feat(security-agent): add audit report backend by jeanduplessis · Pull Request #4081 · Kilo-Org/cloud

jeanduplessis · 2026-06-17T18:27:35Z

Summary

Security Agent now has the backend/API foundation for durable Security Finding Activity Events and owner-scoped Audit Reports, split out so it can land before the web UI.

Why this change is needed

Security owners need period-bounded evidence of material Security Finding actions and outcomes for investigation and compliance work without implying complete legacy reconstruction or aggregate historical SLA compliance. The schema, writers, and API need to land first because deployed services will write audit evidence before the UI consumes it.

How this is addressed

Extends the canonical audit ledger with owner-scoped, idempotent, deletion-safe Security Finding Activity Event fields and a regenerated migration.
Adds shared audit-event helpers used by Security Sync and Security Auto Analysis flows.
Emits reportable evidence across sync, analysis, dismissal, remediation, and deletion paths.
Adds server-side report assembly with UTC date ranges, deterministic finding timelines, privacy controls, fail-closed query budgets, and personal/organization tRPC endpoints.
Updates the Security Agent spec and context contract for Audit Report evidence, access, deletion, privacy, and availability guarantees.

Verification

Reviewed the backend split against the original feat(security-agent): add audit reports and refresh management UX #4069 scope and confirmed it excludes web route pages, React components, shared UI primitive changes, and the UI-only package dependency.
No browser or manual runtime verification was performed; this PR contains backend/API/database changes only.

Visual Changes

N/A

Reviewer Notes

Human Reviewer Flags

Deploy this PR before feat(security-agent): add audit report UI #4082. The migration must be applied before deployed writers emit the new Security Finding Activity Event fields and actions.
Schema-first deployment is required because authoritative finding transitions now write audit evidence in the same transaction.
Synchronous report assembly intentionally returns no partial data when its event-count, serialized-size, or timeout budgets are exceeded.
Organization report access is broader than ordinary member access and intentionally remains available after Security Agent, subscription, or integration disablement for authorized viewers.

Code Reviewer Agent

Code Reviewer Notes

Audit events use owner-partitioned idempotency, compact deletion-safe snapshots, strict payload validation, and event-time actor attribution.
Report assembly uses owner-scoped keyset pagination, deterministic grouping, safe link projection, and explicit legacy-evidence handling.
Focus review on route authorization, real-database multi-page report behavior, deleted-finding end-to-end evidence, and migration behavior on populated audit data.
The UI is intentionally excluded and stacked in feat(security-agent): add audit report UI #4082.

kilo-code-bot · 2026-06-17T18:33:22Z

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Incremental changes address review feedback: actor_email removed from audit report rows, snapshot sanitization functions added (email redaction, URL validation, CVSS validation), and typed error class applied. Previous CREATE INDEX warning on the migration file carries forward unchanged.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0166_curved_praxagora.sql`	10-13	`CREATE INDEX` / `CREATE UNIQUE INDEX` without `CONCURRENTLY` may block writes if the `security_audit_log` table has production data

Files Reviewed (8 changed, 73 total)

.env.local.example
ENVIRONMENT.md
apps/web/.env.development.local.example
apps/web/.env.test
apps/web/src/lib/security-agent/db/security-audit-report.test.ts
apps/web/src/lib/security-agent/db/security-audit-report.ts
packages/worker-utils/src/security-finding-audit.ts
services/security-sync/src/sync.test.ts

(plus 65 unchanged files from previous review)

Fix these issues in Kilo Cloud

Previous Review Summaries (2 snapshots, latest commit ab27592)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `ab27592`)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Migration creates indexes without CONCURRENTLY on the security_audit_log table, which could block writes if the table already has production data. Previous issues in auto-dismiss-service.ts have been resolved in this revision.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0166_curved_praxagora.sql`	10-13	`CREATE INDEX` without `CONCURRENTLY` may block writes

Files Reviewed (73 files)

.specs/security-agent.md - spec updates for audit report
CONTEXT.md - domain context additions
apps/web/src/lib/security-agent/core/schemas.ts - new UI interaction enum and schema
apps/web/src/lib/security-agent/db/dashboard-stats.test.ts - new tests
apps/web/src/lib/security-agent/db/dashboard-stats.ts - SLA-aware dashboard stats
apps/web/src/lib/security-agent/db/security-analysis.ts - analysis query enhancements
apps/web/src/lib/security-agent/db/security-audit-report.test.ts - new audit report tests
apps/web/src/lib/security-agent/db/security-audit-report.ts - new audit report assembly
apps/web/src/lib/security-agent/db/security-findings.test.ts - package field tests
apps/web/src/lib/security-agent/db/security-findings.ts - per-finding audit events
apps/web/src/lib/security-agent/posthog-tracking.test.ts - new tracking tests
apps/web/src/lib/security-agent/posthog-tracking.ts - UI + remediation tracking
apps/web/src/lib/security-agent/router/shared-handlers.test.ts - expanded handler tests
apps/web/src/lib/security-agent/router/shared-handlers.ts - new handlers + audit events
apps/web/src/lib/security-agent/services/analysis-service.test.ts
apps/web/src/lib/security-agent/services/analysis-service.ts
apps/web/src/lib/security-agent/services/audit-log-service.ts
apps/web/src/lib/security-agent/services/auto-dismiss-service.test.ts
apps/web/src/lib/security-agent/services/auto-dismiss-service.ts - audit event integration (fixed)
apps/web/src/lib/security-agent/services/extraction-service.ts - JSON fallback extraction
apps/web/src/lib/security-agent/services/manual-analysis-client.test.ts
apps/web/src/lib/security-agent/services/manual-analysis-client.ts
apps/web/src/lib/security-agent/services/manual-dismiss-client.test.ts
apps/web/src/lib/security-agent/services/manual-dismiss-client.ts
apps/web/src/lib/security-agent/services/manual-remediation-client.test.ts
apps/web/src/lib/security-agent/services/manual-remediation-client.ts - typed rejection responses
apps/web/src/lib/security-agent/services/triage-service.ts - JSON fallback extraction
apps/web/src/lib/user/index.test.ts
apps/web/src/routers/organizations/organization-security-agent-router.ts
apps/web/src/routers/security-agent-router.ts
packages/db/src/migrations/0166_curved_praxagora.sql - migration (1 issue)
packages/db/src/migrations/meta/0166_snapshot.json
packages/db/src/migrations/meta/_journal.json
packages/db/src/schema-types.ts
packages/db/src/schema.test.ts
packages/db/src/schema.ts - audit log schema extensions
packages/worker-utils/package.json
packages/worker-utils/src/index.ts
packages/worker-utils/src/security-finding-audit.test.ts
packages/worker-utils/src/security-finding-audit.ts
packages/worker-utils/src/security-remediation-policy.test.ts
packages/worker-utils/src/security-remediation-policy.ts
services/security-auto-analysis/src/analysis-start-lifecycle.integration.test.ts
services/security-auto-analysis/src/analysis-start-lifecycle.ts
services/security-auto-analysis/src/auto-dismiss.test.ts
services/security-auto-analysis/src/auto-dismiss.ts
services/security-auto-analysis/src/callbacks.test.ts
services/security-auto-analysis/src/callbacks.ts
services/security-auto-analysis/src/db/queries.integration.test.ts
services/security-auto-analysis/src/db/queries.ts
services/security-auto-analysis/src/extraction.test.ts
services/security-auto-analysis/src/extraction.ts
services/security-auto-analysis/src/index.test.ts
services/security-auto-analysis/src/index.ts
services/security-auto-analysis/src/launch.test.ts
services/security-auto-analysis/src/launch.ts
services/security-auto-analysis/src/manual-analysis.test.ts
services/security-auto-analysis/src/manual-analysis.ts
services/security-auto-analysis/src/remediation-admission.integration.test.ts
services/security-auto-analysis/src/remediation.test.ts
services/security-auto-analysis/src/remediation.ts
services/security-auto-analysis/src/triage.test.ts
services/security-auto-analysis/src/triage.ts
services/security-auto-analysis/src/types.ts
services/security-sync/src/dismiss.test.ts
services/security-sync/src/dismiss.ts
services/security-sync/src/index.test.ts
services/security-sync/src/index.ts
services/security-sync/src/notifications/sweep.test.ts
services/security-sync/src/notifications/sweep.ts
services/security-sync/src/sync.test.ts
services/security-sync/src/sync.ts
services/security-sync/src/types.ts

Fix these issues in Kilo Cloud

Previous review (commit `2497209`)

Status: 3 Issues Found | Recommendation: Address before merge

Executive Summary

Migration creates indexes without CONCURRENTLY on the security_audit_log table, which could block writes if the table already has production data. An identity function (toAuditFinding) and a removed confidence guard in countEligibleForAutoDismiss are minor code quality issues.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
`packages/db/src/migrations/0166_curved_praxagora.sql`	10-13	`CREATE INDEX` without `CONCURRENTLY` may block writes

SUGGESTION

File	Line	Issue
`apps/web/src/lib/security-agent/services/auto-dismiss-service.ts`	84	`toAuditFinding` is a no-op identity function
`apps/web/src/lib/security-agent/services/auto-dismiss-service.ts`	558	Removed confidence guard could produce `NaN` counts

Files Reviewed (71 files)

.specs/security-agent.md - spec updates for audit report
CONTEXT.md - domain context additions
apps/web/src/lib/security-agent/core/schemas.ts - new UI interaction enum and schema
apps/web/src/lib/security-agent/db/dashboard-stats.test.ts - new tests
apps/web/src/lib/security-agent/db/dashboard-stats.ts - SLA-aware dashboard stats
apps/web/src/lib/security-agent/db/security-analysis.ts - analysis query enhancements
apps/web/src/lib/security-agent/db/security-audit-report.test.ts - new audit report tests
apps/web/src/lib/security-agent/db/security-audit-report.ts - new audit report assembly (1 issue)
apps/web/src/lib/security-agent/db/security-findings.test.ts - package field tests
apps/web/src/lib/security-agent/db/security-findings.ts - per-finding audit events
apps/web/src/lib/security-agent/posthog-tracking.test.ts - new tracking tests
apps/web/src/lib/security-agent/posthog-tracking.ts - UI + remediation tracking
apps/web/src/lib/security-agent/router/shared-handlers.test.ts - expanded handler tests
apps/web/src/lib/security-agent/router/shared-handlers.ts - new handlers + audit events
apps/web/src/lib/security-agent/services/analysis-service.test.ts
apps/web/src/lib/security-agent/services/analysis-service.ts
apps/web/src/lib/security-agent/services/audit-log-service.ts
apps/web/src/lib/security-agent/services/auto-dismiss-service.test.ts
apps/web/src/lib/security-agent/services/auto-dismiss-service.ts - audit event integration (2 issues)
apps/web/src/lib/security-agent/services/extraction-service.ts - JSON fallback extraction
apps/web/src/lib/security-agent/services/manual-analysis-client.test.ts
apps/web/src/lib/security-agent/services/manual-analysis-client.ts
apps/web/src/lib/security-agent/services/manual-dismiss-client.test.ts
apps/web/src/lib/security-agent/services/manual-dismiss-client.ts
apps/web/src/lib/security-agent/services/manual-remediation-client.test.ts
apps/web/src/lib/security-agent/services/manual-remediation-client.ts - typed rejection responses
apps/web/src/lib/security-agent/services/triage-service.ts - JSON fallback extraction
apps/web/src/lib/user/index.test.ts
apps/web/src/routers/organizations/organization-security-agent-router.ts
apps/web/src/routers/security-agent-router.ts
packages/db/src/migrations/0166_curved_praxagora.sql - migration (1 issue)
packages/db/src/migrations/meta/0166_snapshot.json
packages/db/src/migrations/meta/_journal.json
packages/db/src/schema-types.ts
packages/db/src/schema.test.ts
packages/db/src/schema.ts - audit log schema extensions
packages/worker-utils/package.json
packages/worker-utils/src/index.ts
packages/worker-utils/src/security-finding-audit.test.ts
packages/worker-utils/src/security-finding-audit.ts
packages/worker-utils/src/security-remediation-policy.test.ts
packages/worker-utils/src/security-remediation-policy.ts
services/security-auto-analysis/src/analysis-start-lifecycle.integration.test.ts
services/security-auto-analysis/src/analysis-start-lifecycle.ts
services/security-auto-analysis/src/auto-dismiss.test.ts
services/security-auto-analysis/src/auto-dismiss.ts
services/security-auto-analysis/src/callbacks.test.ts
services/security-auto-analysis/src/callbacks.ts
services/security-auto-analysis/src/db/queries.integration.test.ts
services/security-auto-analysis/src/db/queries.ts
services/security-auto-analysis/src/extraction.test.ts
services/security-auto-analysis/src/extraction.ts
services/security-auto-analysis/src/index.test.ts
services/security-auto-analysis/src/index.ts
services/security-auto-analysis/src/launch.test.ts
services/security-auto-analysis/src/launch.ts
services/security-auto-analysis/src/manual-analysis.test.ts
services/security-auto-analysis/src/manual-analysis.ts
services/security-auto-analysis/src/remediation-admission.integration.test.ts
services/security-auto-analysis/src/remediation.test.ts
services/security-auto-analysis/src/remediation.ts
services/security-auto-analysis/src/triage.test.ts
services/security-auto-analysis/src/triage.ts
services/security-auto-analysis/src/types.ts
services/security-sync/src/dismiss.test.ts
services/security-sync/src/dismiss.ts
services/security-sync/src/index.test.ts
services/security-sync/src/index.ts
services/security-sync/src/notifications/sweep.test.ts
services/security-sync/src/notifications/sweep.ts
services/security-sync/src/sync.test.ts
services/security-sync/src/sync.ts

Fix these issues in Kilo Cloud

_{Reviewed by deepseek-v4-pro-20260423 · 529,301 tokens}

_{Review guidance: REVIEW.md from base branch main}

feat(security-agent): add audit report backend

2497209

jeanduplessis mentioned this pull request Jun 17, 2026

feat(security-agent): add audit report UI #4082

Open

kilo-code-bot Bot reviewed Jun 17, 2026

View reviewed changes

Comment thread packages/db/src/migrations/0166_curved_praxagora.sql

Comment thread apps/web/src/lib/security-agent/services/auto-dismiss-service.ts Outdated

Comment thread apps/web/src/lib/security-agent/services/auto-dismiss-service.ts

fix(security-agent): harden auto-dismiss review feedback

ab27592

St0rmz1 reviewed Jun 17, 2026

View reviewed changes

Comment thread services/security-sync/src/sync.ts

St0rmz1 reviewed Jun 17, 2026

View reviewed changes

Comment thread apps/web/src/lib/security-agent/db/security-audit-report.ts

St0rmz1 reviewed Jun 17, 2026

View reviewed changes

Comment thread apps/web/src/lib/security-agent/db/security-audit-report.ts Outdated

St0rmz1 approved these changes Jun 17, 2026

View reviewed changes

fix(security-agent): address audit report review feedback

7174b18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(security-agent): add audit report backend#4081

feat(security-agent): add audit report backend#4081
jeanduplessis wants to merge 3 commits into
mainfrom
jdp/security-agent-audit-backend

jeanduplessis commented Jun 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Jun 17, 2026 •

edited

Loading

WARNING

Previous review (commit `ab27592`)

Executive Summary

Overview

WARNING

Previous review (commit `2497209`)

Executive Summary

Overview

WARNING

SUGGESTION

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jeanduplessis commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why this change is needed

How this is addressed

Verification

Visual Changes

Reviewer Notes

Human Reviewer Flags

Code Reviewer Agent

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Overview

WARNING

Previous review (commit ab27592)

Executive Summary

Overview

WARNING

Previous review (commit 2497209)

Executive Summary

Overview

WARNING

SUGGESTION

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jeanduplessis commented Jun 17, 2026 •

edited

Loading

kilo-code-bot Bot commented Jun 17, 2026 •

edited

Loading

Previous review (commit `ab27592`)

Previous review (commit `2497209`)