AEGIS — Autonomous Equilateral Governed Intelligence System

A governed Cyber Reasoning System that discovers vulnerabilities across 7 languages, proves exploitability, synthesizes patches (including LLM-assisted), and deploys fixes — all under consequence-tier governance with cryptographic provenance.

Pareidolia LLC (d/b/a Equilateral AI)

What It Does

Every step produces a hash-chained provenance entry. T3+ actions require human approval. The pipeline halts — not fails — when governance intervenes.

Supported Languages

Plus: CWE-798 (hardcoded secrets), CWE-1035 (dependency vulnerabilities)

Quick Start

# Install
npm install

# Initialize config
npx aegis init

# Scan a project (Phase 1: Recon → Furies → Triage)
npx aegis run ./your-project --phase1 --no-db

# Full scan with reports
npx aegis run ./your-project --no-db --sarif --html --scan-deps --scan-secrets

# CI/CD mode (exit 1 on critical findings)
npx aegis run . --phase1 --no-db --fail-on=critical --json

# Watch mode (re-scan on file changes)
npx aegis watch ./your-project

# Start API server with dashboard
npx aegis serve --port=3000

Docker

docker build -t aegis .
docker run -v $(pwd):/target aegis run /target --phase1 --sarif
docker run -p 3000:3000 aegis serve --port=3000

CLI Reference

Commands

Options

Pipeline:
  --phase1               Recon → Furies → Triage only
  --no-db                Run without database (in-memory)
  --no-tree-sitter       Use regex fallback instead of AST

Reports:
  --sarif                SARIF 2.1.0 report
  --html                 HTML vulnerability report
  --json                 Machine-readable JSON to stdout
  --git-patches=DIR      Git-format .patch files
  --fuzz-harnesses=DIR   LibFuzzer harness files

Scanning:
  --scan-deps            npm audit / pip audit
  --scan-secrets         Detect hardcoded secrets

CI/CD:
  --fail-on=SEVERITY     Exit 1 on critical|high|medium|low
  --max-findings=N       Exit 1 if count exceeds N
  --github-pr=NUMBER     Post PR review comments
  --github-check         Create GitHub check run

Baselines:
  --save-baseline=PATH   Save findings as baseline
  --baseline=PATH        Compare against baseline

Filtering:
  --suppress-file=PATH   Load suppression rules
  --since=REF            Incremental scan (git diff)

GitHub Actions

# .github/workflows/aegis.yml
name: AEGIS Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: JamesFord-HappyHippo/AEGIS@main
        with:
          target: '.'
          fail-on: 'critical'
          scan-deps: 'true'
          scan-secrets: 'true'

Configuration

.aegisrc.json

{
  "phase1": true,
  "sarif": true,
  "html": true,
  "failOn": "critical",
  "suppressFile": ".aegis-suppress.json"
}

.aegis-suppress.json

{
  "suppressions": [
    { "crashHash": "abc123", "reason": "False positive" },
    { "cweId": "CWE-78", "filePath": "scripts/", "reason": "Intentional" },
    { "filePath": "test/", "reason": "Test code" }
  ]
}

Architecture

9 Pipeline Agents

Governance

• ConsequenceTierGate — T1 auto-pass, T2 logged, T3-T4 hold for approval
• IntentCapsuleManager — HMAC-signed mandates with drift detection
• EarnedAuthorityEngine — Agents earn autonomy through track record
• ProvenanceStore — SHA-256 hash-chained, append-only, SLSA-compatible

Additional Scanners

• DependencyScanner — npm audit integration, CWE-1035
• SecretDetector — 16 patterns (AWS, GitHub, Slack, JWT, private keys, API keys)

Reports & Integrations

• SARIF 2.1.0 — GitHub code scanning compatible
• HTML — Self-contained dark-theme report with CVSS scores
• JSON — Machine-readable CI/CD summary
• REST API — POST /api/scan, GET /api/findings, dashboard at /
• GitHub — PR comments, check runs, SARIF upload

Testing

# Run all 292 tests
npm test

# Self-scan AEGIS
npm run self-scan

npm Scripts

License

UNLICENSED — Proprietary. Pareidolia LLC (d/b/a Equilateral AI).