[{"data":1,"prerenderedAt":414},["ShallowReactive",2],{"-docs-guide-audit-workflows":3,"-docs-guide-audit-workflows-surround":401},{"id":4,"title":5,"body":6,"description":391,"extension":392,"links":393,"meta":394,"navigation":395,"path":397,"seo":398,"stem":399,"__hash__":400},"docs\u002Fdocs\u002F2.guide\u002F10.audit-workflows.md","How to run campaign workflows",{"type":7,"value":8,"toc":384},"minimark",[9,13,18,31,54,61,73,80,84,87,201,204,207,225,232,236,244,265,268,271,275,296,310,313,339,342,346,366,380],[10,11,12],"p",{},"Use full campaigns to establish broad coverage, incremental campaigns to review changed paths, and retest campaigns to verify one remediated finding.",[14,15,17],"h2",{"id":16},"establish-a-baseline-with-a-full-campaign","Establish a baseline with a full campaign",[19,20,21,25,28],"ol",{},[22,23,24],"li",{},"Confirm the project has a methodology version and at least one enabled model.",[22,26,27],{},"Check out the target branch and commit locally.",[22,29,30],{},"Run:",[32,33,38],"pre",{"className":34,"code":35,"language":36,"meta":37,"style":37},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","thespider-agent run\n","bash","",[39,40,41],"code",{"__ignoreMap":37},[42,43,46,50],"span",{"class":44,"line":45},"line",1,[42,47,49],{"class":48},"sBMFI","thespider-agent",[42,51,53],{"class":52},"sfazB"," run\n",[10,55,56,57,60],{},"Without ",[39,58,59],{},"--campaign",", the agent creates or reuses a full campaign from local Git metadata, drains claimable slices for its configured models, and submits results.",[19,62,64,67,70],{"start":63},4,[22,65,66],{},"Open the project dashboard.",[22,68,69],{},"Confirm no slices remain pending or running.",[22,71,72],{},"Triage findings before treating the campaign as a release baseline.",[10,74,75,76,79],{},"The first campaign has no comparison. A later campaign compares with its explicit ",[39,77,78],{},"baseline_campaign_id"," when one is set; otherwise the risk dashboard compares with the preceding campaign by identifier.",[14,81,83],{"id":82},"run-an-incremental-audit","Run an incremental audit",[10,85,86],{},"Incremental campaigns require a base commit and a non-empty changed-path list because the server does not have the source tree.",[32,88,92],{"className":89,"code":90,"language":91,"meta":37,"style":37},"language-http shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","POST \u002Fv1\u002Fprojects\u002F{projectId}\u002Fcampaigns\nAuthorization: Bearer TOKEN\nContent-Type: application\u002Fjson\n\n{\n  \"type\": \"incremental\",\n  \"git\": {\n    \"branch\": \"feature\u002Ftenant-settings\",\n    \"commit\": \"HEAD_COMMIT\",\n    \"remote_url\": \"git@example.com:team\u002Frepo.git\",\n    \"dirty\": false\n  },\n  \"base_commit\": \"BASE_COMMIT\",\n  \"changed_paths\": [\n    \"src\u002Fhttp\u002Fsettings.ts\",\n    \"src\u002Fdb\u002Ftenant.ts\"\n  ]\n}\n","http",[39,93,94,99,105,111,117,123,129,135,141,147,153,159,165,171,177,183,189,195],{"__ignoreMap":37},[42,95,96],{"class":44,"line":45},[42,97,98],{},"POST \u002Fv1\u002Fprojects\u002F{projectId}\u002Fcampaigns\n",[42,100,102],{"class":44,"line":101},2,[42,103,104],{},"Authorization: Bearer TOKEN\n",[42,106,108],{"class":44,"line":107},3,[42,109,110],{},"Content-Type: application\u002Fjson\n",[42,112,113],{"class":44,"line":63},[42,114,116],{"emptyLinePlaceholder":115},true,"\n",[42,118,120],{"class":44,"line":119},5,[42,121,122],{},"{\n",[42,124,126],{"class":44,"line":125},6,[42,127,128],{},"  \"type\": \"incremental\",\n",[42,130,132],{"class":44,"line":131},7,[42,133,134],{},"  \"git\": {\n",[42,136,138],{"class":44,"line":137},8,[42,139,140],{},"    \"branch\": \"feature\u002Ftenant-settings\",\n",[42,142,144],{"class":44,"line":143},9,[42,145,146],{},"    \"commit\": \"HEAD_COMMIT\",\n",[42,148,150],{"class":44,"line":149},10,[42,151,152],{},"    \"remote_url\": \"git@example.com:team\u002Frepo.git\",\n",[42,154,156],{"class":44,"line":155},11,[42,157,158],{},"    \"dirty\": false\n",[42,160,162],{"class":44,"line":161},12,[42,163,164],{},"  },\n",[42,166,168],{"class":44,"line":167},13,[42,169,170],{},"  \"base_commit\": \"BASE_COMMIT\",\n",[42,172,174],{"class":44,"line":173},14,[42,175,176],{},"  \"changed_paths\": [\n",[42,178,180],{"class":44,"line":179},15,[42,181,182],{},"    \"src\u002Fhttp\u002Fsettings.ts\",\n",[42,184,186],{"class":44,"line":185},16,[42,187,188],{},"    \"src\u002Fdb\u002Ftenant.ts\"\n",[42,190,192],{"class":44,"line":191},17,[42,193,194],{},"  ]\n",[42,196,198],{"class":44,"line":197},18,[42,199,200],{},"}\n",[10,202,203],{},"The server matches changed paths against pass scopes. Dependency manifests, lockfiles, container files, environment files, and selected framework configuration files trigger every pass because they can change assumptions globally.",[10,205,206],{},"Run an existing incremental campaign from the checkout that matches its target commit:",[32,208,210],{"className":34,"code":209,"language":36,"meta":37,"style":37},"thespider-agent run --campaign CAMPAIGN_ID\n",[39,211,212],{"__ignoreMap":37},[42,213,214,216,219,222],{"class":44,"line":45},[42,215,49],{"class":48},[42,217,218],{"class":52}," run",[42,220,221],{"class":52}," --campaign",[42,223,224],{"class":52}," CAMPAIGN_ID\n",[10,226,227,228,231],{},"On a managed runner host, ",[39,229,230],{},"thespider-agent daemon"," discovers claimable campaigns, fetches the target commit into a managed checkout, and runs them.",[14,233,235],{"id":234},"interpret-campaign-comparison","Interpret campaign comparison",[10,237,238,239,243],{},"The selected campaign is the ",[240,241,242],"strong",{},"current"," side. Its baseline is the explicit baseline campaign when present, otherwise the previous campaign.",[245,246,247,253,259],"ul",{},[22,248,249,252],{},[240,250,251],{},"New"," means the finding has a current sighting and no baseline sighting.",[22,254,255,258],{},[240,256,257],{},"Resolved"," means the finding has a baseline sighting and no current sighting.",[22,260,261,264],{},[240,262,263],{},"Carried forward"," means an open finding has sightings in both campaigns.",[10,266,267],{},"Comparison uses project-level finding identity, fingerprint aliases, and sightings. A wording change that deduplicates to the same keeper is carried forward rather than counted as new.",[10,269,270],{},"The campaign page also shows findings new relative to its baseline. The project dashboard supplies the new, resolved, and carried-forward counts.",[14,272,274],{"id":273},"retest-a-remediation","Retest a remediation",[19,276,277,280,283,290,293],{},[22,278,279],{},"Open the finding in the web application.",[22,281,282],{},"Change its status to the mode-appropriate fixed state and record one or more fix commits.",[22,284,285,286,289],{},"Select ",[240,287,288],{},"Create retest campaign",".",[22,291,292],{},"Open the linked campaign.",[22,294,295],{},"Run the campaign from a checkout at the recorded fix commit:",[32,297,298],{"className":34,"code":209,"language":36,"meta":37,"style":37},[39,299,300],{"__ignoreMap":37},[42,301,302,304,306,308],{"class":44,"line":45},[42,303,49],{"class":48},[42,305,218],{"class":52},[42,307,221],{"class":52},[42,309,224],{"class":52},[10,311,312],{},"The server limits the campaign to the finding's bucket and passes whose scopes match its files. When every retest slice finishes:",[245,314,315,326,336],{},[22,316,317,318,321,322,325],{},"An exact or deduplicated reappearance changes the finding to ",[39,319,320],{},"still_vulnerable"," and records a ",[39,323,324],{},"regressed"," fix verification.",[22,327,328,329,321,332,335],{},"A covered run with no reappearance keeps or changes the finding to ",[39,330,331],{},"fixed",[39,333,334],{},"confirmed"," verification.",[22,337,338],{},"An uncovered scope produces no conclusion.",[10,340,341],{},"Open the finding again to review fix and verification history.",[14,343,345],{"id":344},"choose-a-cadence","Choose a cadence",[245,347,348,351,354,357,360],{},[22,349,350],{},"Run a full campaign after material methodology changes and on a scheduled release or monthly boundary.",[22,352,353],{},"Run incremental campaigns for pull requests or branch updates.",[22,355,356],{},"Retest each remediated severe finding before release.",[22,358,359],{},"Keep one stable, completed campaign as the comparison baseline while a release train is active.",[22,361,362,363,289],{},"Do not compare incomplete campaigns as if absence proved resolution; pending slices make the gate status ",[39,364,365],{},"pending",[10,367,368,369,374,375,379],{},"Use the ",[370,371,373],"a",{"href":372},"\u002Fdocs\u002Freference\u002Fapi","API reference"," for request fields and the ",[370,376,378],{"href":377},"\u002Fdocs\u002Freference\u002Fconcepts","concepts glossary"," for identity and lease terminology.",[381,382,383],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":37,"searchDepth":101,"depth":101,"links":385},[386,387,388,389,390],{"id":16,"depth":101,"text":17},{"id":82,"depth":101,"text":83},{"id":234,"depth":101,"text":235},{"id":273,"depth":101,"text":274},{"id":344,"depth":101,"text":345},"Choose full, incremental, baseline, and retest campaigns and establish an audit cadence","md",null,{},{"icon":396},"i-lucide-git-compare-arrows","\u002Fdocs\u002Fguide\u002Faudit-workflows",{"title":5,"description":391},"docs\u002F2.guide\u002F10.audit-workflows","T_8SYYHQjiwpXsnckzrIHCfu144UqqODb3jSgeUP1wg",[402,408],{"title":403,"path":404,"stem":405,"description":406,"icon":407,"children":-1},"Configuration","\u002Fdocs\u002Fguide\u002Fconfiguration","docs\u002F2.guide\u002F1.configuration","XDG user auth store and commit-safe project config","i-lucide-settings",{"title":409,"path":410,"stem":411,"description":412,"icon":413,"children":-1},"How to host an external execution agent","\u002Fdocs\u002Fguide\u002Fexternal-agent","docs\u002F2.guide\u002F11.external-agent","Implement the claim, lease, heartbeat, and result lifecycle on a third-party runner host","i-lucide-plug-zap",1784724165141]