          },
          "focus_path": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Focus Path",
            "description": "Optional absolute path to a local checkout to assess instead of cloning or resolving from config/repos.yaml.",
            "examples": [
              "/tmp/agentyzer-repos/vuln-benchmark-08dfa46a5b30"
            ]
          },
          "dependency_paths": {
            "anyOf": [
              {
                "items": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dependency Paths",
            "description": "Optional dependency chains to bias transitive reachability analysis. Each nested list represents one path from a top-level dependency to the vulnerable package.",
            "examples": [
              [
                [
                  "flask",
                  "werkzeug"
                ]
              ]
            ]
          },
          "project_versions": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Project Versions",
            "description": "Caller-supplied project/application releases for which the vulnerability was processed. These are repository-version candidates, not vulnerable dependency versions. The analyzer intersects them with repository tags, release branches, and configured default-branch version metadata before checking dependency versions.",
            "examples": [
              [
                "1.0.0",
                "1.1.0",
                "2.0.0"
              ]
            ]
          },
          "affected_product_versions": {
            "anyOf": [
              {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Affected Product Versions",
            "description": "Deprecated alias for project_versions. Values are processed project releases, never vulnerable dependency versions.",
            "deprecated": true
          },
          "user_guidance": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "User Guidance",
            "description": "Optional analyst context passed verbatim to every LLM call.",
            "examples": [
              "Treat code reachable from background workers as in scope."
            ]
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "Optional LLM model override for this assessment.",
            "examples": [
              "mistral"
            ]
          },
          "llm_backend": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Backend",
            "description": "Optional LLM backend label supplied by the caller for tracking.",
            "examples": [
              "ollama"
            ]
          },
          "llm_provider": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Provider",
            "description": "Optional LLM provider label supplied by the caller for tracking.",
            "examples": [
              "ollama"
            ]
          },
          "debug": {
            "type": "boolean",
            "title": "Debug",
            "description": "Enable verbose debug output, including per-step input snapshots and full version comparison traces.",
            "default": false,
            "examples": [
              true
            ]
          }
        },
        "type": "object",
        "required": [
          "component_name"
        ],
        "title": "AssessRequest",
        "description": "Input for starting a vulnerability assessment.",
        "examples": [
          {
            "component_name": "benchmark",
            "debug": true,
            "focus_path": "/tmp/agentyzer-repos/vuln-benchmark-08dfa46a5b30",
            "user_guidance": "Prioritize code paths reachable from HTTP request handlers.",
            "vuln_id": "CVE-2024-49766"
          },
          {
            "component_name": "benchmark",
            "debug": false,
            "dependency_paths": [
              [
                "flask",
                "werkzeug"
              ]
            ],
            "vuln_id": "CVE-2024-49766"
          }
        ]
      },
      "AssessResponse": {
        "properties": {
          "assessment": {
            "$ref": "#/components/schemas/Assessment",
            "description": "Overall assessment result."
          },
          "steps": {
            "items": {
              "$ref": "#/components/schemas/StepFindings"
            },
            "type": "array",
            "title": "Steps",
            "description": "Ordered pipeline findings produced while computing the assessment."
          },
          "llm_conversation": {
            "items": {
              "additionalProperties": true,
              "type": "object"
            },
            "type": "array",
            "title": "Llm Conversation",
            "description": "Actual LLM conversation turns captured during this assessment. Each turn includes timestamps, messages sent to the model, the assistant response, directional token usage, and provider metrics when available."
          }
        },
        "type": "object",
        "required": [
          "assessment",
          "steps"
        ],
        "title": "AssessResponse",
        "description": "Top-level response \u2014 assessment + per-step detail.",
        "example": {
          "assessment": {
            "adjusted_cvss": {
              "adjusted_score": 6.3,
              "adjusted_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A",
              "original_score": 6.3,
              "original_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
              "reasons": [
                "version 2.0.0 (lock file) confirmed in affected range \u2014 lock file \u2014 version 2.0.0 is in the explicit affected versions list",
                "LLM confirmed exploitable code path \u2192 E:A"
              ],
              "summary": "6.3 \u2192 6.3 (version 2.0.0 confirmed in affected range; LLM confirmed exploitable code path)",
              "version": "4.0",
              "version_context": {
                "affected": true,
                "affected_ranges_summary": [
                  "SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)"
                ],
                "comparison_inputs": {
                  "affected_ranges_summary": [
                    "ECOSYSTEM range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                    "Explicit affected versions: 2 listed"
                  ],
                  "affected_versions_count": 2,
                  "component_name": "werkzeug",
                  "locked_version": "2.0.0"
                },
                "comparison_trace": [
                  "Affected ranges: 1 SEMVER/ECOSYSTEM, 0 GIT, 2 explicit versions",
                  "  Explicit affected versions: ['2.0.0', '3.0.2']",
                  "  SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                  "version=2.0.0: MATCH in explicit affected versions list"
                ],
                "detected_version": "2.0.0",
                "note": "lock file \u2014 version 2.0.0 is in the explicit affected versions list",
                "version_source": "lock file"
              }
            },
            "advisory_relevance": {
              "reasons": [
                "OSV ecosystem match: {'PyPI'} (project={'PyPI'})"
              ],
              "relevant": true,
              "source": "rules",
              "status": "ok"
            },
            "affected": true,
            "analysis": "EXPLOITABLE",
            "audit_view": {
              "checks": [
                "Supports verdict: the current detected version remains within the affected range.",
                "Supports verdict: direct production reachability was identified."
              ],
              "conclusion": "The available evidence is internally consistent with the current verdict. The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code.",
              "consistency": "strong",
              "downgrade_supported": true,
              "downgrade_target": false,
              "objective": "Challenge the assessment and verify that the conclusion really matches the available evidence.",
              "status": "pass"
            },
            "confidence": "High",
            "cvss_score": 6.3,
            "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A",
            "dependency_presence": {
              "declared_in": [
                "pyproject.toml"
              ],
              "direct": true,
              "found": true,
              "lock_files": [
                "uv.lock"
              ],
              "locked_version": "2.0.0",
              "presence_basis": "direct",
              "repo_found": true,
              "sbom_attributed": true,
              "transitive": false
            },
            "details": "The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code.\nCVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A (score: 6.3)\nRescoring: LLM confirmed exploitable code path \u2192 E:A",
            "executive_summary": {
              "assessment": "Disposition: Affected. Confidence: High. Exposure: direct. Audit: status pass; evidence consistency strong. Basis: the current detected version remains within the affected range. Required action: upgrade werkzeug to a fixed release.",
              "vulnerability": "CVE-2024-49766 \u00b7 werkzeug: crafted multipart form data can trigger excessive resource consumption.",
              "why": [
                "Advisory applicability: Applicable \u2014 the advisory matches the assessed dependency context.",
                "Dependency evidence: werkzeug is a direct dependency; declared in pyproject.toml; resolved from uv.lock.",
                "Version evidence: current dependency version 2.0.0 (lock file) is inside the advisory's affected range.",
                "Direct reachability (current workspace): Reachable \u2014 an evidence-backed production path to the dependency was identified. The vulnerable multipart parser is called by the request handler.",
                "Deep exploitability (current workspace): Exploitability: Yes; vulnerability-specific path: confirmed.",
                "Audit assurance: status pass; evidence consistency strong."
              ]
            },
            "exposure": "direct",
            "justification": "NOT_SET",
            "reasoning": "The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code.",
            "remediation_view": {
              "objective": "Reduce the finding to low/info when supportable, ideally by proving the current codebase is Not Affected.",
              "recommendations": [
                "Upgrade to 3.0.6",
                "Upgrade, remove, or isolate the direct dependency and verify the vulnerable path is no longer reachable.",
                "Rerun Agentyzer after remediation to confirm a Not Affected or low/info rescoring outcome."
              ],
              "status": "action_needed",
              "summary": "The current assessment does not yet justify a low/info outcome. Use the recommended changes to eliminate reachability or move the assessed version outside the affected range."
            },
            "researcher_view": {
              "conclusion": "The dependency is present, the locked version is inside the advisory range, and the vulnerable API is reachable from application code.",
              "findings": [
                "Advisory relevance: relevant via rules",
                "Dependency presence: found as a direct dependency",
                "Version check: 2.0.0 (lock file) is inside the advisory range",
                "Direct reachability: reachable from production code",
                "Deep analysis: confirmed=True, exploitable=YES"
              ],
              "objective": "Find the weakness, determine exposure, and check whether the assessed application is actually affected.",
              "target_outcome": "Prefer an evidence-backed Not Affected / low-info outcome when the current codebase can be excluded."
            },
            "response": "UPDATE",
            "summary": "Direct dependency with reachable vulnerable code path.",
            "verdict": "Affected",
            "version_analysis": {
              "affected": true,
              "affected_ranges_summary": [
                "SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)"
              ],
              "checked_versions": [
                {
                  "affected": true,
                  "notes": "lock file \u2014 version 2.0.0 is in the explicit affected versions list",
                  "ref": "LOCKED",
                  "ref_type": "lock",
                  "version": "2.0.0"
                },
                {
                  "affected": true,
                  "notes": "version is in the explicit affected versions list",
                  "ref": "WORKTREE",
                  "ref_type": "worktree",
                  "source": "manifest",
                  "version": "2.0.0"
                }
              ],
              "comparison_inputs": {
                "affected_ranges_summary": [
                  "ECOSYSTEM range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                  "Explicit affected versions: 2 listed"
                ],
                "affected_versions_count": 2,
                "component_name": "werkzeug",
                "locked_version": "2.0.0"
              },
              "comparison_trace": [
                "Affected ranges: 1 SEMVER/ECOSYSTEM, 0 GIT, 2 explicit versions",
                "  Explicit affected versions: ['2.0.0', '3.0.2']",
                "  SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)",
                "version=2.0.0: MATCH in explicit affected versions list"
              ],
              "detected_version": "2.0.0",
              "historical_affected": [],
              "note": "lock file \u2014 version 2.0.0 is in the explicit affected versions list",
              "version_source": "lock file"
            }
          },
          "steps": [
            {
              "evidence": [
                "Found werkzeug in fixtures/python-direct-werkzeug/uv.lock",
                "Locked version resolved to 2.0.0"
              ],
              "findings": {
                "direct": true,
                "found": true,
                "locked_version": "2.0.0"
              },
              "status": "pass",
              "step": "scan_dependencies",
              "title": "Scan dependency manifests and lock files"
            }
          ]
        }
      },
      "Assessment": {
        "properties": {
          "affected": {
            "type": "boolean",
            "title": "Affected",
            "description": "Whether the analyzer concluded that the target is affected by the vulnerability."
          },
          "verdict": {
            "type": "string",
            "title": "Verdict",
            "description": "Top-level verdict label returned by the analyzer.",
            "examples": [
              "Affected"
            ]
          },
          "confidence": {
            "type": "string",
            "title": "Confidence",
            "description": "Confidence level for the verdict.",
            "examples": [
              "High"
            ]
          },
          "exposure": {
            "type": "string",
            "title": "Exposure",
            "description": "Exposure classification such as direct, transitive, or none.",
            "examples": [
              "direct"
            ]
          },
          "dependency_presence": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/DependencyPresence"
              },
              {
                "type": "null"
              }
            ],
            "description": "Normalized dependency presence provenance combining local repo rediscovery and SBOM attribution signals."
          },
          "advisory_relevance": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Advisory Relevance",
            "description": "Outcome of the advisory relevance filter step, including whether the advisory was considered relevant, whether the decision came from deterministic rules or the LLM, and the supporting reasons."
          },
          "version_analysis": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Version Analysis",
            "description": "Structured version evidence, including covered product versions, the separately detected dependency/component version, advisory range summaries, and the per-ref version table used during verdicting."
          },
          "researcher_view": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Researcher View",
            "description": "Security researcher / analyst view: what weakness was examined, what evidence was found, and why the project does or does not appear affected."
          },
          "remediation_view": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Remediation View",
            "description": "Remediation-focused view aimed at reaching low/info if possible, including upgrade targets or other concrete actions."
          },
          "audit_view": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Audit View",
            "description": "Critical review of whether the final assessment is well supported by the available evidence."
          },
          "ticket_text": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Ticket Text",
            "description": "Developer-focused Markdown ticket text generated from the assessment, excluding analyzer runtime details."
          },
          "adjusted_cvss": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/CvssAdjustment"
              },
              {
                "type": "null"
              }
            ],
            "description": "Rescored CVSS details when advisory scoring data is available."
          },
          "executive_summary": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ExecutiveSummary"
              },
              {
                "type": "null"
              }
            ],
            "description": "Compact executive statements that separate the advisory's vulnerability from the audited, repository-specific assessment and explain the decision with concrete evidence."
          },
          "summary": {
            "type": "string",
            "title": "Summary",
            "description": "Short summary intended for human-readable reporting."
          },
          "reasoning": {
            "type": "string",
            "title": "Reasoning",
            "description": "Detailed rationale that supports the verdict."
          },
          "analysis": {
            "$ref": "#/components/schemas/AnalysisState",
            "description": "Dependency-Track analysis state (VEX). Maps the verdict to one of: EXPLOITABLE, IN_TRIAGE, FALSE_POSITIVE, NOT_AFFECTED, NOT_SET.",
            "examples": [
              "EXPLOITABLE"
            ]
          },
          "justification": {
            "$ref": "#/components/schemas/AnalysisJustification",
            "description": "Dependency-Track justification for NOT_AFFECTED findings. One of CODE_NOT_PRESENT, CODE_NOT_REACHABLE, REQUIRES_CONFIGURATION, REQUIRES_DEPENDENCY, REQUIRES_ENVIRONMENT, PROTECTED_BY_COMPILER, PROTECTED_AT_RUNTIME, PROTECTED_AT_PERIMETER, PROTECTED_BY_MITIGATING_CONTROL, NOT_SET.",
            "examples": [
              "NOT_SET"
            ]
          },
          "response": {
            "$ref": "#/components/schemas/AnalysisResponse",
            "description": "Dependency-Track analysis response recommendation.",
            "default": "NOT_SET",
            "examples": [
              "UPDATE"
            ]
          },
          "details": {
            "type": "string",
            "title": "Details",
            "description": "Assessment text that rationalizes the analysis decision. Suitable for the Dependency-Track analysis comment field."
          },
          "cvss_vector": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cvss Vector",
            "description": "Full CVSS vector string (original or adjusted) for this finding.",
            "examples": [
              "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
            ]
          },
          "cvss_score": {
            "anyOf": [
              {
                "type": "number"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cvss Score",
            "description": "Numeric CVSS score derived from the vector (adjusted if rescoring was applied).",
            "examples": [
              6.3
            ]
          }
        },
        "type": "object",
        "required": [
          "affected",
          "verdict",
          "confidence",
          "exposure",
          "summary",
          "reasoning",
          "analysis",
          "justification",
          "details"
        ],
        "title": "Assessment",
        "description": "Overall verdict produced by the pipeline."
      },
      "BackendInformation": {
        "properties": {
          "llm": {
            "$ref": "#/components/schemas/LlmBackendInfo",
            "description": "Configured LLM backend details."
          },
          "repositories": {
            "$ref": "#/components/schemas/RepositoryBackendInfo",
            "description": "Repository workspace backend details."
          },
          "jobs": {
            "$ref": "#/components/schemas/JobBackendInfo"
          }
        },
        "type": "object",
        "required": [
          "llm",
          "repositories",
          "jobs"
        ],
        "title": "BackendInformation",
        "description": "Operational backend information for API consumers."
      },
      "BenchmarkCompareRequest": {
        "properties": {
          "benchmark": {
            "additionalProperties": true,
            "type": "object",
            "title": "Benchmark",
            "description": "Structured benchmark artifact prepared by DTVP. It includes the human assessment snapshot, automated Agentyzer assessment summary, deterministic state/CVSS deltas, and fallback rating."
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "Optional LLM model override for the probabilistic comparison."
          }
        },
        "type": "object",
        "required": [
          "benchmark"
        ],
        "title": "BenchmarkCompareRequest",
        "description": "Input for comparing human and automated assessment artifacts."
      },
      "BenchmarkCompareResponse": {
        "properties": {
          "schema_version": {
            "type": "string",
            "title": "Schema Version",
            "description": "Benchmark comparison schema version."
          },
          "comparison_method": {
            "type": "string",
            "title": "Comparison Method",
            "description": "Comparison method, such as agentyzer_probabilistic or deterministic_fallback."
          },
          "evaluator": {
            "additionalProperties": true,
            "type": "object",
            "title": "Evaluator",
            "description": "Evaluator metadata including model and whether probabilistic scoring was available."
          },
          "rating": {
            "additionalProperties": true,
            "type": "object",
            "title": "Rating",
            "description": "Canonical 1-5 agreement rating for human and automated assessment artifacts. The optional letter grade is a derived display alias."
          },
          "human": {
            "additionalProperties": true,
            "type": "object",
            "title": "Human",
            "description": "Normalized human assessment snapshot."
          },
          "automated": {
            "additionalProperties": true,
            "type": "object",
            "title": "Automated",
            "description": "Normalized automated assessment snapshot."
          },
          "deltas": {
            "additionalProperties": true,
            "type": "object",
            "title": "Deltas",
            "description": "Deterministic state, CVSS, and reasoning anchors."
          },
          "findings": {
            "items": {
              "additionalProperties": true,
              "type": "object"
            },
            "type": "array",
            "title": "Findings",
            "description": "Important agreement or disagreement findings."
          },
          "recommendation": {
            "type": "string",
            "title": "Recommendation",
            "description": "Recommended reviewer action."
          },
          "reasoning_summary": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Reasoning Summary",
            "description": "Probabilistic evaluator explanation for the rating."
          }
        },
        "type": "object",
        "required": [
          "schema_version",
          "comparison_method",
          "rating",
          "human",
          "automated",
          "deltas",
          "recommendation"
        ],
        "title": "BenchmarkCompareResponse",
        "description": "Probabilistic benchmark comparison result."
      },
      "CompactContextResponse": {
        "properties": {
          "job_id": {
            "type": "string",
            "title": "Job Id",
            "description": "Parent job identifier that was compacted."
          },
          "compacted_at": {
            "type": "string",
            "title": "Compacted At",
            "description": "RFC 3339 timestamp for compaction."
          },
          "context": {
            "additionalProperties": true,
            "type": "object",
            "title": "Context",
            "description": "Structured compact context suitable for follow-up runs."
          },
          "prompt_context": {
            "type": "string",
            "title": "Prompt Context",
            "description": "Plain-text rendering of the compact context for LLM guidance."
          }
        },
        "type": "object",
        "required": [
          "job_id",
          "compacted_at",
          "context",
          "prompt_context"
        ],
        "title": "CompactContextResponse"
      },
      "CvssAdjustment": {
        "properties": {
          "original_score": {
            "type": "number",
            "title": "Original Score",
            "description": "Highest CVSS score reported by the advisory.",
            "examples": [
              6.3
            ]
          },
          "adjusted_score": {
            "type": "number",
            "title": "Adjusted Score",
            "description": "Environment-adjusted CVSS score after dependency, reachability, and version evidence are applied.",
            "examples": [
              6.3
            ]
          },
          "original_vector": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Original Vector",
            "description": "Original CVSS vector used as the rescoring baseline.",
            "examples": [
              "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
            ]
          },
          "adjusted_vector": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Adjusted Vector",
            "description": "Modified CVSS vector after environmental metrics are applied.",
            "examples": [
              "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A"
            ]
          },
          "version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Version",
            "description": "CVSS specification version for the vector and scores.",
            "examples": [
              "4.0"
            ]
          },
          "reasons": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Reasons",
            "description": "Ordered explanation of why the score changed or stayed the same."
          },
          "summary": {
            "type": "string",
            "title": "Summary",
            "description": "One-line explanation summarizing the original and adjusted score relationship.",
            "examples": [
              "6.3 \u2192 6.3 (version 2.0.0 confirmed in affected range; LLM confirmed exploitable code path)"
            ]
          },
          "version_context": {
            "$ref": "#/components/schemas/VersionContext",
            "description": "Detailed context for the component version checked during rescoring."
          }
        },
        "type": "object",
        "required": [
          "original_score",
          "adjusted_score",
          "summary"
        ],
        "title": "CvssAdjustment",
        "description": "Original and rescored CVSS details for the assessment."
      },
      "DependencyPresence": {
        "properties": {
          "found": {
            "type": "boolean",
            "title": "Found",
            "description": "True when the vulnerable dependency is considered present in the assessed project."
          },
          "repo_found": {
            "type": "boolean",
            "title": "Repo Found",
            "description": "True when manifests or lock files in the local repo scan rediscovered the dependency."
          },
          "sbom_attributed": {
            "type": "boolean",
            "title": "Sbom Attributed",
            "description": "True when the dependency presence comes from upstream SBOM/input attribution."
          },
          "presence_basis": {
            "type": "string",
            "title": "Presence Basis",
            "description": "Primary presence source used for reporting (for example: direct, transitive, sbom_attributed, not_found).",
            "examples": [
              "sbom_attributed"
            ]
          },
          "direct": {
            "type": "boolean",
            "title": "Direct",
            "description": "True when the dependency is declared directly in a top-level manifest."
          },
          "transitive": {
            "type": "boolean",
            "title": "Transitive",
            "description": "True when dependency evidence is transitive rather than directly declared."
          },
          "declared_in": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Declared In",
            "description": "Manifest files where the dependency was declared directly."
          },
          "lock_files": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Lock Files",
            "description": "Lock files where the dependency was observed."
          },
          "locked_version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Locked Version",
            "description": "Best-effort pinned version discovered in lock files."
          }
        },
        "type": "object",
        "required": [
          "found",
          "repo_found",
          "sbom_attributed",
          "presence_basis",
          "direct",
          "transitive"
        ],
        "title": "DependencyPresence",
        "description": "Dependency presence and provenance evidence for the assessed component."
      },
      "ErrorResponse": {
        "properties": {
          "detail": {
            "type": "string",
            "title": "Detail",
            "description": "Human-readable error description."
          }
        },
        "type": "object",
        "required": [
          "detail"
        ],
        "title": "ErrorResponse",
        "description": "Standard error payload returned by FastAPI.",
        "example": {
          "detail": "Job not found"
        }
      },
      "ExecutiveSummary": {
        "properties": {
          "vulnerability": {
            "type": "string",
            "title": "Vulnerability",
            "description": "Brief description of the vulnerability and affected dependency."
          },
          "assessment": {
            "type": "string",
            "title": "Assessment",
            "description": "Brief final assessment after version, reachability, and audit checks."
          },
          "why": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Why",
            "description": "Complete, audit-ready decision rationale drawn from labeled advisory applicability, dependency, version, reachability, exploitability, release, and assurance evidence."
          }
        },
        "type": "object",
        "required": [
          "vulnerability",
          "assessment"
        ],
        "title": "ExecutiveSummary",
        "description": "Compact advisory, repository assessment, and decisive evidence."
      },
      "FollowUpRequest": {
        "properties": {
          "question": {
            "type": "string",
            "title": "Question",
            "description": "Reviewer follow-up question to answer in the new assessment.",
            "examples": [
              "Is Keycloak itself vulnerable, not only the extension?"
            ]
          },
          "vuln_id": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Vuln Id",
            "description": "Optional vulnerability override. Defaults to the parent request."
          },
          "component_name": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Component Name",
            "description": "Optional component override. Defaults to the parent request."
          },
          "cvss_vector": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Cvss Vector",
            "description": "Optional CVSS vector override. Defaults to the parent request."
          },
          "focus_path": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Focus Path",
            "description": "Optional local checkout override. Defaults to the parent request."
          },
          "dependency_paths": {
            "anyOf": [
              {
                "items": {
                  "items": {
                    "type": "string"
                  },
                  "type": "array"
                },
                "type": "array"
              },
              {
                "type": "null"
              }
            ],
            "title": "Dependency Paths",
            "description": "Optional dependency path override. Defaults to the parent request."
          },
          "user_guidance": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "User Guidance",
            "description": "Additional reviewer guidance appended after the compact parent context."
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "Optional LLM model override for the follow-up assessment."
          },
          "llm_backend": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Backend",
            "description": "Optional LLM backend label supplied by the caller for tracking."
          },
          "llm_provider": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Provider",
            "description": "Optional LLM provider label supplied by the caller for tracking."
          },
          "debug": {
            "type": "boolean",
            "title": "Debug",
            "description": "Enable verbose debug output for the follow-up assessment.",
            "default": false
          }
        },
        "type": "object",
        "required": [
          "question"
        ],
        "title": "FollowUpRequest",
        "description": "Input for rerunning an assessment using compacted parent-job context."
      },
      "HTTPValidationError": {
        "properties": {
          "detail": {
            "items": {
              "$ref": "#/components/schemas/ValidationError"
            },
            "type": "array",
            "title": "Detail"
          }
        },
        "type": "object",
        "title": "HTTPValidationError"
      },
      "HealthResponse": {
        "properties": {
          "status": {
            "type": "string",
            "title": "Status",
            "description": "Service health indicator.",
            "examples": [
              "ok"
            ]
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "Configured LLM model when known."
          },
          "llm_backend": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Backend",
            "description": "Configured LLM backend identifier or URL when known."
          },
          "llm_provider": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Provider",
            "description": "Configured LLM provider label when known."
          },
          "llm": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm",
            "description": "Structured LLM backend metadata when known."
          },
          "configuration": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ServiceConfiguration"
              },
              {
                "type": "null"
              }
            ],
            "description": "Sanitized service configuration visible to API consumers."
          },
          "backend": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/BackendInformation"
              },
              {
                "type": "null"
              }
            ],
            "description": "Operational backend details visible to API consumers."
          }
        },
        "type": "object",
        "required": [
          "status"
        ],
        "title": "HealthResponse",
        "description": "Health check response.",
        "example": {
          "backend": {
            "jobs": {
              "available_slots": 1,
              "execution_model": "bounded asyncio background tasks in this API process",
              "job_store": "in_memory",
              "known_jobs": 1,
              "max_concurrent_jobs": 1,
              "queued_jobs": 1,
              "running_jobs": 0,
              "status_counts": {
                "cancelled": 0,
                "completed": 0,
                "failed": 0,
                "pending": 1,
                "running": 0
              }
            },
            "llm": {
              "backend": "OllamaClient",
              "healthy": true,
              "host": "http://localhost:11434",
              "model": "mistral",
              "provider": "ollama",
              "supports_model_override": true
            },
            "repositories": {
              "parallel_safety": "execution is bounded by AGENTYZER_MAX_CONCURRENT_JOBS; configured repositories use isolated worktrees, while focus_path concurrency is caller-managed",
              "reuse_strategy": "stable control repository plus detached per-analysis worktree",
              "update_strategy": "cross-process repository lock around clone, fetch, and worktree creation",
              "workspace_dir": "repos"
            }
          },
          "configuration": {
            "config_dir": "config",
            "features": {
              "async_assessments": true,
              "bounded_async_execution": true,
              "debug_responses": true,
              "focus_path": true,
              "job_cancellation": true,
              "job_logs": true,
              "repos_config_hot_reload": true,
              "repository_archive_inspection": true,
              "request_model_override": true,
              "sync_assessments": true
            },
            "repos_config_path": "config/repos.yaml",
            "repositories": {
              "aliases": [],
              "component_count": 1,
              "components": [
                "benchmark"
              ],
              "default_template_configured": false,
              "hot_reload": true,
              "workspace_dir": "repos"
            },
            "service_name": "Agentic Vulnerability Analyzer",
            "service_version": "1.0.22"
          },
          "llm_backend": "http://localhost:11434",
          "llm_provider": "ollama",
          "model": "mistral",
          "status": "ok"
        }
      },
      "JobBackendInfo": {
        "properties": {
          "job_store": {
            "type": "string",
            "title": "Job Store",
            "description": "Persistence backend used for job records."
          },
          "execution_model": {
            "type": "string",
            "title": "Execution Model",
            "description": "How background assessments are run."
          },
          "known_jobs": {
            "type": "integer",
            "title": "Known Jobs",
            "description": "Number of jobs known to this API process."
          },
          "max_concurrent_jobs": {
            "type": "integer",
            "minimum": 1.0,
            "title": "Max Concurrent Jobs",
            "description": "Maximum number of assessment pipelines this process runs at the same time."
          },
          "running_jobs": {
            "type": "integer",
            "title": "Running Jobs",
            "description": "Number of assessment pipelines currently occupying execution slots."
          },
          "queued_jobs": {
            "type": "integer",
            "title": "Queued Jobs",
            "description": "Number of accepted jobs waiting for an execution slot."
          },
          "available_slots": {
            "type": "integer",
            "minimum": 0.0,
            "title": "Available Slots",
            "description": "Number of execution slots currently available for pending work."
          },
          "status_counts": {
            "additionalProperties": {
              "type": "integer"
            },
            "type": "object",
            "title": "Status Counts",
            "description": "Current in-memory job count by lifecycle status."
          }
        },
        "type": "object",
        "required": [
          "job_store",
          "execution_model",
          "known_jobs",
          "max_concurrent_jobs",
          "running_jobs",
          "queued_jobs",
          "available_slots"
        ],
        "title": "JobBackendInfo",
        "description": "Async job backend details."
      },
      "JobListResponse": {
        "properties": {
          "jobs": {
            "items": {
              "$ref": "#/components/schemas/JobStatusResponse"
            },
            "type": "array",
            "title": "Jobs",
            "description": "Currently known in-memory jobs."
          },
          "configuration": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ServiceConfiguration"
              },
              {
                "type": "null"
              }
            ],
            "description": "Sanitized service configuration shared by all listed jobs."
          },
          "backend": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/BackendInformation"
              },
              {
                "type": "null"
              }
            ],
            "description": "Operational backend details shared by all listed jobs."
          }
        },
        "type": "object",
        "required": [
          "jobs"
        ],
        "title": "JobListResponse"
      },
      "JobProgress": {
        "properties": {
          "completed_steps": {
            "type": "integer",
            "title": "Completed Steps",
            "description": "Number of pipeline steps that have finished so far."
          },
          "total_steps": {
            "type": "integer",
            "title": "Total Steps",
            "description": "Estimated number of steps for the current pipeline path."
          },
          "percent": {
            "type": "integer",
            "maximum": 100.0,
            "minimum": 0.0,
            "title": "Percent",
            "description": "Integer progress percentage for the assessment job."
          },
          "current_step": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Step",
            "description": "Most recently started or currently active pipeline step."
          },
          "current_title": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Title",
            "description": "Human-readable title for the current pipeline step."
          },
          "current_agent": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Agent",
            "description": "Agent module currently responsible for the active work."
          },
          "current_activity": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Current Activity",
            "description": "Short description of what the current agent is doing."
          },
          "last_completed_step": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Completed Step",
            "description": "Most recent pipeline step to finish."
          },
          "last_updated_at": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Updated At",
            "description": "RFC 3339 timestamp for the latest progress update."
          },
          "active_agents": {
            "items": {
              "$ref": "#/components/schemas/ActiveAgentStatus"
            },
            "type": "array",
            "title": "Active Agents",
            "description": "All steps that are currently running, including parallel branches."
          },
          "step_statuses": {
            "additionalProperties": {
              "type": "string"
            },
            "type": "object",
            "title": "Step Statuses",
            "description": "Latest known status for each pipeline step reached so far."
          },
          "logs": {
            "items": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "string"
                }
              ]
            },
            "type": "array",
            "title": "Logs",
            "description": "Recent live log entries emitted while the job runs."
          }
        },
        "type": "object",
        "required": [
          "completed_steps",
          "total_steps",
          "percent"
        ],
        "title": "JobProgress"
      },
      "JobStatus": {
        "type": "string",
        "enum": [
          "pending",
          "running",
          "completed",
          "failed",
          "cancelled"
        ],
        "title": "JobStatus"
      },
      "JobStatusResponse": {
        "properties": {
          "job_id": {
            "type": "string",
            "title": "Job Id",
            "description": "Opaque job identifier returned by POST /assess in async mode."
          },
          "status": {
            "$ref": "#/components/schemas/JobStatus",
            "description": "Current lifecycle state of the assessment job."
          },
          "created_at": {
            "type": "string",
            "title": "Created At",
            "description": "RFC 3339 timestamp for when the job was created."
          },
          "finished_at": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Finished At",
            "description": "RFC 3339 timestamp for when the job finished, if available."
          },
          "error": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Error",
            "description": "Error message for failed jobs."
          },
          "progress": {
            "$ref": "#/components/schemas/JobProgress",
            "description": "UI-friendly live progress snapshot for the assessment pipeline."
          },
          "request": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Request",
            "description": "Original assessment request metadata with unset fields omitted."
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "LLM model used for this assessment when known."
          },
          "llm_backend": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Backend",
            "description": "LLM backend identifier or URL when known."
          },
          "llm_provider": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Provider",
            "description": "LLM provider label when known."
          },
          "llm": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm",
            "description": "Structured LLM backend metadata when known."
          },
          "logs": {
            "items": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "string"
                }
              ]
            },
            "type": "array",
            "title": "Logs",
            "description": "Recent live log entries emitted while the job runs."
          },
          "configuration": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ServiceConfiguration"
              },
              {
                "type": "null"
              }
            ],
            "description": "Sanitized service configuration visible to API consumers."
          },
          "backend": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/BackendInformation"
              },
              {
                "type": "null"
              }
            ],
            "description": "Operational backend details visible to API consumers."
          }
        },
        "type": "object",
        "required": [
          "job_id",
          "status",
          "created_at",
          "progress"
        ],
        "title": "JobStatusResponse",
        "example": {
          "created_at": "2026-04-24T15:42:10.123456+00:00",
          "job_id": "9f7e2c4b5a6d",
          "progress": {
            "active_agents": [
              {
                "activity": "Searching source files for vulnerable symbols and usage",
                "agent": "code_scanner",
                "status": "running",
                "step": "scan_code",
                "title": "Code Scan"
              },
              {
                "activity": "Scanning manifests and lock files for the vulnerable package",
                "agent": "dependency_scanner",
                "status": "running",
                "step": "scan_dependencies",
                "title": "Dependency Scan"
              }
            ],
            "completed_steps": 5,
            "current_activity": "Searching source files for vulnerable symbols and usage",
            "current_agent": "code_scanner",
            "current_step": "scan_code",
            "current_title": "Code Scan",
            "last_completed_step": "inspect_archives",
            "last_updated_at": "2026-04-24T15:42:11.102938+00:00",
            "percent": 38,
            "step_statuses": {
              "discover_vuln": "completed",
              "fetch_advisory": "completed",
              "filter_advisory": "completed",
              "inspect_archives": "completed",
              "prepare_repo": "completed",
              "scan_code": "running",
              "scan_dependencies": "running"
            },
            "total_steps": 13
          },
          "status": "running"
        }
      },
      "JobSubmittedResponse": {
        "properties": {
          "job_id": {
            "type": "string",
            "title": "Job Id",
            "description": "Opaque identifier for the background assessment job."
          },
          "status": {
            "$ref": "#/components/schemas/JobStatus",
            "description": "Initial status for the newly created job."
          },
          "poll_url": {
            "type": "string",
            "title": "Poll Url",
            "description": "Relative URL that can be polled for job status updates."
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "LLM model accepted for this job when known."
          },
          "llm_backend": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Backend",
            "description": "LLM backend accepted for this job when known."
          },
          "llm_provider": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm Provider",
            "description": "LLM provider accepted for this job when known."
          },
          "llm": {
            "anyOf": [
              {
                "additionalProperties": true,
                "type": "object"
              },
              {
                "type": "null"
              }
            ],
            "title": "Llm",
            "description": "Structured LLM backend metadata accepted for this job."
          },
          "configuration": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/ServiceConfiguration"
              },
              {
                "type": "null"
              }
            ],
            "description": "Sanitized service configuration accepted for this job."
          },
          "backend": {
            "anyOf": [
              {
                "$ref": "#/components/schemas/BackendInformation"
              },
              {
                "type": "null"
              }
            ],
            "description": "Operational backend details accepted for this job."
          }
        },
        "type": "object",
        "required": [
          "job_id",
          "status",
          "poll_url"
        ],
        "title": "JobSubmittedResponse",
        "example": {
          "backend": {
            "jobs": {
              "available_slots": 1,
              "execution_model": "bounded asyncio background tasks in this API process",
              "job_store": "in_memory",
              "known_jobs": 1,
              "max_concurrent_jobs": 1,
              "queued_jobs": 1,
              "running_jobs": 0,
              "status_counts": {
                "cancelled": 0,
                "completed": 0,
                "failed": 0,
                "pending": 1,
                "running": 0
              }
            },
            "llm": {
              "backend": "OllamaClient",
              "healthy": true,
              "host": "http://localhost:11434",
              "model": "mistral",
              "provider": "ollama",
              "supports_model_override": true
            },
            "repositories": {
              "parallel_safety": "execution is bounded by AGENTYZER_MAX_CONCURRENT_JOBS; configured repositories use isolated worktrees, while focus_path concurrency is caller-managed",
              "reuse_strategy": "stable control repository plus detached per-analysis worktree",
              "update_strategy": "cross-process repository lock around clone, fetch, and worktree creation",
              "workspace_dir": "repos"
            }
          },
          "configuration": {
            "config_dir": "config",
            "features": {
              "async_assessments": true,
              "bounded_async_execution": true,
              "debug_responses": true,
              "focus_path": true,
              "job_cancellation": true,
              "job_logs": true,
              "repos_config_hot_reload": true,
              "repository_archive_inspection": true,
              "request_model_override": true,
              "sync_assessments": true
            },
            "repos_config_path": "config/repos.yaml",
            "repositories": {
              "aliases": [],
              "component_count": 1,
              "components": [
                "benchmark"
              ],
              "default_template_configured": false,
              "hot_reload": true,
              "workspace_dir": "repos"
            },
            "service_name": "Agentic Vulnerability Analyzer",
            "service_version": "1.0.22"
          },
          "job_id": "9f7e2c4b5a6d",
          "poll_url": "/jobs/9f7e2c4b5a6d",
          "status": "pending"
        }
      },
      "LlmBackendInfo": {
        "properties": {
          "provider": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Provider",
            "description": "Configured LLM provider label, such as ollama or openwebui."
          },
          "backend": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Backend",
            "description": "Concrete backend client class used by the API process."
          },
          "host": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Host",
            "description": "Configured backend base URL when available."
          },
          "model": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Model",
            "description": "Default model configured for LLM-backed assessment steps."
          },
          "healthy": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Healthy",
            "description": "Last known startup health-check result for the default backend."
          },
          "last_error": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Last Error",
            "description": "Last backend health or request error observed by the configured client, if any."
          },
          "supports_model_override": {
            "type": "boolean",
            "title": "Supports Model Override",
            "description": "Whether callers can request a per-assessment model override with `model`.",
            "default": true
          }
        },
        "type": "object",
        "title": "LlmBackendInfo",
        "description": "Runtime LLM backend details useful to API consumers."
      },
      "RepositoryBackendInfo": {
        "properties": {
          "workspace_dir": {
            "type": "string",
            "title": "Workspace Dir",
            "description": "Directory used for cloned or reused repository workspaces."
          },
          "reuse_strategy": {
            "type": "string",
            "title": "Reuse Strategy",
            "description": "How repository workspace paths are selected and reused."
          },
          "update_strategy": {
            "type": "string",
            "title": "Update Strategy",
            "description": "How existing workspaces are refreshed before scanning."
          },
          "parallel_safety": {
            "type": "string",
            "title": "Parallel Safety",
            "description": "Current concurrency guarantees and caveats for workspace reuse."
          }
        },
        "type": "object",
        "required": [
          "workspace_dir",
          "reuse_strategy",
          "update_strategy",
          "parallel_safety"
        ],
        "title": "RepositoryBackendInfo",
        "description": "Repository workspace backend behavior."
      },
      "RepositoryConfigurationSummary": {
        "properties": {
          "workspace_dir": {
            "type": "string",
            "title": "Workspace Dir",
            "description": "Base directory where repository workspaces are cached or reused."
          },
          "component_count": {
            "type": "integer",
            "title": "Component Count",
            "description": "Number of explicitly configured components in repos.yaml."
          },
          "components": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Components",
            "description": "Configured component names. Secrets and raw repository credentials are never included."
          },
          "aliases": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Aliases",
            "description": "Configured alias names when the defaults template is used."
          },
          "default_template_configured": {
            "type": "boolean",
            "title": "Default Template Configured",
            "description": "True when repos.yaml contains a defaults template for dynamic component resolution."
          },
          "hot_reload": {
            "type": "boolean",
            "title": "Hot Reload",
            "description": "True when the service watches repos.yaml mtime and reloads component configuration."
          }
        },
        "type": "object",
        "required": [
          "workspace_dir",
          "component_count",
          "default_template_configured",
          "hot_reload"
        ],
        "title": "RepositoryConfigurationSummary",
        "description": "Sanitized repository configuration summary."
      },
      "ServiceConfiguration": {
        "properties": {
          "service_name": {
            "type": "string",
            "title": "Service Name",
            "description": "Human-readable API service name."
          },
          "service_version": {
            "type": "string",
            "title": "Service Version",
            "description": "API service version."
          },
          "config_dir": {
            "type": "string",
            "title": "Config Dir",
            "description": "Resolved configuration directory."
          },
          "repos_config_path": {
            "type": "string",
            "title": "Repos Config Path",
            "description": "Resolved repos.yaml path."
          },
          "repositories": {
            "$ref": "#/components/schemas/RepositoryConfigurationSummary",
            "description": "Sanitized repository configuration and workspace-cache summary."
          },
          "features": {
            "additionalProperties": {
              "type": "boolean"
            },
            "type": "object",
            "title": "Features",
            "description": "Feature switches and interface capabilities currently exposed by this process."
          }
        },
        "type": "object",
        "required": [
          "service_name",
          "service_version",
          "config_dir",
          "repos_config_path",
          "repositories"
        ],
        "title": "ServiceConfiguration",
        "description": "Sanitized service configuration returned by operational endpoints."
      },
      "StepFindings": {
        "properties": {
          "step": {
            "type": "string",
            "title": "Step",
            "description": "Stable machine-readable step identifier.",
            "examples": [
              "scan_dependencies"
            ]
          },
          "title": {
            "type": "string",
            "title": "Title",
            "description": "Human-readable title for the pipeline step.",
            "examples": [
              "Scan dependency manifests and lock files"
            ]
          },
          "status": {
            "type": "string",
            "title": "Status",
            "description": "Outcome of the step, such as pass, fail, or skip.",
            "examples": [
              "pass"
            ]
          },
          "findings": {
            "additionalProperties": true,
            "type": "object",
            "title": "Findings",
            "description": "Structured findings emitted by the step. Keys vary by step type.",
            "examples": [
              {
                "direct": true,
                "found": true,
                "locked_version": "2.0.0"
              }
            ]
          },
          "evidence": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Evidence",
            "description": "Short evidence statements supporting the step findings.",
            "examples": [
              [
                "Found werkzeug in fixtures/python-direct-werkzeug/uv.lock"
              ]
            ]
          }
        },
        "type": "object",
        "required": [
          "step",
          "title",
          "status",
          "findings",
          "evidence"
        ],
        "title": "StepFindings",
        "description": "Structured findings from a single pipeline step."
      },
      "ValidationError": {
        "properties": {
          "loc": {
            "items": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "integer"
                }
              ]
            },
            "type": "array",
            "title": "Location"
          },
          "msg": {
            "type": "string",
            "title": "Message"
          },
          "type": {
            "type": "string",
            "title": "Error Type"
          },
          "input": {
            "title": "Input"
          },
          "ctx": {
            "type": "object",
            "title": "Context"
          }
        },
        "type": "object",
        "required": [
          "loc",
          "msg",
          "type"
        ],
        "title": "ValidationError"
      },
      "VersionContext": {
        "properties": {
          "detected_version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Detected Version",
            "description": "Version of the affected component that the analyzer actually evaluated.",
            "examples": [
              "2.0.0"
            ]
          },
          "version_source": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Version Source",
            "description": "Where the detected version came from, such as a lock file or worktree manifest.",
            "examples": [
              "lock file"
            ]
          },
          "affected": {
            "anyOf": [
              {
                "type": "boolean"
              },
              {
                "type": "null"
              }
            ],
            "title": "Affected",
            "description": "Whether the detected version falls inside the advisory's affected range."
          },
          "note": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ],
            "title": "Note",
            "description": "Human-readable explanation of the version match decision.",
            "examples": [
              "lock file \u2014 version 2.0.0 is in the explicit affected versions list"
            ]
          },
          "affected_ranges_summary": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Affected Ranges Summary",
            "description": "Normalized summaries of the advisory ranges used for the comparison.",
            "examples": [
              [
                "SEMVER range: introduced=0 fixed=3.0.6 (source=osv_ghsa)"
              ]
            ]
          },
          "comparison_inputs": {
            "additionalProperties": true,
            "type": "object",
            "title": "Comparison Inputs",
            "description": "Exact inputs supplied to the version comparison, including advisory ranges and explicit version lists."
          },
          "comparison_trace": {
            "items": {
              "type": "string"
            },
            "type": "array",
            "title": "Comparison Trace",
            "description": "Full ordered trace of the version comparison logic, including each match or non-match decision."
          }
        },
        "type": "object",
        "title": "VersionContext",
        "description": "Concrete version evidence used during CVSS rescoring."
      }
    }
  },
  "tags": [
    {
      "name": "system",
      "description": "Service health and operational endpoints."
    },
    {
      "name": "assessment",
      "description": "Submit vulnerability assessments and inspect pipeline output."
    },
    {
      "name": "jobs",
      "description": "Track, inspect, and remove asynchronous assessment jobs."
    },
    {
      "name": "benchmark",
      "description": "Compare human and automated assessment artifacts without rerunning repository analysis."
    }
  ]
}