From 4774d9f3d2bce87d65b23a1f28d2adfcc7a85fae Mon Sep 17 00:00:00 2001 From: Antonio Morales <55253029+antonio-morales@users.noreply.github.com> Date: Fri, 18 Sep 2026 08:19:57 +0000 Subject: [PATCH] Default the fuzzing taskflow to claude-sonnet-5 Add src/seclab_taskflows_fuzzing/configs/model_config.yaml, a repo-local model_config that maps every role (code_analysis, general_tasks, triage) to claude-sonnet-5, and repoint every taskflow YAML under taskflows/fuzzing/ at it instead of the parent package's seclab_taskflows.configs.model_config default. Each taskflow YAML's own model_config: header is the sole default used when no -m/--model-config flag is passed, so this makes sonnet-5 the default model for every fuzzing stage without requiring any CLI option or environment variable. Only this repository's own taskflow package is touched, so other repositories depending on the shared seclab_taskflows package are unaffected. Also fix a latent bug in fuzz_runner.py where fold_queue_into_persistent_corpus and reproduce_crash called the tool functions via a nonexistent .fn attribute (leftover from an older fastmcp API), which raised AttributeError on every call. --- .../configs/model_config.yaml | 23 +++++++++++++++++++ .../mcp_servers/fuzz_runner.py | 4 ++-- .../fuzzing/analyze_build_system.yaml | 2 +- .../taskflows/fuzzing/analyze_call_graph.yaml | 2 +- .../taskflows/fuzzing/build_harnesses.yaml | 2 +- .../fuzzing/confirm_fixed_crashes.yaml | 2 +- .../taskflows/fuzzing/fuzz_iteration.yaml | 2 +- .../fuzzing/identify_fuzz_targets.yaml | 2 +- .../taskflows/fuzzing/qualify_harnesses.yaml | 2 +- .../taskflows/fuzzing/triage_crashes.yaml | 2 +- .../fuzzing/write_initial_harnesses.yaml | 2 +- .../taskflows/fuzzing/write_report.yaml | 2 +- .../taskflows/fuzzing/write_vuln_reports.yaml | 2 +- 13 files changed, 36 insertions(+), 13 deletions(-) create mode 100644 src/seclab_taskflows_fuzzing/configs/model_config.yaml diff --git a/src/seclab_taskflows_fuzzing/configs/model_config.yaml b/src/seclab_taskflows_fuzzing/configs/model_config.yaml new file mode 100644 index 0000000..11bee9e --- /dev/null +++ b/src/seclab_taskflows_fuzzing/configs/model_config.yaml @@ -0,0 +1,23 @@ +# SPDX-FileCopyrightText: GitHub, Inc. +# SPDX-License-Identifier: MIT +# +# Default model config for the fuzzing taskflow (this repository only). +# +# claude-sonnet-5 has empirically given the best harness-writing / triage +# results for this pipeline, so it is the default for every role here. Every +# taskflow YAML under seclab_taskflows_fuzzing.taskflows.fuzzing.* references +# this file directly (see its `model_config:` header), so running any stage +# via `python -m seclab_taskflow_agent -t seclab_taskflows_fuzzing.taskflows.fuzzing. ...` +# uses claude-sonnet-5 automatically — no `-m` flag or environment variable +# required. +# +# To use a different model for a one-off run, pass +# `-m ` explicitly; that still overrides this default. + +seclab-taskflow-agent: + version: "1.0" + filetype: model_config +models: + code_analysis: claude-sonnet-5 + general_tasks: claude-sonnet-5 + triage: claude-sonnet-5 diff --git a/src/seclab_taskflows_fuzzing/mcp_servers/fuzz_runner.py b/src/seclab_taskflows_fuzzing/mcp_servers/fuzz_runner.py index b98b0b0..992b760 100644 --- a/src/seclab_taskflows_fuzzing/mcp_servers/fuzz_runner.py +++ b/src/seclab_taskflows_fuzzing/mcp_servers/fuzz_runner.py @@ -1174,7 +1174,7 @@ def fold_queue_into_persistent_corpus( if tmp.exists(): shutil.rmtree(tmp, ignore_errors=True) tmp.mkdir(parents=True, exist_ok=True) - cmin_result = cmin.fn( + cmin_result = cmin( afl_binary_path=afl_binary_path, input_dir=str(cd), output_dir=str(tmp), @@ -1217,7 +1217,7 @@ def reproduce_crash( return {"ok": False, "error": f"binary not found: {afl_binary_path}"} if not Path(input_path).is_file(): return {"ok": False, "error": f"input not found: {input_path}"} - return replay_under_asan.fn( + return replay_under_asan( afl_binary_path=afl_binary_path, input_path=input_path, stdin_input=False, timeout_seconds=timeout_seconds, ) diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_build_system.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_build_system.yaml index cdb9a2b..b6bbce6 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_build_system.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_build_system.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_call_graph.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_call_graph.yaml index fe0bf3a..1da583b 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_call_graph.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/analyze_call_graph.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/build_harnesses.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/build_harnesses.yaml index 87370c8..8f6afc4 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/build_harnesses.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/build_harnesses.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/confirm_fixed_crashes.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/confirm_fixed_crashes.yaml index c6fe9b5..e5a772e 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/confirm_fixed_crashes.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/confirm_fixed_crashes.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/fuzz_iteration.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/fuzz_iteration.yaml index 2fac571..ace726a 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/fuzz_iteration.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/fuzz_iteration.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/identify_fuzz_targets.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/identify_fuzz_targets.yaml index 428139d..a1d7d04 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/identify_fuzz_targets.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/identify_fuzz_targets.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/qualify_harnesses.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/qualify_harnesses.yaml index 170d3d4..1ac2414 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/qualify_harnesses.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/qualify_harnesses.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/triage_crashes.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/triage_crashes.yaml index a8acb12..4ef5e56 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/triage_crashes.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/triage_crashes.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_initial_harnesses.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_initial_harnesses.yaml index 7c59eaa..5b80413 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_initial_harnesses.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_initial_harnesses.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_report.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_report.yaml index 4f88429..905557a 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_report.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_report.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: diff --git a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_vuln_reports.yaml b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_vuln_reports.yaml index b0e37bf..456650f 100644 --- a/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_vuln_reports.yaml +++ b/src/seclab_taskflows_fuzzing/taskflows/fuzzing/write_vuln_reports.yaml @@ -4,7 +4,7 @@ seclab-taskflow-agent: filetype: taskflow version: "1.0" -model_config: seclab_taskflows.configs.model_config +model_config: seclab_taskflows_fuzzing.configs.model_config globals: repo: