How omercn1/orod-security-lab works
OROD is a local-first security review and refactoring application. A user starts a scan in the dashboard; the API coordinates a multi-agent run that prepares a repository, scans and selects findings, proposes a patch, validates it, pauses for review, and may publish a draft pull request. The dashboard follows persisted run events and supports replay and review decisions. The graph reflects the documented workflow and sampled wiring; implementation details for several agent stages and API routes were not sampled, so uncertain links are omitted.
Main entry points: builder.py Security team graph · __init__.py Patch development · useRun.ts Run lifecycle · validation_checks.py Patch validation
Components 27
Dashboard
- Dashboard
frontend/src/App.tsx - API client
frontend/src/api/client.ts - Run lifecycle
frontend/src/features/runs/useRun.ts - Event replay
frontend/src/features/runs/useReplay.ts
API and runs
- Run routes
backend/src/orod/api/routes/runs.py - Run coordinator
backend/src/orod/application/run_analysis.py - Event streaming
backend/src/orod/application/stream_events.py - Advisory sync
backend/src/orod/application/sync_vulnerabilities.py
Agent workflow
- Security team graph
backend/src/orod/graph/builder.py - Repository survey
backend/src/orod/agents/architect/__init__.py - Security analysis
backend/src/orod/agents/security/__init__.py - Finding selection
backend/src/orod/graph/routing.py - Patch development
backend/src/orod/agents/developer/__init__.py - Patch validation
backend/src/orod/adapters/repository/validation_checks.py - Human review
backend/src/orod/graph/routing.py - Draft PR publishing
backend/src/orod/adapters/github/cli.py
Repository and security
- Git repository
backend/src/orod/adapters/repository/git.py - Security scanners
backend/src/orod/adapters/scanners - Patch providers
backend/src/orod/adapters/llm/routing.py - OSV advisories
backend/src/orod/adapters/scanners/osv.py
Run and advisory state
- Run event store
backend/src/orod/adapters/persistence/sqlite.py - Storage contracts
backend/src/orod/ports/storage.py - Advisory index
backend/src/orod/adapters/vector/chroma.py
Other components
- User
- GitHub
- LLM service
- Docker validation
Connections 31
- User → Dashboard: starts and reviews
- Dashboard → Run lifecycle: controls run
- Run lifecycle → API client: requests run
- API client → Run routes: calls API
- Run routes → Run coordinator: coordinates
- Run coordinator → Security team graph: runs workflow
- Security team graph → Repository survey: surveys repository
- Security team graph → Security analysis: runs security analysis
- Security analysis → Finding selection: returns findings
- Finding selection → Patch development: routes selected findings
- Security team graph → Patch development: proposes fixes
- Patch development → Patch validation: validates patch
- Patch validation → Human review: routes outcome
- Human review → Patch development: requests regeneration
- Human review → Draft PR publishing: approves validated patch
- Repository survey → Git repository: prepares repository
- Security analysis → Security scanners: runs scanners
- Patch development → Patch providers: requests patch
- Patch providers → LLM service: requests generation
- Patch validation → Git repository: validates changes
- Git repository → GitHub: clones repository
- Patch validation → Docker validation: runs trusted tests
- Draft PR publishing → GitHub: opens draft PR
- Run coordinator → Run event store: persists run
- Security team graph → Run event store: records events
- Run lifecycle → Event streaming: subscribes to events
- Event streaming → Run event store: reads event history
- Run lifecycle → Event replay: replays events
- Advisory sync → OSV advisories: fetches advisories
- OSV advisories → Advisory index: indexes advisories
- Security team graph → Advisory index: searches advisories