Module security 

Security-posture audit — the executor behind brain security audit and the security.audit native capability (Issue 140).

A deterministic, offline pass over the loaded config that emits severity-ranked findings about the running posture — network exposure, authentication, egress, secret handling, the execution sandbox surface, and at-rest encryption. Truthful by construction: it reads only config, never the network or an LLM, so every finding is a literal consequence of what the config declares.

The same pure audit function backs both surfaces: the CLI calls it directly and prints render; ConfigSecurityAuditor wraps it to satisfy the cortex::actions::SecurityAuditBackend trait the chat tool-loop dispatches security.audit through.

Structs

ConfigSecurityAuditor

The cortex::actions::SecurityAuditBackend implementation. Holds a snapshot of the config taken at boot and re-runs the pure audit on each dispatch, returning the rendered report. The chat tool-loop dispatches security.audit through this; the CLI calls audit/render directly.

Finding

One security finding — a stable id, a one-line title, the detail explaining why it matters here, and a concrete remediation.

Enums

Severity

Finding severity, ordered most-to-least serious. Derived Ord follows declaration order, so sorting ascending puts the worst findings first.

Functions

audit

Inspect config and produce the security findings, sorted worst-first. Pure — no I/O, no LLM — so it is deterministic and unit-testable.

capabilities

The capability this backend declares: a read-only, offline security-posture audit. Always wired — pure config inspection, no I/O.

render

Render the findings as the human-readable report both surfaces print.