aertunmanual

Findings and the AI analyst

One queue, ranked by risk, and every decision kept.

In the consoleFindingsRisk

  1. Read the queue

    aertun finding list --state open
aertun finding risk
aertun finding story ID

  2. Let the analyst take the first pass

    aertun analyst plan
aertun analyst triage --limit 20 --dry-run

    The model is any OpenAI-compatible endpoint, set with AERTUN_MODEL_URL, AERTUN_MODEL_KEY and AERTUN_MODEL. Without one, findings are triaged by people alone.

  3. Decide

    aertun finding decide ID false-positive

    The states are open, triaged, accepted, fixed, stale, false-positive and benign.

What a log line cannot do to the analyst

A finding's evidence is log text, written by whoever reached the log. So nothing depends on the model declining an instruction, and the worst a planted line can do is make a suggestion wrong:

  • What it reads, and in what order, is a plan fixed in code. Nothing a log says can add a step.
  • It is given counts and closed words the program worked out, and, separately and marked, the text somebody else wrote.
  • Its answer is one word from a closed set with a confidence, shown only above a threshold. The reason a person reads is assembled from the counts, never from what the model wrote.
  • Personal data and credentials are masked before the prompt leaves and restored in the answer.

A person records the verdict; the analyst has no way to. aertun analyst eval --k 3 measures it against what people decided.

Replay

aertun detect replay runs today's rules over the events again and says which decisions would now be different, and aertun detect learn FINDING turns a decision into a fixture.