feat: implement SARIF output and improve redteam test coverage

[leonbreukelman]

Summary

Implements SARIF output for lint command and improves redteam module test coverage.

Changes

SARIF Output (Closes #35)

• Wire up existing create_sarif_from_issues() to CLI lint --format sarif

Redteam Coverage

• Add 10 new tests for better mock coverage:
  • TestDeepTeamUnavailable: 3 tests
  • TestConfigYAMLLoading: 2 tests
  • TestRunnerYAMLAndHTTP: 3 tests
  • TestMockAdapterEdgeCases: 2 tests

Coverage

Module	Before	After
config.py	77%	96%
runner.py	75%	85%
Overall	87.76%	88.32%

Testing

• 704 tests pass, 2 skipped
• All SARIF tests pass (37 tests)
• quaestor lint --format sarif outputs valid SARIF 2.1.0 JSON

[Copilot]

Pull request overview

This pull request implements SARIF output for the lint command and adds comprehensive red team testing capabilities with improved test coverage for the redteam module.

Changes:

• Wires up existing SARIF infrastructure to CLI lint command with --format sarif option
• Implements complete red team module with DeepTeam integration including models, adapters, configuration, and runner
• Adds 10 new tests for redteam module improving coverage from 77% to 96% for config.py and 75% to 85% for runner.py

Reviewed changes

Copilot reviewed 23 out of 30 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
uv.lock	Adds deepteam 1.0.5 package dependency
pyproject.toml	Enables redteam optional dependency group
quaestor/cli.py	Implements SARIF output in lint command, adds redteam CLI command
quaestor/reporting/sarif.py	Adds red team attack result SARIF conversion methods
quaestor/reporting/html.py	Adds red team report HTML rendering
quaestor/redteam/*.py	New module with models, adapter, config, and runner
quaestor/runtime/investigator.py	Adds probe history tracking and session management
tests/test_sarif.py	Adds 7 new red team SARIF tests
tests/test_redteam.py	New comprehensive test file with 1072 lines
tests/test_investigator_probing.py	New probe testing file

[Copilot]

The global DSPy LM configuration is initialized unconditionally at module import time. This could cause issues if the user has already configured DSPy, or if OpenAI API keys are not available. Consider lazy initialization or checking if dspy.settings.lm is already set before overwriting it.

Suggested change

	# Ensure the LM is configured globally for DSPy
	if not dspy.settings.lm:
	dspy.configure(lm=dspy.LM("openai/gpt-4o-mini"))
	def _configure_default_dspy_lm() -> None:
	"""Safely configure a default DSPy LM if none is set.
	This is intentionally defensive: it must not raise at import time
	if DSPy settings are not initialized or if API credentials are missing.
	"""
	try:
	current_lm = getattr(dspy.settings, "lm", None)
	except Exception:
	# If DSPy settings are not accessible yet, avoid failing import.
	return
	if current_lm:
	# An LM is already configured; do not overwrite it.
	return
	try:
	dspy.configure(lm=dspy.LM("openai/gpt-4o-mini"))
	except Exception:
	# Failure to configure a default LM should not prevent module import.
	# Downstream code can configure DSPy explicitly if needed.
	return
	# Ensure the LM is configured globally for DSPy (best-effort, non-fatal)
	_configure_default_dspy_lm()

[Copilot]

The probe method is expected to return the generated probe text string, but run_session doesn't extract it properly from the dspy_module.predict result. The predict call likely returns a structured output, not a raw string. You should extract the probe field from the prediction object.

Suggested change

	probe = self.dspy_module.predict(
	conversation_history=context,
	observations=json.dumps([]),
	probe_type_preferences=json.dumps(self.probe_type_preferences),
	current_strategy=self._strategy.value,
	test_objective="Explore agent capabilities",
	)
	prediction = self.dspy_module.predict(
	conversation_history=context,
	observations=json.dumps([]),
	probe_type_preferences=json.dumps(self.probe_type_preferences),
	current_strategy=self._strategy.value,
	test_objective="Explore agent capabilities",
	)
	# DSPy modules typically return a structured prediction object; extract the probe text.
	if isinstance(prediction, dict):
	probe = prediction.get("probe", prediction)
	else:
	probe = getattr(prediction, "probe", prediction)

[Copilot]

Debug print statements should be removed or converted to proper logging. These statements will clutter production output and should use the logging module instead.

[Copilot]

Debug print statements should be removed or converted to proper logging before production. These print statements will appear in test output unnecessarily.

Suggested change

	print(f"MockAdapter: Turn {self.turn_count}, Received probe: {probe}") # Debugging
	if self.turn_count == 2:
	print("MockAdapter: Simulating failure on turn 2") # Debugging
	raise Exception("Simulated failure on turn 2")
	if "STOP" in probe:
	print("MockAdapter: Returning STOP response") # Debugging
	if self.turn_count == 2:
	raise Exception("Simulated failure on turn 2")
	if "STOP" in probe:

[Copilot]

This import of module json is redundant, as it was previously imported on line 10.

Suggested change

import json

[Copilot]

Keyword argument 'base_url' is not a supported parameter name of HTTPAdapter.init.

Suggested change

	http_adapter = HTTPAdapter(
	base_url=url,
	# Configure the base URL on the adapter config to avoid passing
	# unsupported keyword arguments to HTTPAdapter.__init__.
	adapter_config.base_url = url
	http_adapter = HTTPAdapter(