SOVA Agent
Claude Opus 4.6 agentic loop. 30 tools. 7 ARQ cron schedules. Redis memory: 20-turn cap, 6h TTL.
MasterAgent
4 specialised sub-agents (SOVAOperator, ThreatHunter, ForensicsAgent, ComplianceAgent). HMAC task tokens. Human-in-the-loop approval.
WardenHealer
Autonomous anomaly detection. OLS trend prediction. SQLite recipe cache. Haiku incident classification.
Agent Monitor
Session-level threat pattern detection including INJECTION_CHAIN. Cryptographic attestation chain.
Browser Sandbox
Playwright headless Chromium. ScreencastRecorder captures video → MinIO SOC 2 evidence bundles.
Visual Assert Page
In-process Claude Vision page assertion. No HTTP round-trip. Requires Playwright + Anthropic API key.
Visual Diff Tool
Claude Vision baseline vs candidate screenshot comparison. Verdicts: IDENTICAL / MINOR_DIFF / REGRESSION / CRITICAL.
Shadow AI Scanner (SOVA)
SOVA tool #29: calls ShadowAIDetector directly. 18 providers. Falls back gracefully without package.
XAI Explain Tool (SOVA)
SOVA tool #30: causal chain retrieval from logs + XAI rationale. Used by ScenarioRunner smart_retry.
Mobile SOC App — React Native push alerts for HIGH/BLOCK verdicts
iOS + Android React Native app for on-the-go SOC operators. FCM/APNs push alerts fire on every HIGH/BLOCK verdict via the SOVA alerting pipeline. Alert feed, detail view with 9-stage XAI pipeline, one-tap deep-link to full XAI report. Device token registry (SQLite, max 50/tenant). Prometheus counter for delivered notifications.