Fix: build error + ACTS consensus + ChainAnalyzer + rate limit + timer + venv path\n\n Build error fix:\n - requirements.txt: Remove atheris (requires Clang+libFuzzer, unavailable in HF Spaces)\n - fuzzing_engine.py: Graceful atheris fallback, detects availability at runtime,\n falls back to Hypothesis automatically\n - Dockerfile: Renamed builder stage to base, runtime inherits directly, eliminates\n broken reference to nonexistent 'builder' stage name in COPY --from\n\n ACTS Consensus bug (hermes_orchestrator.py):\n - _run_acts_consensus now calls all 3 models individually and concurrently,\n passing all 3 raw verdicts to compute_acts() so disagreement penalty works\n - Previously merged result collapsed to 1-item list (agreement_factor always 1.0)\n\n ChainAnalyzerTool in Hermes registry (hermes_orchestrator.py):\n - Added ChainAnalyzerTool with name=chain_analysis registered in _TOOL_REGISTRY\n - Hermes can now autonomously synthesize exploit chains without human UI click\n - _HERMES_SYSTEM prompt updated to document the new tool\n\n LLM rate limit backoff (hermes_orchestrator.py):\n - _hermes_llm_call retries on 429 with delays 15s/30s/60s\n - Single 429 no longer aborts the entire research session\n\n Timer consolidation (app.py):\n - get_combined_refresh() returns all 8 live-update outputs at once\n - 3 concurrent gr.Timer.tick() SSE streams collapsed to single tick\n - Reduces HF Space connection pressure under multiple simultaneous users\n\n Venv path fix (app.py):\n - execute_approved_harness uses VENV_DIR constant, not hardcoded string\n - Creates venv on-demand if missing so standalone Security Research tab works

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Builder
-FROM python:3.12-slim AS builder
+FROM python:3.12-slim AS base
 
 ENV DEBIAN_FRONTEND=noninteractive \
     PYTHONUNBUFFERED=1 \
@@ -16,33 +16,26 @@ COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 WORKDIR /build
 COPY requirements.txt .
 
-# FIX: only build wheels here — do NOT also run uv pip install --system.
-# The previous double-install (uv pip install --system AND pip wheel) was
-# redundant and could produce conflicting bytecode in the builder layer.
-RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt mcp-server-fetch
+# Install dependencies directly — avoids wheel-build failures for packages
+# that require special compile-time tooling (e.g. atheris/libFuzzer).
+# atheris has been removed from requirements.txt; Hypothesis is the fallback.
+RUN pip install --no-cache-dir -r requirements.txt mcp-server-fetch
 
 
-# Stage 2: Runtime
-FROM python:3.12-slim AS runtime
+# Stage 2: Runtime — inherits installed packages from base
+FROM base AS runtime
 
 LABEL org.opencontainers.image.title="Rhodawk AI DevSecOps Engine"
 
-# FIX: UV_PYTHON now points to python3 (always present in python:3.12-slim)
-# rather than /usr/local/bin/python which may lack the executable in some
-# HuggingFace Space runtime snapshots. UV_PYTHON_PREFERENCE=system tells uv
-# to skip its managed-toolchain download and use the container Python directly.
-ENV DEBIAN_FRONTEND=noninteractive \
-    PYTHONUNBUFFERED=1 \
-    GRADIO_SERVER_NAME=0.0.0.0 \
+ENV GRADIO_SERVER_NAME=0.0.0.0 \
     GRADIO_SERVER_PORT=7860 \
     HOME=/home/rhodawk \
     PATH="/home/rhodawk/.local/bin:/usr/local/bin:$PATH" \
-    UV_LINK_MODE=copy \
     UV_PYTHON_PREFERENCE=system \
     UV_PYTHON=/usr/local/bin/python3
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends git curl ca-certificates nodejs npm && \
+    apt-get install -y --no-install-recommends nodejs npm && \
     rm -rf /var/lib/apt/lists/*
 
 RUN npm install -g --quiet @modelcontextprotocol/server-github
@@ -55,16 +48,10 @@ RUN id -u 1000 >/dev/null 2>&1 && (userdel -r $(id -un 1000) || true) || true &&
 # even before the application calls os.makedirs() at runtime.
 RUN mkdir -p /data /app && chmod 777 /data && chown -R rhodawk:rhodawk /app
 
-WORKDIR /app
-
-# Copy pre-built wheels from builder
-COPY --from=builder /wheels /wheels
-
 # Copy the uv executable from the official image
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
-RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
-
+WORKDIR /app
 USER rhodawk
 
 # Copy the source code

fuzzing_engine.py

@@ -152,21 +152,47 @@ def _extract_code_block(text: str) -> str:
 def _fallback_harness(target: str, language: str) -> str:
     """Generic fallback harness when LLM is unavailable."""
     if language == "python":
+        # FIX (Build Error): atheris requires Clang + libFuzzer at compile time and
+        # fails to build on HuggingFace Spaces.  The fallback harness now uses
+        # hypothesis which is available everywhere, matching the Hypothesis
+        # fallback already in use when atheris is unavailable at runtime.
         return f"""
-import atheris
 import sys
+try:
+    import atheris
+    _ATHERIS_AVAILABLE = True
+except ImportError:
+    _ATHERIS_AVAILABLE = False
+
+if _ATHERIS_AVAILABLE:
+    import sys
+
+    @atheris.instrument_func
+    def fuzz_target(data):
+        fdp = atheris.FuzzedDataProvider(data)
+        try:
+            val = fdp.ConsumeUnicodeNoSurrogates(128)
+            # TODO: call {target}(val)
+        except Exception:
+            pass
 
-@atheris.instrument_func
-def fuzz_target(data):
-    fdp = atheris.FuzzedDataProvider(data)
-    try:
-        val = fdp.ConsumeUnicodeNoSurrogates(128)
-        # TODO: call {target}(val)
-    except Exception:
-        pass
+    atheris.Setup(sys.argv, fuzz_target)
+    atheris.Fuzz()
+else:
+    # Hypothesis-based fallback when atheris/libFuzzer is unavailable
+    from hypothesis import given, settings, HealthCheck
+    from hypothesis import strategies as st
 
-atheris.Setup(sys.argv, fuzz_target)
-atheris.Fuzz()
+    @given(st.text(max_size=128))
+    @settings(max_examples=500, suppress_health_check=list(HealthCheck))
+    def fuzz_target(val):
+        try:
+            # TODO: call {target}(val)
+            pass
+        except Exception:
+            pass
+
+    fuzz_target()
 """
     return f"# Fallback harness for {target} ({language})\n# Manual harness required\n"
 
@@ -331,7 +357,20 @@ def run_fuzzing_campaign(
 
     start = time.time()
     if language == "python" and "atheris" in harness_code:
-        crashes = _run_python_atheris(harness_code, duration_s)
+        # FIX (Build Error): atheris may be unavailable; fall back to Hypothesis.
+        try:
+            import importlib.util
+            _atheris_available = importlib.util.find_spec("atheris") is not None
+        except Exception:
+            _atheris_available = False
+        if _atheris_available:
+            crashes = _run_python_atheris(harness_code, duration_s)
+        else:
+            # Rewrite the harness to use Hypothesis if atheris is not installed
+            harness_code = harness_code.replace(
+                "import atheris", "# atheris unavailable — using Hypothesis fallback"
+            )
+            crashes = _run_hypothesis(repo_dir, target, harness_code, duration_s)
     else:
         crashes = _run_hypothesis(repo_dir, target, harness_code, duration_s)
 

hermes_orchestrator.py

@@ -210,10 +210,30 @@ class SSECTool(HermesTool):
         return run_ssec_scan(repo_dir, focus_files=focus_files)
 
 
+class ChainAnalyzerTool(HermesTool):
+    name = "chain_analysis"
+    description = (
+        "Synthesize stored primitive findings into higher-severity exploit chains. "
+        "Call after at least 2 primitives are recorded. Returns THEORETICAL proposals "
+        "tagged PENDING_HUMAN_REVIEW — no chain is executed automatically."
+    )
+
+    def run(self, repo_dir: str, repo: str = "", **kwargs) -> dict:
+        hermes_log(f"Chain analysis → {repo or repo_dir}", "EXPLOIT")
+        from chain_analyzer import analyze_chains, get_all_primitives
+        target = repo or repo_dir
+        primitives = get_all_primitives(repo=target)
+        if len(primitives) < 2:
+            return {"chains": [], "note": f"Only {len(primitives)} primitive(s) stored — need ≥2 to chain"}
+        chains = analyze_chains(repo=target)
+        return {"chains": chains, "primitive_count": len(primitives)}
+
+
 _TOOL_REGISTRY: dict[str, HermesTool] = {
     t.name: t() for t in [
         ReconTool, TaintTool, SymbolicTool, FuzzTool,
         ExploitTool, CVETool, CommitWatchTool, SSECTool,
+        ChainAnalyzerTool,
     ]
 }
 
@@ -326,6 +346,7 @@ You have access to these tools:
 - cve_intel: Query historical CVEs for similar patterns
 - commit_watch: Find silent security patches in commit history
 - ssec_scan: Semantic similarity to known exploit patterns
+- chain_analysis: Synthesize stored primitive findings into exploit chains (call after ≥2 findings)
 
 For each target, produce a research plan and execute it step by step.
 When you find something, rate its severity honestly. Never hallucinate findings.
@@ -352,7 +373,14 @@ Or to signal completion:
 """
 
 
+_RATE_LIMIT_BACKOFF_DELAYS = [15, 30, 60]  # seconds — exponential backoff for 429s
+
+
 def _hermes_llm_call(messages: list[dict], model: str = None, timeout: int = 120) -> dict:
+    """
+    Call the Hermes LLM with exponential backoff on rate-limit (429) responses.
+    Three retries before giving up — prevents a single 429 from aborting a session.
+    """
     if not OPENROUTER_API_KEY:
         return {"done": True, "summary": "OPENROUTER_API_KEY not set"}
 
@@ -370,17 +398,34 @@ def _hermes_llm_call(messages: list[dict], model: str = None, timeout: int = 120
         "max_tokens": 2048,
         "response_format": {"type": "json_object"},
     }
-    try:
-        resp = requests.post(
-            f"{OPENROUTER_BASE}/chat/completions",
-            headers=headers, json=payload, timeout=timeout,
-        )
-        resp.raise_for_status()
-        content = resp.json()["choices"][0]["message"]["content"]
-        return json.loads(content)
-    except Exception as e:
-        hermes_log(f"LLM call failed: {e}", "WARN")
-        return {"done": True, "summary": f"LLM error: {e}"}
+
+    last_error: Exception | None = None
+    for attempt, backoff in enumerate([0] + _RATE_LIMIT_BACKOFF_DELAYS):
+        if backoff:
+            hermes_log(f"Rate limit hit — waiting {backoff}s before retry {attempt}/{len(_RATE_LIMIT_BACKOFF_DELAYS)}", "WARN")
+            time.sleep(backoff)
+        try:
+            resp = requests.post(
+                f"{OPENROUTER_BASE}/chat/completions",
+                headers=headers, json=payload, timeout=timeout,
+            )
+            if resp.status_code == 429:
+                last_error = Exception(f"HTTP 429 rate limit (attempt {attempt + 1})")
+                hermes_log(str(last_error), "WARN")
+                continue
+            resp.raise_for_status()
+            content = resp.json()["choices"][0]["message"]["content"]
+            return json.loads(content)
+        except Exception as e:
+            if "429" in str(e):
+                last_error = e
+                hermes_log(f"Rate limit exception: {e}", "WARN")
+                continue
+            hermes_log(f"LLM call failed: {e}", "WARN")
+            return {"done": True, "summary": f"LLM error: {e}"}
+
+    hermes_log(f"LLM call exhausted all retries. Last error: {last_error}", "WARN")
+    return {"done": True, "summary": f"LLM rate limit — all retries exhausted: {last_error}"}
 
 
 # ──────────────────────────────────────────────────────────────
@@ -528,8 +573,17 @@ def run_hermes_research(
 
 
 def _run_acts_consensus(session: HermesSession):
-    """Run multi-model adversarial consensus on each finding to compute ACTS score."""
-    from adversarial_reviewer import _call_concurrent_consensus
+    """
+    Run multi-model adversarial consensus on each finding to compute ACTS score.
+
+    FIX (ACTS Bug): Previously _call_concurrent_consensus returned a single merged
+    result, so compute_acts() always received a 1-item list with agreement_factor=1.0
+    — completely bypassing the disagreement penalty.  Now we call each consensus model
+    individually so all 3 raw verdicts are passed to compute_acts(), enabling the full
+    Bayesian disagreement weighting to work as designed.
+    """
+    import concurrent.futures
+    from adversarial_reviewer import _call_single_model, ADVERSARY_SYSTEM_PROMPT
 
     CONSENSUS_MODELS = [
         "deepseek/deepseek-r1:free",
@@ -551,12 +605,40 @@ def _run_acts_consensus(session: HermesSession):
             "Is this a real, exploitable vulnerability? Respond as a hostile security reviewer."
         )
         try:
-            result, _ = _call_concurrent_consensus(prompt)
+            # Call all 3 models concurrently and collect individual raw verdicts.
+            # This is required so compute_acts() receives the full disagreement signal
+            # rather than a pre-merged single verdict (which collapses agreement_factor to 1.0).
+            individual_results: list[dict] = []
+            with concurrent.futures.ThreadPoolExecutor(max_workers=len(CONSENSUS_MODELS)) as ex:
+                futures = {
+                    ex.submit(_call_single_model, model, prompt): model
+                    for model in CONSENSUS_MODELS
+                }
+                for future in concurrent.futures.as_completed(futures, timeout=90):
+                    try:
+                        result_dict, _ = future.result()
+                        if result_dict is not None:
+                            individual_results.append(result_dict)
+                    except Exception:
+                        pass
+
+            if not individual_results:
+                raise RuntimeError("All ACTS consensus models failed")
+
+            # Build one verdict entry per model response so compute_acts sees N items.
             verdicts = [
-                {"verdict": result.get("verdict", "UNCERTAIN"), "confidence": result.get("confidence", 0.5)}
+                {
+                    "verdict": r.get("verdict", "UNCERTAIN"),
+                    "confidence": float(r.get("confidence", 0.5)),
+                }
+                for r in individual_results
             ]
             finding.acts_score = compute_acts(verdicts)
-            hermes_log(f"ACTS score for {finding.finding_id}: {finding.acts_score}", "ACTS")
+            hermes_log(
+                f"ACTS score for {finding.finding_id}: {finding.acts_score} "
+                f"({len(verdicts)} model verdicts: {[v['verdict'] for v in verdicts]})",
+                "ACTS",
+            )
         except Exception as e:
             hermes_log(f"ACTS consensus failed for {finding.finding_id}: {e}", "WARN")
             finding.acts_score = finding.confidence

requirements.txt

@@ -24,7 +24,8 @@ z3-solver>=4.12.0
 qdrant-client>=1.9.0
 transformers>=4.40.0
 torch>=2.2.0
-atheris>=2.3.0
+# atheris removed: requires Clang + libFuzzer at compile time which is unavailable
+# on HuggingFace Space Docker images. Fuzzing falls back to Hypothesis automatically.
 angr>=9.2.0
 networkx>=3.0
 defusedxml>=0.7.1