Vaigilmanual

Findings and the AI analyst

One queue, ranked by risk, and every decision kept.

In the consoleFindingsRisk

  1. Read the queue

    vaigil finding list --state open
vaigil finding risk
vaigil finding story ID

  2. Let the analyst take the first pass

    vaigil analyst plan
vaigil analyst triage --limit 20 --dry-run

    The model is any OpenAI-compatible endpoint, set with VAIGIL_MODEL_URL, VAIGIL_MODEL_KEY and VAIGIL_MODEL. Without one, findings are triaged by people alone.

  3. Decide

    vaigil finding decide ID false-positive

    The states are open, triaged, accepted, fixed, stale, false-positive and benign.

What a log line cannot do to the analyst

A finding's evidence is log text, written by whoever reached the log. So nothing depends on the model declining an instruction, and the worst a planted line can do is make a suggestion wrong:

  • What it reads, and in what order, is a plan fixed in code. Nothing a log says can add a step.
  • It is given counts and closed words the program worked out, and, separately and marked, the text somebody else wrote.
  • Its answer is one word from a closed set with a confidence, shown only above a threshold. The reason a person reads is assembled from the counts, never from what the model wrote.
  • Personal data and credentials are masked before the prompt leaves and restored in the answer.

A person records the verdict; the analyst has no way to. vaigil analyst eval --k 3 measures it against what people decided.

Replay

vaigil detect replay runs today's rules over the events again and says which decisions would now be different, and vaigil detect learn FINDING turns a decision into a fixture.