System Architecture
Relevant source files
The following files were used as context for generating this wiki page:
FixOps is an enterprise-grade Decision and Verification Engine designed to normalize, analyze, and automate security decision-making across the software development lifecycle (SDLC). The architecture is built around a multi-layered processing pipeline that ingest various security artifacts (SARIF, SBOM, CVE feeds) and applies sophisticated logic—including Bayesian Prior Mapping and Markov Transition Matrices—to produce actionable security decisions.
The system supports two primary modes: Demo Mode, which uses in-memory stores and mock data for localized testing, and Production Mode, which utilizes distributed components like ChromaDB for vector storage and PostgreSQL for immutable evidence logging.
Sources: frontend/src/pages/ArchitectureCenter.jsx:65-115, frontend/src/pages/ArchitectDashboard.jsx:131-150, CLI_API_INVENTORY.md:144-165
Functional Layering
The FixOps architecture is organized into five distinct logical layers that handle the lifecycle of a security finding from ingestion to final decision and evidence persistence.
Layered Structure Overview
| Layer | Component | Primary Responsibility |
|---|---|---|
| Input Layer | Scan Ingestion | Parses SARIF, SBOM, VEX, and CNAPP findings into a canonical internal format. |
| Processing Layer | Decision Engine | Executes Bayesian Prior Mapping and Markov Transition Matrix analysis. |
| Intelligence Layer | Vector & LLM | Performs security pattern matching via Vector DB and Multi-LLM consensus. |
| Decision Layer | Policy Engine | Evaluates findings against OPA/Rego policies to determine BLOCK or ALLOW. |
| Output Layer | Evidence Lake | Stores immutable audit trails of decisions in PostgreSQL or Audit logs. |
Sources: frontend/src/pages/ArchitectureCenter.jsx:55-103, CLI_API_INVENTORY.md:167-185, scripts/generate_analysis.py:59-71
Data Flow Pipeline
The following diagram illustrates the flow of security artifacts through the system layers.
The diagram shows the sequential transformation of raw security scans into verified decisions.
Sources: frontend/src/pages/ArchitectureCenter.jsx:55-105, CLI_API_INVENTORY.md:200-220
Core Backend Components
The backend architecture relies on several specialized services that provide the algorithmic sophistication required for security verification.
Processing Engine
The processing layer utilizes real Open Source Software (OSS) libraries such as pgmpy, pomegranate, and mchmm. These are used to calculate SSVC (Stakeholder-Specific Vulnerability Categorization) context probability and model vulnerability state evolution.
Sources: frontend/src/pages/ArchitectureCenter.jsx:65-80, frontend/src/pages/ArchitectDashboard.jsx:265-275
Intelligence and Decisioning
- Vector Database: In production, FixOps uses ChromaDB with sentence transformers to store and retrieve over 10,000 security patterns.
- Multi-LLM Consensus: The engine orchestrates analysis across multiple models (GPT-5, Claude, Gemini) to reach a weighted consensus, reducing false positives.
- Policy Engine: Governance is enforced through a production OPA (Open Policy Agent) server executing Rego policies.
Sources: frontend/src/pages/ArchitectureCenter.jsx:82-105, frontend/src/pages/ArchitectDashboard.jsx:230-260
Enterprise Integration Architecture
FixOps is designed to integrate into existing enterprise environments through a robust API surface and a "Plug-and-Play" connector model.
Integration Connectors
The system maintains bidirectional sync with major development and security platforms.
| Connector | Outbound Operations | Webhook Support |
|---|---|---|
| Jira | Create/Update/Transition Issue | Yes |
| ServiceNow | Create Incident/Add Work Note | Yes |
| GitLab | Create/Update Issue | Yes |
| GitHub | Create/Update Issue | No |
| Slack | Post Message | No |
Sources: CLI_API_INVENTORY.md:112-135
Pentagi Integration
The architecture includes a specialized Pentagi penetration testing engine. This module manages pen test requests, tracks execution status (pending, running, completed), and stores results mapped to specific findings.
Sources: CLI_API_INVENTORY.md:65-103, fixops-enterprise/src/services/advanced_pentest_engine.py:880-920
Infrastructure and Deployment
The system is containerized and designed for cloud-native deployment, specifically targeting Kubernetes environments.
Deployment Components
A standard deployment manifest includes the following resources:
- FixOps Backend: High-availability deployment with configurable replicas (default 3).
- Databases: MongoDB for metadata and Redis for caching and session management.
- Storage: Persistent Volume Claims (PVC) for the Evidence Lake, ensuring audit data survival.
- Ingress: Nginx or Istio controllers managing external access to the API and Frontend.
Sources: deployment-packs/kubernetes/backstage/template.yaml:50-100, tests/e2e/mac_m5_setup.md:120-135
Network Architecture
Based on the design documentation, the network is segmented into three primary zones:
- DMZ Zone: Hosts the API Gateway (e.g., Kong).
- Application Zone: Hosts internal microservices like the Payment and User services.
- Data Zone: Isolated zone for PostgreSQL and Redis, accessible only from the application zone.
Sources: demo_ssdlc_stages/02_design_architecture.yaml:45-65
Conclusion
FixOps' architecture emphasizes reliability and auditability by separating ingestion, complex probabilistic analysis, and immutable storage. By leveraging multi-LLM consensus and standardized OPA policies, it provides a scalable framework for automating security gates within enterprise SDLC pipelines.
Sources: frontend/src/pages/ArchitectureCenter.jsx:350-365, CLI_API_INVENTORY.md:180-200