Probe Execution Lifecycle — One Finding, End to End

Probe Execution Lifecycle — One Finding, End to End A sequence diagram generated by Archify. POST /v1/scans enqueue run_scan_job 202 + scan id dequeue probe key attack payload (httpx, isolated) completion request agent response evaluate response + trace verdict + confidence 0.90 INSERT finding + attack path framework control tags next probe key scan completed Dispatch Engage target Judge + persist Console · operator · Sequence participant Console operator Scan API · /v1/scans · Sequence participant Scan API /v1/scans ARQ · queue · Sequence participant ARQ queue Worker · probe engine · Sequence participant Worker probe engine Gateway · OpenRouter · Sequence participant Gateway OpenRouter Agent Persona · target · Sequence participant Agent Persona target AEGIS-J · cascade judge · Sequence participant AEGIS-J cascade judge Postgres · evidence · Sequence participant Postgres evidence Legend request return security async trace default message

Evidence at every hop

  • • Each probe key carries an attack path recorded step by step
  • • The judge sees the response and the trace, never the probe's severity hint
  • • Findings and control tags persist in one write — no post-hoc mapping

What the trace proves

  • • The agent, not the platform, produced the violating output
  • • Confidence below 0.75 escalates rather than inflates
  • • 243 findings survived this pipeline in the internal evaluation

Scale of one scan

  • • Median completed scan: 3.6 minutes of probe traffic
  • • 1,092 unique probe keys available per evaluation
  • • Average completed scan: 7.1 minutes end to end