rhoai-security-reviewer

AI-First Pipeline

Integration and deployment repository for the RHOAI (Red Hat OpenShift AI) AI-first engineering platform. It combines an active Python pipeline for bug, RFE, and strategy work with a K3s-hosted suite of workflow, CI simulation, observability, and trace-analysis services.

This repository owns the integration layer: the Python CLI/dashboard, workflow definitions, container assembly, Kubernetes manifests, and operational scripts. Several deployed applications are independent repositories checked out under the gitignored deploy/repos/ directory. The manifests and deployment script, not the contents of every local checkout, define the component stack.

The platform is designed to define, run, observe, evaluate, and govern AI-native software-engineering workflows against realistic but isolated services. It can connect business intent to planning, investigation, code, CI, and evidence while preserving the execution history needed to understand and compare the result.

Its central goal is continuous improvement: turn execution traces and generated artifacts into evidence-backed feedback for skills, context, retrieval, workflows, models, tools, and policies. Findings from one run become targeted changes and regression cases for the next, creating a measurable engineering quality loop rather than a collection of one-off agent prompts.

Skills + context + models + policy
                 |
                 v
           Workflow execution
                 |
                 v
       Artifacts + traces + claims
                 |
                 v
      Evidence-based verification
                 |
                 v
         Root-cause attribution
                 |
                 v
     Targeted change + regression replay

The reference scenario in var/demos/end-to-end/ demonstrates the current platform arc:

RFE -> quality gate -> strategy -> review -> epic decomposition
    -> investigation and code generation

It resets the local service environment, imports source and skill repositories, seeds Jira, launches instrumented agent jobs through the dashboard, fans work out through Markov, and records artifacts and telemetry. The scenario is destructive by design, which makes complete runs reproducible and suitable for workflow, skill, model, harness, and policy comparisons.

graph TB
    subgraph host["Host Machine"]
        proxy["Go Reverse Proxy<br/>*.local TLS routing"]
    end

    subgraph k3s["K3s Cluster"]
        direction TB

        subgraph core["Core Services"]
            dashboard["Pipeline Dashboard<br/>dashboard.local"]
            markov["markovd + Markov Jobs<br/>markov.local<br/>Workflow Control Plane"]
            mlflow["MLflow<br/>mlflow.local<br/>Experiment Tracking"]
            es["Elasticsearch<br/>Trace Indexing"]
            observatory["Observatory<br/>observatory.local<br/>Claim Verification"]
        end

        subgraph emulators["Service Emulators"]
            github["GitHub Emulator<br/>github.local"]
            gitlab["GitLab Emulator<br/>gitlab.local"]
            jira["Jira Emulator<br/>jira.local"]
            runner["GitLab Runner<br/>K8s Executor"]
        end

        subgraph infra["Infrastructure"]
            certmgr["cert-manager<br/>Internal CA"]
            traefik["Traefik<br/>Ingress Controller"]
        end

        jobs["Pipeline / Workflow Jobs<br/>Claude SDK · OpenCode · agentic-ci"]
    end

    proxy --> traefik
    traefik --> dashboard & mlflow & markov & observatory
    traefik --> github & gitlab & jira
    runner --> gitlab
    dashboard --> jira & mlflow & markov
    markov --> jobs
    jobs --> jira & github & gitlab & mlflow
    mlflow -.->|trace sync| es
    observatory --> github & gitlab & jira
    certmgr -.->|TLS certs| traefik

Prerequisites

• Python 3.13+
• uv (package manager)
• Podman or Docker for image builds; Podman is required for the Python pipeline's patch-validation containers
• Git
• Vertex AI credentials (the Claude Agent SDK connects via Google Cloud)
• K3s (for the full deployment stack; optional for CLI-only usage)

External data directories

The pipeline uses a .context/ directory (gitignored) for external reference data:

• .context/architecture-context/ — architecture docs for RHOAI components (read-only reference for agents)
• .context/odh-tests-context/ — test context files (.json + .md) describing how to lint/test each repo in a container

RFE and strategy skills live in an external repo:

• remote_skills/rfe-creator/ — cloned repo with RFE/strategy skill definitions, scripts, and its own CLAUDE.md

These are gitignored and must be cloned or populated separately.