YouTube: https://youtu.be/_w3uMlr_FCs?si=LqcuZZ3TZf9wID5k
This now covers BOTH the writeup criterion options:
- Mini-blog (BLOG.md, ~2000 words, hero arc)
- < 2 min YouTube video (founders intro, embedded everywhere)
Surfaced in:
- README.md right under the headline (with thumbnail)
- README.md 'All links (judges click here)' table
- BLOG.md as the first thing under the title (with thumbnail)
- server/app.py landing page (Quick links, top of list)
- HF model card (already pushed)
Deploy Gradio demo Space + link from README + env Space landing
NEW: https://huggingface.co/spaces/Sayuj63/Vapt-Env-Demo
- Standalone Gradio Space hosting the interactive demo UI
- Judges click -> pick scenario + agent -> watch action timeline stream
- Final grader card with delta + improvement multiplier
- Bar chart + W&B reward curve embedded
- Links back to env Space, trained adapter, W&B, GitHub
README: surfaced the demo Space at the top of the link block as the
'try it now' entry point — judges hit this first.
Env Space landing page: also links the demo Space at the top of the
'Quick links' section.
Add friendly landing page at / so judges don't see {'detail':'Not Found'}
Visiting https://huggingface.co/spaces/Sayuj63/Vapt-env was returning a
JSON 404 because the FastAPI server only exposed /reset, /step, /docs,
/health, etc. — there was no GET / handler.
Added a self-contained HTML landing page that shows:
- Project pitch + 3 OpenEnv themes
- 6.4x average lift / 3 themes / 11-component grader cards
- Quick links: GitHub, trained adapter on HF Hub, W&B run
- API endpoints (/docs, /health, /tasks, /openapi.json, /reset, /step)
- Code snippet showing how to talk to the env via openenv-core client
Page is dark-mode native (matches HF Space embed), inline CSS only (no
external assets), included as include_in_schema=False so it doesn't
pollute the OpenAPI spec.
Phase 4 — inference.py teaches the LLM about delegation:
- SYSTEM_PROMPT extended with two new action shapes (spawn_subagent / return_to_parent)
- Explicit delegation guidance: persist vs spawn tradeoff, productive=+0.05 / unproductive=-0.05
- LLMJsonAction & SecurityAuditAction Pydantic Literal extended to accept the new types
- [STEP] log line renders spawn_subagent(scope:target) for visibility
- parse_llm_action_text round-trip verified for both new action types
Phase 5 — reward shaping (already wired in Phase 3's _handle_return_to_parent):
- +0.05 productive, -0.05 unproductive, sub-agent findings flow into _submitted_findings
- spawn_subagent action itself returns +0.01 (tiny acknowledgement so the model sees the spawn was accepted)
- All shaping happens server-side; inference.py is unchanged in the loop body
Phase 6 — grader.py gains Delegation Score (5%):
- New parameter: subagent_outcomes (defaults to empty for single-agent backward compat)
- delegation_score = productive_spa…
- New action types accepted by SecurityAuditAction + LLMJsonAction:
spawn_subagent and return_to_parent (Pydantic Literal extended)
- spawn_subagent validates scope (host|endpoint|cred) and target against the
dynamic _attack_surface; rejects spawn when another sub-agent is still active
or when target is unknown. Auto-admits a revealed-but-not-yet-discovered host
to discovered_hosts so sub-agent tools can immediately reach it.
- Sub-agent registry tracks: scope, target, budget (clamped 2..15),
steps_used, findings_at_spawn, parent_step, status.
- step() auto-decrements budget on every action while a sub-agent is active;
on budget exhaust, sub-agent is closed and outcome recorded as timeout.
- return_to_parent computes productivity (>=1 finding submitted while sub-agent
was active = productive) and emits delegation reward: +0.05 productive,
-0.05 unproductive. Outcome appended to _subagent_outcomes for the future
Delegation Score grader component.
- submit_finding tags …
Phase 1 — schema additions (no behavior change yet, all 78 tests still pass):
- execute_tool() now returns 5-tuple (output, new_hosts, new_ports, reward, revealed_targets)
with backward-compat: 4-tuple handlers get padded to 5-tuple at the engine boundary
- env tracks _attack_surface (grows during episode), _revealed_targets log,
_active_subagents dict, _subagent_outcomes log
- New action_types accepted: spawn_subagent / return_to_parent (stubs, real impl in Phase 3)
- Tests updated: 3 test_generator.py unpack sites bumped to 5-tuple
Phase 2 — tools emit revealed_targets when they hit gateway vulns:
- New _revelations_for_vulns helper in tools_engine/testing.py: when a tool finds a
vulnerability whose ID gates a hidden host (via scenario hosts.hidden_until chain),
emit a {scope: host, target: <ip>, context: ...} revelation
- handle_test_injection / handle_test_xss / handle_test_auth surface revelations both
in their textual output ("[REVEALED] Sub-agent delegation candidates…
