Vision

Vision answers one question: what to act on next. It reads the latest runs of each workspace, and it puts the result in one place.

The Vision screen has one group for each workspace. Each group holds two halves: the checks that the workspace can start, and the items that ask for attention.

Checks

A check is a template. The list holds the analysis templates and the test templates of the workspace, and nothing else.

Press the button on a row to start that template. Press the button on the group to start all of them. Midair makes a run for each start and reports the run identifier.

Monitoring has no row here, because a device reports on its own cycle and there is nothing to start.

Insight cards

An insight card names an action. The title and the numbers come from the records. The one line under the title says why the item deserves attention now. An AI provider writes that line once it has read the evidence, and a computed line stands in until then.

A click opens the card onto the evidence: the failing tests, the advisories of each workspace, the findings, or the story of the device.

Attack vectors

Vision, then Attack vectors, holds the avenues that are under probe: each one names something somebody wants proved or disproved about the system, and owns a loop that keeps testing it. See Attack vectors.

The problem list

The problem list holds every problem in scope as one list, with a filter for the source:

Vulnerabilities

An advisory against a dependency.

Tests

A test that did not pass.

Code

A finding that the analyser reported.

Devices

Drift on a monitored device.

Licences

A licence that asks for a decision, and a package that declares none.

Contributors

A fact about who wrote the flagged code.

Midair reads the list from the latest analysis run of each workspace. The vulnerabilities go one step further: the run recorded what was known when it ran, and the vulnerability database knows what is true now. A package that was clean last month is the package that nobody is looking at.

Vulnerability database

Vision, then Vulnerability DB, searches the vulnerability database server directly. The page has two modes.

Package mode takes an ecosystem, a package name, and either an exact version or a version range. An operating-system package also takes a distribution. The ecosystems are npm, pypi, cargo, go, maven, composer, rubygems, nuget, hex, github-action, deb, rpm and apk.

Vulnerability ID mode takes one identifier, for example a CVE number or a GHSA number, and shows what the database holds about it.

The database is a local copy. The server answers from it, and it makes no request to the internet while it answers.