SecHive is a local-first operator control plane: scope policy, recon, skill routing, hypothesis planning, runtime validation, proof packaging and signed reporting — composed as one accountable pipeline.
Each stage emits artifacts. Artifacts are hashed. Hashes are bound to the proof pack. Nothing in the report is reachable without an artifact behind it.
Authorization document loaded before any active probe. scope_guard hard-blocks out-of-scope action at the skill level — not just at the UI.
Refutations are first-class artifacts. When a hypothesis fails, the failure is signed and retained in the proof pack — not discarded. This is what makes the report defensible when challenged.
Every promoted finding ships with a replay.sh bound to the same artifact hashes. A reviewer can reproduce the finding on any lab that matches the target configuration.
SecHive routes signals into focused agents. A nonce in a signed payload should not be reasoned about by the same skill that handles JavaScript route inventory.
The human-readable report for the reviewer and the machine-readable proof pack for downstream systems. One is not a derivative of the other — they are emitted by the same pipeline stage.
Mode-specific Markdown + HTML render. Executive summary, findings table, severity histogram, evidence excerpts, remediation guidance, redaction status.
JSON manifest with provenance, sha256 artifact index, replay scripts, reviewer disposition, model-cost accounting and a cosign attestation.
SecHive is local-first. The operator UI shows running campaigns, hypothesis graphs, evidence drawers, replay buttons, runtime health and approval queues — all served from the same machine that holds your scope.
