TrustFix

Using the product

Findings & fixes

The Consequence Queue and Remediation Dry-Run — triage open findings and run the same engine that gates every shipped fix, with no side effects on preview.

TrustFix turns each detected misconfiguration into a finding, then lets you generate an engine-verified fix as a pull request — or honestly tells you it couldn't safely fix it. The product will not ship a fix it can't verify.

Consequence Queue

/consequence-queue · reads GET /api/findings?status=OPEN

The V2 view of your org-scoped open findings, ranked by real risk (the V1 product owns /findings, so this is mounted at /consequence-queue). The header shows total open plus critical and high counts; severity tabs filter the list. Select a finding to open its detail rail with an engine fix panel.

Generate engine-verified fix runs the full Policy Intelligence Engine (PIE) pipeline and renders exactly what the engine returns — nothing is simulated. The honest outcomes are:

  • Verified (PR open) or Verified fix cached — a fix the engine proved safe.
  • Couldn't safely fix — the engine refused; no fake fix is shown.
  • Detection-only or No code host linked — when a PR can't be produced.

Fix generation itself runs through POST /api/findings/[id]/generate-fix. A cached fix short-circuits without re-running the pipeline or consuming a credit, as long as the trust policy hasn't changed.

Remediation Dry-Run

/remediation-dry-run · POST /api/remediation/preview (preview), POST /api/remediation/generate (apply)

The flagship "see the fix before you trust it" screen. It runs the same engine that gates every shipped fix, with no side effects on preview. Pick an open finding and run a dry-run preview; the full PIE pipeline runs and the verdict renders verbatim:

  • Verified by the engine — real generated Terraform, the PIE layer-by-layer breakdown (score, interpretation, delta classification, passed/total assertions), and a real blast-radius analysis (permissions removed/added, workflows affected, breakage warnings, merge risk, rollback note).
  • Couldn't safely fix — engine refused — the rejected Terraform is shown flagged for manual review only, never presented as a fix.
  • Detection-only or Usage blocked — rendered as-is.

If the verdict is verified, Apply re-runs the pipeline, consumes a credit, opens a real PR, and writes a signed remediation receipt to the Trust Ledger. The apply result is honest too: if the engine refuses at apply time, no PR is opened and no receipt is written. One credit is consumed per finding on whichever action happens first (preview or apply); the second action reads from the cache for 0 credits, and PIE-blocked fixes consume 0 credits.

Tracking a fix to merge

Once a PR is open, a finding moves through remediation and can be checked with POST /api/findings/[id]/check-pr-status; when the merge is detected, the finding is marked RESOLVED. You can mark a finding a false positive (and reopen it) via PATCH /api/findings/[id]/status. The dry-run and apply outcomes also feed The Gate, where every PIE verdict is recorded as a signed gate-decision entry.

← Posture screensGovernance screens →