Start with the tool you're using, then follow into the design docs as needed.
| Doc | Covers |
|---|---|
| cve-metadata-extractor | Inputs, data sources, output format, Ubuntu sources, extractor config keys |
| cve-oe-backport | From a Yocto CVE report through OE patch preparation and build validation |
| cve-corrector | Workflow modes, dependent commit chains, build control, exit codes |
| cve-agent | AI backends, --verify-backend, session limits, security gate, agent exit codes |
| Configuration | XDG storage locations and environment variables |
| Doc | Covers |
|---|---|
| Result schema | Versioned workflow/build/security outcome format, including the WORKFLOW_COMPLETED_UNVERIFIED state before semantic validation accepts a result |
| Agent artifacts | Durable, redacted per-attempt artifact directories |
| Agent preflight | Typed repository preflight checks before an AI backend starts |
| Agent progress and budgets | State-based progress accounting and bounded terminal budgets for native model sessions |
| Doc | Covers |
|---|---|
| Corrector-to-agent handoff | Versioned repository-state boundary crossed after a recoverable corrector failure, including manifest and generated-file policy |
| Safe patch transfer | Deterministic patch-transfer plan for cross-layout changes, with content anchors, rollback, and path verification |
| Semantic security validation | Host-owned gate that a completed build must pass before it's accepted for release |
| Doc | Covers |
|---|---|
| Native OpenAI-compatible backend | Ollama setup, API contract, configuration precedence, endpoint/key gates, and troubleshooting for the openai backend |
| Evaluation harness | Reproducible backend/model benchmarking with fresh snapshots, crossover cohorts, and semantic success metrics |
| LLM backport capability suite | Isolated scoring of a model's patch-adaptation ability, independent of Yocto/mirrors/corrector setup |
| Adversarial release gate | Deterministic tests for known false positives and hostile model/provider/repository cases before a controlled evaluation release |
- extra/README.md — plugin development guide for custom CVE sources and AI backends
- CONTRIBUTING.md — development setup and contribution guidelines
- AGENTS.md — codebase map for AI assistants