审脉 AuditPilot

面向审计交付场景的企业级 AI Agent 工作台：把 RAG 取证、控制映射、工具治理、评测门禁和人工复核放进同一条可追溯工作流。

Why AuditPilot

很多 Agent 项目停留在聊天框或 Demo。AuditPilot 选择一个更“硬”的落地场景：企业审计交付。它需要证据、控制、风险、复核、报告和整改闭环，也天然要求可追溯、可回归、可解释。

AuditPilot 的目标不是替代审计师，而是把审计师反复执行的取证、映射、检查、补证和交付动作，组织成一套可治理的 Agent 工作流。

What it does

模块	能力
Audit Workspace	审计立项、控制矩阵、审计程序、抽样计划、发现、整改和交付包。
Agent Runtime	Plan / Execute / Reflect、任务产物、失败恢复、安全门和运行指标。
Agentic RAG	知识写入、切块、检索、来源引用、证据质量门和缺证提示。
Skills / MCP-style Tools	工具 Schema、权限声明、TTL 缓存、熔断器、调用日志和工具指标。
Memory	Working / Episodic / Profile Memory，保留多轮审计上下文。
Evaluation Harness	Agent / RAG / Research 评测、基线对比、release gate 和 badcase 沉淀。
Interview-driven Diagnostics	将大厂 Agent 面经/JD 中常问的 Runtime、RAG、Tool、Memory、评测和生产化问题转成可执行诊断。

Screenshots

Audit workspace	Agent runtime

Agent collaboration	Mobile overview

Architecture

Audit request
  -> Hybrid Intent Router
  -> Working + Episodic + Profile Memory
  -> Planner / Evidence / Control / Risk / Compliance / Remediation Agents
  -> Agentic RAG + Knowledge Graph + Skills / MCP-style Tools
  -> Safety Gate + Reflection + Human Review
  -> Audit Repository + Evaluation Baseline + Delivery Package

Design boundaries:

• LLMs help with understanding, summarization and explanation.
• Evidence gaps, quality gates, permissions, risk signals and delivery state stay auditable.
• High-risk or low-confidence outputs are routed to evidence补充 and human review.

Quick start

python -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt
Copy-Item config.env.example config.env
python start.py

The system can run in deterministic fallback mode without model keys. Add an OpenAI-compatible provider only when you want LLM-enhanced analysis.

Security

Do not commit real API keys.

• Put local secrets in config.env.
• Use platform secrets for deployment.
• config.env, .env*, runtime data, logs, model artifacts and local databases are ignored by Git.
• Example config files use placeholders only.

Validation

.\.venv\Scripts\python.exe -m compileall -q agents services rag web tests scripts
.\.venv\Scripts\python.exe -m unittest discover -s tests -p "test_*.py"

Current tests cover intent routing, memory compaction, skill validation/cache, runtime reflection, evaluation regression, self-evolution harness, quality diagnostics and global search.

Project layout

agents/                 audit agent chain and control library
services/               runtime, memory, router, skills, safety, evaluation, delivery
rag/                    agentic RAG and persisted knowledge base
knowledge_graph/        optional graph construction and Neo4j adapter
training/               evaluation and offline training entry points
web/                    FastAPI application and APIs
templates/ + static/    product UI
tests/                  regression tests
docs/                   project archive, interview material and screenshots
data/                   local runtime data, mostly ignored by Git

Reality notes

• Runtime records, tool calls, evaluations, memory and audit cases are generated by real code and persisted locally.
• Untested throughput, accuracy or availability claims are intentionally not presented as project facts.
• SFT / RLHF-style model training is treated as an offline extension; the Web app focuses on workflow, evaluation and data preparation.