FixOps turns raw security artefacts into contextual risk, compliance, and automation outputs in minutes. A lightweight FastAPI service and a parity CLI accept push-style uploads, hydrate an overlay-driven pipeline, and emit guardrail verdicts, context summaries, evidence bundles, pricing signals, and automation manifests that match demo or enterprise guardrails without code changes.

Canonical docs: start with docs/ARCHITECTURE.md for the platform map, then dive into readme_updated.md for feature-by-feature deep dives.

For a fully reproducible setup run the bootstrap helper (installs runtime + dev tooling, pre-commit, and fixtures) or use the Makefile targets:

$ cp .env.example .env  # update secrets before running services
$ ./scripts/bootstrap.sh
$ make fmt lint typecheck test
$ make demo
$ make demo-enterprise

The repository ships with a pair of curated fixtures and overlay profiles so you can experience the full pipeline without wiring external systems or secrets.

1. Install dependencies

   pip install -r requirements.txt
   # Optional: install backend extras when you have access to private repos
   pip install -r apps/api/requirements-optional.txt

2. Run the bundled demo experience

   python -m core.cli demo --mode demo --output out/demo.json --pretty

   The command seeds deterministic tokens, loads the curated design/SBOM/SARIF/CVE fixtures, and executes the same pipeline that powers the API. The JSON result is saved to out/demo.json and the console summary highlights severity, guardrail status, compliance frameworks, executed modules, and the active pricing tier.

3. Switch to the enterprise overlay

   python -m core.cli demo --mode enterprise --output out/enterprise.json --pretty

   Enterprise mode applies the hardened profile from config/fixops.overlay.yml, demonstrating how additional guardrails, automation destinations, and evidence retention settings change the output without touching code. Evidence bundles, cache directories, and automation payloads are created under the allow-listed paths declared in the overlay.

4. Iterate locally

   You can point the CLI at your own artefacts with python -m core.cli run or import core.demo_runner.run_demo_pipeline in a notebook for scripted exploration. Use python -m core.cli show-overlay --pretty to inspect the merged overlay for each profile. When running the enterprise stack with Docker Compose, copy enterprise/.env.example to .env, rotate the secrets, and ensure FIXOPS_AUTH_DISABLED remains false.

5. Validate with automated tests

   The repository ships with a pytest suite that exercises the CLI stage runner, ingest API, compliance rollups, and SSDLC orchestrator logic. Re-run it after local changes to confirm the canonical IO contract still holds.

   export PYTHONPATH=.
   pytest

The unified stage runner gives you the same normalisation logic that powers the API while keeping artefacts local. Each invocation calls core.stage_runner.StageRunner.run_stage, which coordinates identity minting via src.services.id_allocator.ensure_ids, run persistence through src.services.run_registry.RunRegistry.ensure_run, and optional manifest signing with src.services.signing.

Run the sequence above to materialise canonical JSON under artefacts/<app_id>/<run_id>/outputs/. Each run also records signed manifests (when FIXOPS_SIGNING_KEY/FIXOPS_SIGNING_KID are configured) and emits a transparency log via outputs/transparency.index. After the CLI walkthrough, execute pytest to confirm the ingest API and compliance regressions continue to pass end-to-end.

• Overlay-governed operating modes – A single configuration file switches between 30-minute demo onboarding and hardened enterprise guardrails, provisioning directories, tokens, compliance packs, automation connectors, and module toggles on startup (config/fixops.overlay.yml).
• Push ingestion + parity CLI – Upload design CSV, SBOM, SARIF, and CVE/KEV data through FastAPI endpoints or run the same flow locally via python -m core.cli, with API-key enforcement, MIME validation, byte limits, and evidence export controls (apps/api/app.py, core/cli.py).
• Context-aware decisioning – The orchestrator correlates design intent with bill-of-materials, findings, and advisories, then layers the context engine, guardrails, SSDLC scoring, IaC posture, exploit intelligence, AI agent detections, and knowledge graph analytics in a single pass (apps/api/pipeline.py, new_apps/api/processing/knowledge_graph.py).
• Probabilistic escalation intelligence – The core.probabilistic.ProbabilisticForecastEngine applies Dirichlet-smoothed calibration, spectral diagnostics, Markov chains, and Bayesian posterior updates to forecast severity drift, quantify stationary risk, and surface explainable escalation pressure for decision makers.
• Multi-LLM consensus & transparency – The enhanced decision engine layers deterministic heuristics with optional OpenAI/Anthropic/Gemini calls (when API keys are present), reconciles verdicts, enriches MITRE ATT&CK, compliance, and marketplace intelligence, and emits explainable consensus telemetry for demos or production pipelines (fixops-enterprise/src/services/enhanced_decision_engine.py, fixops-enterprise/src/api/v1/enhanced.py).
• Security-as-code provenance & trust – SLSA v1 attestations, provenance graph relationships, reproducible build attestations, and cosign signing keep releases anchored to verifiable supply-chain evidence (services/provenance, services/graph, services/repro, scripts/signing, services/evidence/packager.py).
• Risk-first posture – Normalised SBOMs, EPSS/KEV feed joins, FixOpsRisk scoring, and anomaly detection correlate exploit probability, exposure, and downgrade drift before pull requests merge (lib4sbom/normalizer.py, risk/scoring.py, risk/feeds, services/graph/graph.py).
• Evidence & automation built-in – Compliance packs, policy automation (Jira/Confluence/Slack), onboarding guidance, feedback capture, and evidence bundling persist auditable manifests inside overlay-allowlisted directories (core/compliance.py, core/policy.py, core/evidence.py, core/feedback.py, services/evidence/packager.py).
• Observability & demo-ready experiences – Telemetry hooks, dashboards, and docker-compose demos provide investor-ready tours while keeping operators in control of data flow (telemetry, docker-compose.demo.yml, ui/dashboard).

┌────────────┐   uploads    ┌───────────────┐   overlay + artefacts   ┌────────────────────────────┐   probabilistic + LLM intelligence   ┌────────────────────┐   evidence + automations   ┌──────────────┐
│  Clients    │ ───────────▶│ FastAPI (ing) │────────────────────────▶│ Pipeline orchestrator     │──────────────────────────────────────▶│ Enhanced decisioning │──────────────────────────▶│ Destinations    │
│ (CLI/API)   │             │  /inputs/*    │                         │ (context, guardrails,     │                                           │ (consensus, MITRE,   │                          │ (Jira, bundle,  │
│             │◀────────────│ /pipeline/run │◀────────────────────────│ SSDLC, IaC, probabilistic)│◀──────────────────────────────────────│ compliance, KG, LLM) │◀──────────────────────────│ Slack, storage) │
└────────────┘  JSON status └───────────────┘  overlay metadata       │ overlay module matrix     │                                           └───────────────────────┘                            └──────────────┘
                                                   │                   └────────────────────────────┘
                                                   ▼
                                   Graph + risk engine, evidence hub, pricing, knowledge graph, feedback, docs

             ┌────────────────────┐
             │ Overlay registry   │
             │ config/*.yml       │
             └────────┬───────────┘
                      │
                      ▼ load_overlay()
┌────────────┐   auth/token   ┌───────────────────┐    artefact cache     ┌───────────────────────┐
│ CLI runner │──────────────▶│ FastAPI ingestion │──────────────────────▶│ Storage + evidence    │
│ core.cli │               │  apps/api/app.py   │◀──────────────────────│ data/uploads/*        │
└────────────┘               └────────┬──────────┘     archive bundles    └──────────┬────────────┘
         ▲                             │                                    decrypt/compress │
         │ module toggles              │ orchestrate()                       ▼                │
         │                             ▼                             ┌─────────────┐        │
         │                     ┌───────────────────┐                 │ Destinations│◀───────┘
         ├────────────────────▶│ Pipeline modules  │───────────────▶ │ Jira/Slack │   automation manifests
         │                     │ context/guardrail │  ROI & telemetry │ GRC repos │
         │                     └────────┬──────────┘                 └─────────────┘
         │                              │ enhanced_run()
         │                              ▼
         │                     ┌───────────────────┐
         └────────────────────▶│ Enhanced decision │
                               │ multi-LLM + KG    │
                               │ explanations      │
                               └───────────────────┘

The overlay registry feeds both the CLI and FastAPI surfaces with runtime configuration. Artefacts ingested through the API are cached under data/uploads, normalised, and handed to modular pipeline stages that emit automation payloads, evidence bundles, and ROI telemetry to downstream destinations.

The enhanced decisioning layer augments the classic pipeline by invoking the multi-LLM ensemble, SentinelGPT explanations, and CTINexus-style knowledge graph analytics before returning consensus decisions and reasoning metadata for executive dashboards.

Client/CLI -> FastAPI ingestion: POST /inputs/* (design, sbom, cve, sarif)
FastAPI ingestion -> Artefact cache: store + normalise artefacts
FastAPI ingestion -> Pipeline orchestrator: invoke /pipeline/run
Pipeline orchestrator -> Module registry: resolve enabled modules
Module registry -> Context engine: enrich with business signals
Module registry -> Guardrails: evaluate maturity thresholds
Module registry -> Automation pack: dispatch Jira/Slack/Confluence
Module registry -> Evidence hub: build encrypted bundle
Module registry -> Analytics: compute ROI + performance profile
Pipeline orchestrator -> Enhanced decisioning: invoke multi-LLM consensus + explanations
Enhanced decisioning -> Knowledge graph processor: map attack paths and entities
Enhanced decisioning -> Explanation engine: craft SentinelGPT executive summary
Enhanced decisioning -> Pipeline orchestrator: return consensus, MITRE, compliance, KG
Pipeline orchestrator -> FastAPI ingestion: return aggregated response
FastAPI ingestion -> Client/CLI: JSON with summaries + bundle paths

@startuml
class OverlayLoader {
  +load_overlay(path)
  +resolve_tokens()
}

class IngestionService {
  +accept_design()
  +accept_sbom()
  +accept_cve()
  +accept_sarif()
  +run_pipeline()
}

class PipelineOrchestrator {
  +correlate_artefacts()
  +execute_modules()
  +emit_outputs()
}

class ModuleRegistry {
  +enable(name)
  +disable(name)
  +register(hook)
}

class EvidenceHub {
  +archive()
  +encrypt()
  +handoff()
}

OverlayLoader --> IngestionService
IngestionService --> PipelineOrchestrator
PipelineOrchestrator --> ModuleRegistry
ModuleRegistry --> EvidenceHub
PipelineOrchestrator --> Destinations
@enduml

The UML block highlights the primary classes composing FixOps: configuration loaders, the ingestion facade, the orchestrator, the modular execution surface, and evidence management.

FixOps Platform
├── Ingestion
│   ├── FastAPI endpoints (`backend/api/*`)
│   └── CLI parity (`cli/fixops-*`)
├── Normalisation & analytics
│   ├── SBOM normaliser (`lib4sbom/normalizer.py`)
│   ├── Risk scoring + feeds (`risk/scoring.py`, `risk/feeds/*`)
│   └── Provenance graph (`services/graph/graph.py`)
├── Contextual intelligence
│   ├── Context engine & guardrails (`apps/api/pipeline.py`)
│   ├── Probabilistic (Markov/Bayesian) forecasts (`core/probabilistic/*`)
│   └── Multi-LLM consensus (`fixops-enterprise/src/services/enhanced_decision_engine.py`)
├── Evidence & automation
│   ├── Evidence bundling (`services/evidence/packager.py`)
│   ├── Cosign signing & provenance (`scripts/signing/*`, `services/provenance`)
│   └── Reproducible build attestations (`services/repro`)
├── Observability & demo
│   ├── Telemetry (`telemetry/*`)
│   ├── Demo stack (`docker-compose.demo.yml`, `config/otel-collector-demo.yaml`)
│   └── UI dashboards (`ui/dashboard`, `ui/graph-view`)
└── Developer experience
    ├── Playbooks & docs (`docs/*.md`)
    ├── QA automation (`.github/workflows/qa.yml`)
    └── Coverage + reports (`reports/coverage/*`)

Each row outlines the stage of the customer journey, the surface to invoke, the exact commands or endpoints, the minimal inputs required, and the resulting business value to emphasise during demos or enterprise rollouts.

• Ingestion service (apps/api/app.py) – Loads the overlay at startup, prepares allowlisted directories, enforces API tokens, validates MIME types, caps uploads, and accepts artefacts at /inputs/design, /inputs/sbom, /inputs/cve, and /inputs/sarif before orchestrating /pipeline/run.
• Pipeline orchestrator (apps/api/pipeline.py) – Normalises severities, builds the design ↔ SBOM ↔ findings ↔ CVE crosswalk, evaluates guardrails and contextual modules, executes automation connectors, and emits the module matrix alongside summaries, evidence bundles, pricing, and sanitized overlay metadata.
• Extension surface (core/modules.py) – Overlay-declared modules and custom hooks allow integrators to disable, enable, or extend behaviour (e.g., IaC posture checks, exploit refresh, probabilistic forecasts) without code changes.

1. Load configuration – load_overlay() merges defaults with demo or enterprise overrides, validates directories, registers tokens, and prepares module toggles (core/configuration.py).
2. Upload artefacts – Push CSV/SBOM/SARIF/CVE data (plain JSON or gzip/zip archives) through FastAPI or point the CLI at local files; the normaliser caches parsers to reuse tokens and reduce I/O (apps/api/normalizers.py).
3. Run the pipeline – The orchestrator correlates artefacts, executes enabled modules (context engine, compliance packs, policy automation, SSDLC, IaC, AI agents, exploitability, probabilistic forecasts, ROI analytics, tenant lifecycle, performance simulation), invokes the enhanced decision engine for multi-LLM consensus, knowledge graph analytics, and SentinelGPT explanations, and tracks custom module outcomes.
4. Persist outputs – Artefact archives capture raw and normalised inputs, evidence hub writes compressed/encrypted bundles, automation connectors dispatch tickets/messages with manifests, exploit feeds refresh against allowlisted directories, and pricing summaries expose plan/limit data. Enhanced responses also persist consensus telemetry, MITRE mapping, and knowledge graph payloads for replay.

1. Stage canonicalisation – Execute the stage workflow table above (or run PYTHONPATH=. pytest tests/test_cli_stage_run.py) to ensure each command writes the canonical artefact into artefacts/<app_id>/<run_id>/outputs/ and, when signing variables are present, emits manifests plus outputs/transparency.index.
2. API ingest parity – Launch the FastAPI app (uvicorn apps.api.app:app --reload) and post artefacts to /api/v1/artefacts; confirm the JSON summary echoes the stage, run ID, canonical output path, and signature state.
3. Overlay pipeline regression – python -m core.cli run --overlay config/fixops.overlay.yml --design simulations/demo_pack/design-input.json --sbom simulations/demo_pack/sbom.json --sarif simulations/demo_pack/scanner.sarif --cve demo/fixtures/sample.cve.json --pretty --output out/pipeline-enterprise.json should emit the full module matrix, evidence bundle path, and pricing posture for enterprise demos.
4. Probabilistic calibration – python -m core.cli train-forecast --incidents data/examples/incidents.json --pretty --output out/forecast.json validates spectral gap, stationary distribution, and multi-step projections, guaranteeing the enhanced analytics remain reproducible.
5. Continuous regression – pytest executes the CLI/API regression suites, stage-run coverage, probabilistic diagnostics, and the import guard that prevents active code from depending on archived WIP/ modules.
6. Inspect results – API/CLI responses include severity overviews, guardrail status, context summaries, compliance coverage, policy execution, SSDLC assessments, IaC posture, AI agent findings, exploitability insights, probabilistic forecasts, ROI dashboards, tenant lifecycle summaries, performance profiles, knowledge graph analytics, SentinelGPT narratives, multi-LLM disagreement matrices, module matrices, feedback endpoints, and sanitized overlay metadata.

This repository ships the CLI workflow, the FastAPI ingestion service, and the overlay profiles used to demonstrate demo vs. enterprise behaviour. Container bundles, React front-ends, and Terraform stacks referenced in earlier drafts are not included.

1. Create a virtual environment and install dependencies (see below).
2. Copy .env.example to .env when running the service locally; for enterprise demos use enterprise/.env.example as a reference for additional secrets.
3. Launch the API with uvicorn apps.api.app:app --reload and exercise the /inputs/* plus /pipeline/run endpoints using the bundled fixtures under simulations/demo_pack/.
4. Use python -m core.cli demo --mode demo|enterprise or make demo / make demo-enterprise to produce canonical pipeline JSON and evidence bundles without wiring external systems.

• The historical Docker Compose stack has been removed; rely on the CLI or FastAPI app for walkthroughs.
• There is no checked-in Terraform state. If you need infrastructure automation, treat it as a greenfield addition and document it alongside new modules.
• The frontend/ symlink in this snapshot points to an external package and is left for compatibility; there is no bundled UI.

• Python 3.10+ (tested with CPython 3.11)
• pip and virtualenv
• Optional: uvicorn for serving the FastAPI application, jq for response inspection
• Optional: cryptography if enabling evidence bundle encryption (limits.evidence.encrypt: true)

python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

• Copy config/fixops.overlay.yml and adjust tokens, directories, module toggles, and pricing tiers as needed.
• Export FIXOPS_API_TOKEN (used by API and CLI) and any connector secrets declared in the overlay (e.g., FIXOPS_JIRA_TOKEN).

export FIXOPS_API_TOKEN="demo-token"
uvicorn backend.app:create_app --factory --reload

Upload artefacts and execute the pipeline:

curl -H "X-API-Key: $FIXOPS_API_TOKEN" -F "file=@samples/design.csv;type=text/csv" http://127.0.0.1:8000/inputs/design
curl -H "X-API-Key: $FIXOPS_API_TOKEN" -F "file=@samples/sbom.json;type=application/json" http://127.0.0.1:8000/inputs/sbom
curl -H "X-API-Key: $FIXOPS_API_TOKEN" -F "file=@samples/cve.json;type=application/json" http://127.0.0.1:8000/inputs/cve
curl -H "X-API-Key: $FIXOPS_API_TOKEN" -F "file=@samples/scan.sarif;type=application/json" http://127.0.0.1:8000/inputs/sarif
curl -H "X-API-Key: $FIXOPS_API_TOKEN" http://127.0.0.1:8000/pipeline/run | jq
curl -H "X-API-Key: $FIXOPS_API_TOKEN" http://127.0.0.1:8000/api/v1/enhanced/capabilities | jq
curl -H "X-API-Key: $FIXOPS_API_TOKEN" -X POST \
  -H 'Content-Type: application/json' \
  -d '{\"service_name\":\"demo-app\",\"security_findings\":[{\"rule_id\":\"SAST001\",\"severity\":\"high\",\"description\":\"SQL injection\"}],\"business_context\":{\"environment\":\"demo\",\"criticality\":\"high\"}}' \
  http://127.0.0.1:8000/api/v1/enhanced/compare-llms | jq

Skip manual artefact preparation and run the overlay-driven demo or enterprise walkthrough in a single command. The CLI seeds required environment variables (API token, Jira/Confluence tokens, and an encryption key) with safe defaults.

# Demo profile (non-encrypted evidence bundle)
python -m core.cli demo --mode demo --output out/pipeline-demo.json --pretty

# Enterprise profile (encryption enabled when `cryptography` is installed)
python -m core.cli demo --mode enterprise --output out/pipeline-enterprise.json --pretty

Both commands emit a short textual summary, persist the full pipeline response (if --output is supplied), and drop evidence bundles inside the overlay-approved directories under data/.

python -m core.cli run \
  --overlay config/fixops.overlay.yml \
  --enable policy_automation --enable compliance --enable ssdlc --enable probabilistic \
  --design artefacts/design.csv --sbom artefacts/sbom.json \
  --sarif artefacts/scan.sarif --cve artefacts/cve.json \
  --evidence-dir out/evidence --output out/pipeline-enterprise.json

Use python -m core.cli show-overlay --overlay config/fixops.overlay.yml to inspect sanitized overlay metadata or python -m core.cli run --offline to disable automatic exploit feed refresh during air-gapped runs. python -m core.cli copy-evidence --run out/pipeline-enterprise.json --target ./hand-off copies bundle archives into hand-off directories for audits.

• pytest – exercises ingestion, overlay validation, module toggles, connectors, exploit refresh, probabilistic forecasts, CLI parity, simulations, and SSDLC outputs.
• python -m compileall backend fixops simulations tests – guards against syntax regressions prior to deployment.

All endpoints require the X-API-Key header. See docs/PLATFORM_RUNBOOK.md for persona-specific examples and docs/INTEGRATIONS.md for connector payload details.

• CISO & Executive Reporting – python -m core.cli run --overlay config/fixops.overlay.yml --enable probabilistic --enable compliance --enable analytics --output out/ciso.json surfaces guardrail status, compliance posture, tenant coverage, ROI telemetry, and performance posture for board reporting.
• CTEM & Vulnerability Ops – python -m core.cli run --enable exploit_signals --enable policy_automation --design ... --sbom ... --sarif ... --cve ... contextualises findings, executes policy automations, and refreshes exploit intelligence.
• DevSecOps / Platform – python -m core.cli run --enable ssdlc --enable iac --custom-module modules/custom.py:main enforces pipeline gates across IaC scans and SSDLC targets.
• SIEM & Incident Responders – python -m core.cli run --enable ai_agents --enable probabilistic --output out/siem.json generates AI-agent detections and probabilistic breach forecasts for downstream correlation.
• Security Testers – Combine --offline with curated artefacts to validate guardrail outcomes pre-deployment.
• Enterprise Architects & Tenant Ops – python -m core.cli run --enable tenancy --enable performance --output out/tenant-summary.json produces tenant lifecycle health, module coverage gaps, and near real-time performance status for shared platforms.

Use python -m core.cli help for the full command reference and flags.

• Pipeline responses include dedicated analytics, pricing_summary, performance_profile, and tenant_lifecycle blocks that feed executive dashboards outlined in market/DEMO_STORY.md and market/ENTERPRISE_READINESS.md.
• Evidence bundles automatically embed ROI, tenant, and performance sections when the corresponding modules are enabled, giving CISOs auditable proof of value per run.
• Roadmap: extend analytics with historical warehousing, interactive ROI dashboards, and connector-level cost attribution (tracked in audit/GAPS.md).

• Overlay-driven tenancy settings now define tenant inventories, lifecycle stages, stage defaults, and module expectations (tenancy section in config/fixops.overlay.yml).
• Pipeline runs emit tenant_lifecycle summaries highlighting stage distribution, module gaps, and support/billing metadata for each tenant.
• Roadmap: add overlay versioning, tenant-specific RBAC, and approval workflows for managed multi-tenant environments (tracked in audit/GAPS.md and docs/PR_SUMMARY.md).

• Pipeline performance module – The performance_profile block computes cumulative latency, throughput, and backlog recommendations based on overlay targets for demo and enterprise runs.
• Scenario replay – python -m simulations.cve_scenario.runner --mode {demo,enterprise} still mirrors production flows (context, automation, evidence) against CVE-2021-44228, now capturing ROI and performance outputs alongside severity shifts.
• Benchmarks & profiling – perf/BENCHMARKS.csv captures timing; extend via python scripts/generate_index.py --bench to aggregate additional profiles while aligning with overlay thresholds.

• Verify artefact cache health with python -m core.cli show-overlay and inspect data/uploads/ for sanitized filenames.
• Review docs/PLATFORM_RUNBOOK.md for stage-by-stage troubleshooting, persona runbooks, and escalation paths.
• Consult audit/SECURITY.md and docs/SDLC_SSDLC.md when integrating FixOps into enterprise governance.

• Schema – Authentication, data directories, upload limits, guardrail thresholds, onboarding checklists, compliance packs, policy automation targets, SSDLC objectives, IaC checks, AI agent watchlists, exploit feeds, probabilistic priors, pricing tiers, and module toggles live in config/fixops.overlay.yml.
• Modes – Profiles labelled demo and enterprise adjust required artefacts, Jira/Confluence/Slack enforcement, evidence maturity, automation aggressiveness, pricing plans, and module enablement.
• Customization – Supply environment overrides (--env KEY=VALUE via CLI) or add custom modules under modules.custom to execute organisation-specific logic alongside first-party modules.

Refer to docs/CONFIG_GUIDE.md for field-level descriptions and overlay extension patterns, and docs/USAGE_GUIDE.html for a persona-focused walkthrough.

• CVE contextual re-scoring – python -m simulations.cve_scenario.runner --mode demo (or enterprise) replays CVE-2021-44228 (Log4Shell) with overlay-governed context, producing severity shifts, evidence bundles, guardrail outcomes, and pricing summaries (simulations/cve_scenario/runner.py).
• Performance telemetry – perf/BENCHMARKS.csv captures representative timings for pipeline crosswalks and probabilistic forecasts; perf/CHANGES.md and perf/BASELINE.md document optimisation rationale.
• Automated tests – pytest exercises ingestion endpoints, overlay validation, module toggles, connectors, exploit refresh, probabilistic forecasts, CLI parity, and simulations; python -m compileall backend fixops simulations tests guards against syntax regressions.

• Market & positioning – market/ contains competitive analysis, pricing strategy, GTM plans, and demo storyboards.
• Architecture & SDLC – docs/ARCHITECTURE.md, docs/DATA_MODEL.md, docs/SDLC_SSDLC.md, and docs/INTEGRATIONS.md outline components, data flows, lifecycle coverage, and integration contracts.
• Architecture inventory & roadmap – docs/ARCH-INVENTORY.md summarises modules/services/data models while docs/TASK-PLAN.md maps Phases 2–10 with concrete code touchpoints.
• Security & audits – audit/SECURITY.md, audit/GAPS.md, and audit/CTEM_ASSESSMENT.md track mitigations, residual risk, and CTEM readiness.
• SBOM normalisation & quality – docs/SBOM-QUALITY.md explains deduplication logic, quality scoring metrics, CLI usage, and HTML reporting expectations.
• Risk scoring & exposure – docs/RISK-SCORING.md documents EPSS/KEV ingestion, FixOpsRisk weighting, CLI usage, and API endpoints for the risk pipeline.
• Provenance & signing – docs/PROVENANCE.md, docs/SIGNING.md, and docs/CI-SECRETS.md cover SLSA attestations, cosign signing flows, required secrets, and verification guidance.
• Provenance graph intelligence – docs/PROVENANCE-GRAPH.md details graph ingestion sources, query surface, anomaly detection, and API integration.
• Reproducible builds – docs/REPRO-BUILDS.md explains the hermetic verifier, plan structure, CLI usage, and CI workflow outputs.
• Evidence bundles & policy – docs/EVIDENCE-BUNDLES.md covers policy-driven packaging, manifest signing, API endpoints, and CLI automation.
• Demo stack & telemetry – docs/DEMO.md walks through the OpenTelemetry-enabled docker-compose demo and dashboard.
• Runbooks & usage – docs/PLATFORM_RUNBOOK.md, docs/USAGE_GUIDE.html, and docs/PR_SUMMARY.md provide persona guides, troubleshooting steps, and an executive summary for reviewers.
• Operational playbooks – docs/PLAYBOOK-DEV.md, docs/PLAYBOOK-SEC.md, and docs/PLAYBOOK-AUDIT.md equip engineering, security, and audit stakeholders with repeatable workflows.
• Security posture & audits – docs/SECURITY-POSTURE.md, audit/SECURITY.md, audit/GAPS.md, and audit/CTEM_ASSESSMENT.md capture branch protections, mitigations, residual risk, and CTEM readiness.

Whether you launch the API or the CLI, FixOps now delivers overlay-governed context, compliance, automation, and probabilistic insight with auditable artefacts that keep demo and enterprise buyers on the same code path.

Run the bundled stage fixtures end-to-end with a single target:

make stage-workflow

The target seeds deterministic identifiers (FIXOPS_RUN_ID_SEED=stage-demo, FIXOPS_FAKE_NOW=2024-01-01T00:00:00Z) and calls scripts/run_stage_workflow.py to materialise canonical outputs under artefacts/stage-demo/. To execute individual stages or capture a JSON summary without Make, invoke the script directly:

python scripts/run_stage_workflow.py \
  --fixtures fixtures/sample_inputs \
  --artefacts artefacts/stage-demo \
  --summary artefacts/stage-demo/summary.json

Refer to fixtures/stage_runbook.md for the complete Input → Command → Output matrix.