threatassessor

Audit and selectively re-run the deterministic analysis engine across all 26 corpus architectures. Default (no args) shows a staleness check — which reports are missing metadata, which arch types need engine fixes re-applied, and the current corpus score table. Pass --ai-only to re-run only AI/agentic architectures, --all to re-run everything, or a single arch name to re-run one. Use after engine changes (self_validation.py, ground_truth_generator.py, rapids_driven_controls.py) to confirm scores are consistent and no regressions landed.

Run TATB (TA Test Benchmark) on a single architecture and print the four-rubric scorecard — Threat-Relevant, TTP-Accurate, Risk-Defensible, Plan-Actionable. Uses the same scoring logic as the dashboard TATB tab. Pass an architecture name as argument, or omit for the most recent report. Read-only. ~3 seconds (includes MITRE API fetch).

Score all architectures in /report/ across the four TATB rubrics and print a visual corpus map — bar table, heatmap, and pipeline stage attribution. Shows which architectures are Excellent/Solid/Weak/Draft on each dimension and identifies which pipeline stages to fix for the largest corpus-wide gain. No UI needed. ~10-15 seconds (MITRE fetch batched once).

Run Expert Review (MoE critics + ScrumMaster) on any architecture that has an existing analysis. Three modes — sequential (3 core critics), full_moe (5 critics + SM, generates Plan-Actionable data), or single-critic (re-run one critic by name). Streams live critic results with scores, gaps, and final confidence. ~60–120s for full_moe, ~30–60s for sequential.

TATB feedback loop — observe corpus or single-arch TATB scores, diagnose weak signals, propose targeted pipeline stage fixes, gate on human approval, apply changes, re-run TATB to verify improvement, and log the before/after delta to docs/DECISIONS.md. The agent does NOT autonomously commit code; every code change requires explicit human approval.

Runs a fast ~15 second integration sanity check — verifies dependencies, rate limiter, MITRE data load (≥835 techniques), OpenRouter API key, API connection, and one real embedding call. Use at session start or after installing dependencies to confirm everything is working before coding.

Show per-critic AIVSS gate config, per-agent model assignments (HarnessModelGuardian), and last SIEM event summary. Use to verify gate thresholds are set, check which agents have custom models configured, and inspect the most recent inbound/internal/outbound scores. Read-only — no side effects.

Run AIVSS v4 scorer on a report directory (ground_truth.json + governance_signals.json) and print the full inbound/internal/outbound breakdown, per-threat table, and a cached-vs-fresh delta if a prior score exists. Pass an architecture name as an argument, or omit for the most recent report. Read-only.

Generate or refresh governance_signals.json + AIVSS scores for existing report directories that are missing them. Supports all reports at once, a single architecture by name, or a fresh full analysis from an MMD file. Pass --force to re-score reports that already have AIVSS data. Use after upgrading the governance pipeline or to populate Insights tab cross-run data.

Generates the MITRE ATT&CK technique embedding cache (technique_embeddings.json). Required after updating enterprise-attack.json or if the cache is missing or corrupt. Takes ~3 minutes and makes ~274 API calls to OpenRouter. Run after /update-data completes a MITRE refresh.

Checks the codebase for deprecated imports, broken module imports, and common anti-patterns. Use after major refactoring, after adding new modules, or before committing large changes. Takes ~2 minutes. Non-destructive — read-only.

Audits CLAUDE.md, docs/DECISIONS.md, and memory files for staleness and accuracy. Use at session start or after a major feature lands. Checks last-updated dates, module paths, API table completeness, and memory entry validity. Outputs a health table with proposed edits — no auto-writes.

Audits and tidies non-code directories (docs, tests, scripts, report). Use when docs feel cluttered, stale reports pile up, or before a release. Read-only audit by default — proposes moves/deletions for user approval, never auto-executes.

Refreshes threat intelligence data in chatbot/data/. Updates MITRE ATT&CK (enterprise-attack.json), ATLAS YAML files, SSP catalog (via scrape script), and ARC risk register YAML from GovTech GitHub. Use quarterly or when a new MITRE/ATLAS release is published. Always backs up before replacing. After MITRE update, prompts to run build-embeddings-cache.