Scenario 14 traces callers, entry points, vulnerable usages, and available data-flow evidence for a named incident question. It supports investigation; the incident owner performs the operational response and records closure.
Start with a bounded question
Use a CVE identifier, vulnerable function, exposed endpoint, or observed exploit path. Bind the question to an incident record, source revision, affected environment, and observation time. Never paste secrets, credentials, customer payloads, or unrestricted logs into the query.
If the issue is a proactive hypothesis rather than an active incident, use the security hypothesis workflow separately. It is not the Scenario 14 entry point.
Run the dedicated CLI
The reproducible local command requires an explicit CPG database:
python -m src.cli security incident "<query>" --db PATH --format json
Optional --max-depth limits call-graph traversal. Preserve the command, CPG revision, query, and output together. Missing --db fails closed with security incident requires explicit --db for CPG access.
Run the typed AppSec scenario
Use the role-bound route when the governed AppSec task and runtime context are available:
from src.digital_employees.runtime.scenarios import (
RoleBoundScenarioInvocationRequest,
invoke_role_bound_scenario_request,
)
request = RoleBoundScenarioInvocationRequest(
query="Trace callers and entry points reaching the vulnerable parser.",
employee_id="codegraph_appsec",
scenario_id="scenario_14",
event_type="appsec_start",
context={
"project_key": "codegraph",
"namespace": "default",
"task_id": "<task-id>",
"source_refs": ["<incident-ref>", "<revision-ref>"],
"file_paths": ["<bounded-source-path>"],
},
)
result = invoke_role_bound_scenario_request(request)
The CLI and typed route are different evidence carriers. Record which one produced each finding.
Read the result
Use the result to prioritize manual verification of direct and transitive callers, entry points, vulnerable usages, attack paths, and taint-flow observations. Validate critical paths in the bound source and affected environment.
LLM or fallback recommendations are hypotheses. Empty paths can reflect missing CPG coverage, a mismatched symbol, limited traversal depth, or a runtime-only path; inspect those conditions during incident triage.
Operational and authority boundaries
Keep these controls separate:
| Control | What Scenario 14 proves |
|---|---|
containment |
nothing; isolate systems through the approved incident procedure |
remediation |
recommendations only; implement and test an authorized patch separately |
postmortem |
nothing; create the accountable incident record and review |
governed closure |
all mandated evidence and accountable authorities are recorded |
Analysis output supports the incident owner, who rotates secrets, blocks traffic, deploys a hotfix, notifies stakeholders, and authorizes disclosure through the operational response.
Failure and recovery
- Explicit database rejected or unavailable: stop and restore the intended revision-bound CPG.
- No matching function: check the exact symbol, language coverage, entry point, and traversal depth.
- Partial or fallback result: label it as preliminary and obtain source/runtime evidence before action.
- Active exploitation or unsafe environment: follow the customer’s incident command process; do not wait for CodeGraph analysis.
Source contract
This guide is bound to:
src/cli/security_suite/security_commands.py— dedicated CLI and explicit database requirement;src/workflow/scenarios/security/incident.py— scenario evidence and fallback behavior;src/workflow/scenarios/security/incident_query_helpers.py— bounded CPG queries;src/digital_employees/runtime/scenarios/role_bound_scenario_invoker.py— typed routing;src/digital_employees/runtime/scenarios/employee_scenario_invocation.py— AppSec ownership and event policy.