# mattandrea02/agentic-dsec architecture

> Architecture diagram of the GitHub repository mattandrea02/agentic-dsec, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mattandrea02/agentic-dsec
- Repository: https://github.com/mattandrea02/agentic-dsec

## Overview

Agentic DSEC is a post-SAST remediation service: a CI client submits immutable run coordinates for a completed SonarQube analysis, then a queued worker produces reviewable remediation artifacts and can optionally publish an issue or pull request. The graph follows the documented service roles and the sampled pipeline/node calls. Service internals beyond the excerpts are represented only where their role is documented; uncertain wiring is omitted.

Main entry points: [`src/graph/graph_builder.py`](https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/graph_builder.py) (LangGraph workflow), [`src/service/runner.py`](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/runner.py) (Run executor), [`src/service/api.py`](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/api.py) (Trigger API), [`src/graph/nodes.py`](https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/nodes.py) (Fetch findings)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_service["Run service"]
  node_api["Trigger API<br/>[api.py]"]
  node_policy["Run policy<br/>[policy.py]"]
  node_run_store[("Durable queue<br/>[store.py]")]
  node_worker["Single worker<br/>[worker.py]"]
  node_runner["Run executor<br/>[runner.py]"]
end

subgraph group_analysis["Analysis pipeline"]
  node_repo_prep["Pinned checkout<br/>[repository.py]"]
  node_sonar_adapter["Sonar adapter<br/>[sonar.py]"]
  node_pipeline["Pipeline entry<br/>[pipeline.py]"]
  node_graph["LangGraph workflow<br/>[graph_builder.py]"]
  node_sonar_stage["Fetch findings<br/>[nodes.py]"]
  node_prioritize["Prioritize findings"]
  node_report["Build report<br/>[report_builder.py]"]
end

subgraph group_remediation["Remediation generation"]
  node_llm_client["LLM client<br/>[llm_client.py]"]
  node_analysis_chains["Explain and recommend<br/>[chain_builder.py]"]
  node_code_agent["Code-fix agent<br/>[agent.py]"]
  node_remediation_node["Generate code fixes<br/>[nodes.py]"]
end

subgraph group_publication["Artifacts and publishing"]
  node_git_workflow["GitHub publishing<br/>[git_workflow.py]"]
  node_git_tools["Git and GitHub tools<br/>[git_tools.py]"]
  node_artifacts["Run artifacts"]
end

node_ci(("Repository CI"))
node_sonar{{"SonarQube"}}
node_llm{{"Configured LLM"}}
node_github{{"GitHub"}}

node_ci -->|"submits run"| node_api
node_api -->|"validates run"| node_policy
node_api -->|"enqueues run"| node_run_store
node_worker -->|"claims run"| node_run_store
node_worker -->|"executes run"| node_runner
node_runner -->|"pins source"| node_repo_prep
node_repo_prep -->|"clones commit"| node_github
node_runner -->|"loads analysis"| node_sonar_adapter
node_sonar_adapter -->|"reads results"| node_sonar
node_runner -->|"starts pipeline"| node_pipeline
node_pipeline -->|"invokes graph"| node_graph
node_graph -->|"dispatches stage"| node_sonar_stage
node_sonar_stage -->|"prioritizes findings"| node_prioritize
node_sonar_stage -->|"builds report"| node_report
node_graph -->|"runs analysis chains"| node_analysis_chains
node_analysis_chains -->|"creates model"| node_llm_client
node_llm_client -->|"calls model"| node_llm
node_graph -->|"dispatches fixes"| node_remediation_node
node_remediation_node -->|"requests code changes"| node_code_agent
node_code_agent -->|"creates agent model"| node_llm_client
node_graph -->|"writes report and patch"| node_artifacts
node_graph -.->|"publishes when enabled"| node_git_workflow
node_git_workflow -->|"uses Git operations"| node_git_tools
node_git_tools -.->|"creates issue or PR"| node_github
node_github -.->|"awaits human review"| node_ci

click node_api "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/api.py"
click node_policy "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/policy.py"
click node_run_store "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/store.py"
click node_worker "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/worker.py"
click node_runner "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/runner.py"
click node_repo_prep "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/repository.py"
click node_sonar_adapter "https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/sonar.py"
click node_pipeline "https://github.com/mattandrea02/agentic-dsec/blob/main/src/application/pipeline.py"
click node_graph "https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/graph_builder.py"
click node_sonar_stage "https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/nodes.py"
click node_prioritize "https://github.com/mattandrea02/agentic-dsec/blob/main/src/nodes/prioritazion_agent.py"
click node_report "https://github.com/mattandrea02/agentic-dsec/blob/main/src/nodes/report_builder.py"
click node_llm_client "https://github.com/mattandrea02/agentic-dsec/blob/main/src/core/llm_client.py"
click node_analysis_chains "https://github.com/mattandrea02/agentic-dsec/blob/main/src/core/chain_builder.py"
click node_code_agent "https://github.com/mattandrea02/agentic-dsec/blob/main/src/agents/agent.py"
click node_remediation_node "https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/nodes.py"
click node_git_workflow "https://github.com/mattandrea02/agentic-dsec/blob/main/src/core/git_workflow.py"
click node_git_tools "https://github.com/mattandrea02/agentic-dsec/blob/main/src/tools/git_tools.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_api,node_policy,node_run_store,node_worker,node_runner toneBlue
class node_repo_prep,node_sonar_adapter,node_pipeline,node_graph,node_sonar_stage,node_prioritize,node_report toneAmber
class node_llm_client,node_analysis_chains,node_code_agent,node_remediation_node toneMint
class node_git_workflow,node_git_tools,node_artifacts toneRose
class node_ci,node_sonar,node_llm,node_github toneIndigo
```

## Components

### Run service

- [Trigger API](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/api.py): `src/service/api.py`
- [Run policy](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/policy.py): `src/service/policy.py`
- [Durable queue](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/store.py): `src/service/store.py`
- [Single worker](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/worker.py): `src/service/worker.py`
- [Run executor](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/runner.py): `src/service/runner.py`

### Analysis pipeline

- [Pinned checkout](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/repository.py): `src/service/repository.py`
- [Sonar adapter](https://github.com/mattandrea02/agentic-dsec/blob/main/src/service/sonar.py): `src/service/sonar.py`
- [Pipeline entry](https://github.com/mattandrea02/agentic-dsec/blob/main/src/application/pipeline.py): `src/application/pipeline.py`
- [LangGraph workflow](https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/graph_builder.py): `src/graph/graph_builder.py`
- [Fetch findings](https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/nodes.py): `src/graph/nodes.py`
- [Prioritize findings](https://github.com/mattandrea02/agentic-dsec/blob/main/src/nodes/prioritazion_agent.py): `src/nodes/prioritazion_agent.py`
- [Build report](https://github.com/mattandrea02/agentic-dsec/blob/main/src/nodes/report_builder.py): `src/nodes/report_builder.py`

### Remediation generation

- [LLM client](https://github.com/mattandrea02/agentic-dsec/blob/main/src/core/llm_client.py): `src/core/llm_client.py`
- [Explain and recommend](https://github.com/mattandrea02/agentic-dsec/blob/main/src/core/chain_builder.py): `src/core/chain_builder.py`
- [Code-fix agent](https://github.com/mattandrea02/agentic-dsec/blob/main/src/agents/agent.py): `src/agents/agent.py`
- [Generate code fixes](https://github.com/mattandrea02/agentic-dsec/blob/main/src/graph/nodes.py): `src/graph/nodes.py`

### Artifacts and publishing

- [GitHub publishing](https://github.com/mattandrea02/agentic-dsec/blob/main/src/core/git_workflow.py): `src/core/git_workflow.py`
- [Git and GitHub tools](https://github.com/mattandrea02/agentic-dsec/blob/main/src/tools/git_tools.py): `src/tools/git_tools.py`
- **Run artifacts**

### Other components

- **Repository CI**
- **SonarQube**
- **Configured LLM**
- **GitHub**

## Connections

- Repository CI → Trigger API: submits run
- Trigger API → Run policy: validates run
- Trigger API → Durable queue: enqueues run
- Single worker → Durable queue: claims run
- Single worker → Run executor: executes run
- Run executor → Pinned checkout: pins source
- Pinned checkout → GitHub: clones commit
- Run executor → Sonar adapter: loads analysis
- Sonar adapter → SonarQube: reads results
- Run executor → Pipeline entry: starts pipeline
- Pipeline entry → LangGraph workflow: invokes graph
- LangGraph workflow → Fetch findings: dispatches stage
- Fetch findings → Prioritize findings: prioritizes findings
- Fetch findings → Build report: builds report
- LangGraph workflow → Explain and recommend: runs analysis chains
- Explain and recommend → LLM client: creates model
- LLM client → Configured LLM: calls model
- LangGraph workflow → Generate code fixes: dispatches fixes
- Generate code fixes → Code-fix agent: requests code changes
- Code-fix agent → LLM client: creates agent model
- LangGraph workflow → Run artifacts: writes report and patch
- LangGraph workflow → GitHub publishing: publishes when enabled
- GitHub publishing → Git and GitHub tools: uses Git operations
- Git and GitHub tools → GitHub: creates issue or PR
- GitHub → Repository CI: awaits human review