codejury 0.10.1__tar.gz → 0.10.2__tar.gz

{codejury-0.10.1 → codejury-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.1
+Version: 0.10.2
 Summary: General-purpose Application Security AI audit framework -- five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT
@@ -32,22 +32,22 @@ Dynamic: license-file
 
 An AI security auditor for code whose knowledge lives in versioned YAML, not in
 prompts. It reviews a diff or a whole repository against the OWASP ASVS and
-reports a verdict per dimension -- both what is **vulnerable** and what is
+reports a verdict per dimension: both what is **vulnerable** and what is
 **verified safe**.
 
-The name is the core idea: code goes before a "jury" of adversarial roles --
-Finder / Challenger / Judge -- that argue and converge on a verdict.
+The name is the core idea: code goes before a "jury" of adversarial roles,
+Finder / Challenger / Judge, that argue and converge on a verdict.
 
 Why it is built this way:
 
 - **Knowledge is data.** Each OWASP ASVS area (and now OWASP LLM Top 10 areas) is a YAML capability
-  (safe patterns + anti-patterns, with CWE and examples) -- versioned, reviewable
+  (safe patterns + anti-patterns, with CWE and examples), versioned, reviewable
   in a PR, and editable by non-engineers. The framework core stays small.
 - **Verdicts, not just alerts.** Every capability yields `SECURE` / `VULNERABLE`
   / `PARTIAL` / `NOT_PRESENT`, so a report shows what was checked and *passed*,
   not only what failed.
 - **Composable.** Four orchestration strategies, four model backends, and
-  diff / repo inputs are chosen per run -- mix and match.
+  diff / repo inputs are chosen per run; mix and match.
 
 ## Install
 
@@ -65,7 +65,7 @@ git diff origin/main... | codejury audit --fail-on high -
 # Post inline review comments on a GitHub pull request (needs GITHUB_TOKEN)
 git diff origin/main... | codejury audit --github your-org/your-repo#123 -
 
-# No API key needed -- prove the pipeline runs end to end with mock layers
+# No API key needed: prove the pipeline runs end to end with mock layers
 codejury dry-run
 
 # A real audit: set a key, then review your staged changes
@@ -104,7 +104,7 @@ caller/callee context). It downgrades only on positive proof, so it removes fals
 positives without dropping real findings.
 
 `--orchestrator adaptive` keeps cost down: it runs the single verifier first and
-escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+escalates to a full debate only for artifacts worth it: any VULNERABLE verdict
 (verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
 confident files pay a single call; only the rest pay for debate.
 
@@ -118,7 +118,7 @@ outside C/C++) are dropped by versioned rules in
 
 `codejury eval` takes `--dataset <dir>` (golden YAML directory), `--split <name>`
 (score only cases tagged with that `split:`, e.g. a held-out set), and
-`--format {text,json}` -- the JSON report is a stable schema (overall plus
+`--format {text,json}`; the JSON report is a stable schema (overall plus
 per-capability confusion matrix and precision / recall / F1).
 
 Runs are deterministic: providers query at temperature 0, and `audit` / `scan`
@@ -139,7 +139,7 @@ codejury scan ./myrepo --only secrets,input_validation,crypto
 ## Configuration
 
 Provider keys are read from the environment (codejury does **not** auto-load
-`.env` -- copy `.env.example` and `source` it):
+`.env`; copy `.env.example` and `source` it):
 
 | Variable | Used by |
 |---|---|
@@ -180,7 +180,7 @@ what `--only` and a task's `capabilities:` accept:
 `business_logic` · `dependency_config` · `prompt_injection` ·
 `insecure_output_handling` · `excessive_agency`
 
-To tune for your codebase, edit these files (add patterns / sharpen wording) --
+To tune for your codebase, edit these files (add patterns / sharpen wording);
 no code change needed.
 
 ## Architecture
@@ -210,13 +210,13 @@ independently.
   can't see whether a value is attacker-controlled. Mitigations that add context
   but do not fully solve it: `scan --callers` (where this file's functions are
   called) and `scan --callees` (the called code it delegates to, so a sink in
-  another file is visible) -- pair them for both directions; `--orchestrator
+  another file is visible); pair them for both directions; `--orchestrator
   challenge` (a recall-safe
   refutation pass that drops only provably-safe flags); `--only` to scope; or
   `--orchestrator debate`. Real taint precision still needs data-flow analysis,
   not model skepticism.
 - **`scan` cost scales as files x capabilities.** It is a periodic deep audit,
-  not a quick check -- scope it with `--only`. Day to day, audit the diff.
+  not a quick check; scope it with `--only`. Day to day, audit the diff.
 
 ## Development
 

{codejury-0.10.1 → codejury-0.10.2}/README.md

@@ -2,22 +2,22 @@
 
 An AI security auditor for code whose knowledge lives in versioned YAML, not in
 prompts. It reviews a diff or a whole repository against the OWASP ASVS and
-reports a verdict per dimension -- both what is **vulnerable** and what is
+reports a verdict per dimension: both what is **vulnerable** and what is
 **verified safe**.
 
-The name is the core idea: code goes before a "jury" of adversarial roles --
-Finder / Challenger / Judge -- that argue and converge on a verdict.
+The name is the core idea: code goes before a "jury" of adversarial roles,
+Finder / Challenger / Judge, that argue and converge on a verdict.
 
 Why it is built this way:
 
 - **Knowledge is data.** Each OWASP ASVS area (and now OWASP LLM Top 10 areas) is a YAML capability
-  (safe patterns + anti-patterns, with CWE and examples) -- versioned, reviewable
+  (safe patterns + anti-patterns, with CWE and examples), versioned, reviewable
   in a PR, and editable by non-engineers. The framework core stays small.
 - **Verdicts, not just alerts.** Every capability yields `SECURE` / `VULNERABLE`
   / `PARTIAL` / `NOT_PRESENT`, so a report shows what was checked and *passed*,
   not only what failed.
 - **Composable.** Four orchestration strategies, four model backends, and
-  diff / repo inputs are chosen per run -- mix and match.
+  diff / repo inputs are chosen per run; mix and match.
 
 ## Install
 
@@ -35,7 +35,7 @@ git diff origin/main... | codejury audit --fail-on high -
 # Post inline review comments on a GitHub pull request (needs GITHUB_TOKEN)
 git diff origin/main... | codejury audit --github your-org/your-repo#123 -
 
-# No API key needed -- prove the pipeline runs end to end with mock layers
+# No API key needed: prove the pipeline runs end to end with mock layers
 codejury dry-run
 
 # A real audit: set a key, then review your staged changes
@@ -74,7 +74,7 @@ caller/callee context). It downgrades only on positive proof, so it removes fals
 positives without dropping real findings.
 
 `--orchestrator adaptive` keeps cost down: it runs the single verifier first and
-escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+escalates to a full debate only for artifacts worth it: any VULNERABLE verdict
 (verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
 confident files pay a single call; only the rest pay for debate.
 
@@ -88,7 +88,7 @@ outside C/C++) are dropped by versioned rules in
 
 `codejury eval` takes `--dataset <dir>` (golden YAML directory), `--split <name>`
 (score only cases tagged with that `split:`, e.g. a held-out set), and
-`--format {text,json}` -- the JSON report is a stable schema (overall plus
+`--format {text,json}`; the JSON report is a stable schema (overall plus
 per-capability confusion matrix and precision / recall / F1).
 
 Runs are deterministic: providers query at temperature 0, and `audit` / `scan`
@@ -109,7 +109,7 @@ codejury scan ./myrepo --only secrets,input_validation,crypto
 ## Configuration
 
 Provider keys are read from the environment (codejury does **not** auto-load
-`.env` -- copy `.env.example` and `source` it):
+`.env`; copy `.env.example` and `source` it):
 
 | Variable | Used by |
 |---|---|
@@ -150,7 +150,7 @@ what `--only` and a task's `capabilities:` accept:
 `business_logic` · `dependency_config` · `prompt_injection` ·
 `insecure_output_handling` · `excessive_agency`
 
-To tune for your codebase, edit these files (add patterns / sharpen wording) --
+To tune for your codebase, edit these files (add patterns / sharpen wording);
 no code change needed.
 
 ## Architecture
@@ -180,13 +180,13 @@ independently.
   can't see whether a value is attacker-controlled. Mitigations that add context
   but do not fully solve it: `scan --callers` (where this file's functions are
   called) and `scan --callees` (the called code it delegates to, so a sink in
-  another file is visible) -- pair them for both directions; `--orchestrator
+  another file is visible); pair them for both directions; `--orchestrator
   challenge` (a recall-safe
   refutation pass that drops only provably-safe flags); `--only` to scope; or
   `--orchestrator debate`. Real taint precision still needs data-flow analysis,
   not model skepticism.
 - **`scan` cost scales as files x capabilities.** It is a periodic deep audit,
-  not a quick check -- scope it with `--only`. Day to day, audit the diff.
+  not a quick check; scope it with `--only`. Day to day, audit the diff.
 
 ## Development
 

{codejury-0.10.1 → codejury-0.10.2}/codejury/__init__.py

@@ -1,6 +1,6 @@
-"""codejury -- a general-purpose Application Security AI audit framework.
+"""codejury: a general-purpose Application Security AI audit framework.
 
-Five layers: Task / (Capability + Orchestrator + Source + Agent) / Provider / Infrastructure.
+Five layers: Task, then Capability plus Orchestrator plus Source plus Agent, then Provider, then Infrastructure.
 Domain knowledge lives in YAML capability files as a first-class citizen,
 aligned with OWASP ASVS.
 """

{codejury-0.10.1 → codejury-0.10.2}/codejury/agents/__init__.py

@@ -1,4 +1,4 @@
-"""codejury.agents -- the audit roles (finder / challenger / judge / verifier).
+"""codejury.agents: the audit roles (finder / challenger / judge / verifier).
 
 An agent reads an AnalysisContext and emits observations. It talks to a model
 only through a Provider, never a vendor SDK, so the role logic stays independent

{codejury-0.10.1 → codejury-0.10.2}/codejury/agents/debate.py

@@ -35,8 +35,8 @@ _FINDING_SHAPE = (
 
 _DEEP_LENS = (
     "Look past surface patterns for the deepest flaw:\n"
-    "- Trust anchors: what does this code trust to authenticate or authorize -- a key, token, header, "
-    "signature, role, or caller -- and who controls that value? If the attacker supplies what is used to "
+    "- Trust anchors: what does this code trust to authenticate or authorize, such as a key, token, header, "
+    "signature, role, or caller, and who controls that value? If the attacker supplies what is used to "
     "verify them (e.g. their own public key, an unconfigured key that disables verification), passing the "
     "check proves nothing.\n"
     "- Order of operations: is an external, irreversible, or privileged action performed before the local "
@@ -101,7 +101,7 @@ class ChallengerAgent(_DebateAgent):
     def run(self, ctx: AnalysisContext) -> list[Observation]:
         parts = [
             "Challenge the findings below. For each one you believe is a false positive, write a rebuttal. "
-            "Add new_findings for any real issue that was missed -- especially a deeper flaw the finder "
+            "Add new_findings for any real issue that was missed, especially a deeper flaw the finder "
             "stopped short of.",
             _DEEP_LENS,
             _code(ctx.artifact),

{codejury-0.10.1 → codejury-0.10.2}/codejury/agents/mock.py

@@ -1,4 +1,4 @@
-"""MockAgent -- a minimal Agent for the dry-run and tests.
+"""MockAgent: a minimal Agent for the dry-run and tests.
 
 It really calls the provider (so the dry-run exercises the agent -> provider
 path), then emits one Verdict per in-scope capability, parking the model's reply

{codejury-0.10.1 → codejury-0.10.2}/codejury/agents/parsing.py

@@ -1,7 +1,7 @@
 """Shared coercion from loosely-typed model JSON into domain values.
 
 Agents parse model output that may omit, mistype, or invent fields. These
-helpers coerce defensively -- they never raise on bad input, they fall back.
+helpers coerce defensively: they never raise on bad input, they fall back.
 """
 
 import math

{codejury-0.10.1 → codejury-0.10.2}/codejury/agents/refuter.py

@@ -1,8 +1,8 @@
-"""RefuterAgent -- a skeptic that tries to dismiss flagged verdicts as false positives.
+"""RefuterAgent: a skeptic that tries to dismiss flagged verdicts as false positives.
 
 Used by the challenge orchestrator: the verifier flags issues, then the refuter
 gets the code plus the VULNERABLE verdicts (via ``ctx.history``) and argues which
-are false positives -- e.g. a value that is not actually attacker-controlled or a
+are false positives, e.g. a value that is not actually attacker-controlled or a
 sink that is not reachable. It returns a Concession per verdict it refutes.
 
 This is the cheap, focused alternative to a full debate: only flagged verdicts
@@ -53,7 +53,7 @@ class RefuterAgent(Agent):
             "is not attacker-controlled: a stored data field, or traced (here or in the call sites) to "
             "a trusted, config, or operator-supplied source. If its origin is not shown or could "
             "plausibly be external input, do NOT refute. For other issue types (hardcoded secrets, "
-            "weak crypto, ...), a literal value is often the vulnerability itself -- do NOT refute "
+            "weak crypto, ...), a literal value is often the vulnerability itself; do NOT refute "
             "those just because a value is constant.\n\n"
             "Respond with a single JSON object exactly like:\n" + _JSON_SHAPE
         )

{codejury-0.10.1 → codejury-0.10.2}/codejury/agents/verifier.py

@@ -1,9 +1,9 @@
-"""VerifierAgent -- check code against a capability's correct/anti patterns.
+"""VerifierAgent: check code against a capability's correct/anti patterns.
 
 It renders the capability into a prompt, calls the provider once per capability,
 and parses the JSON reply into Verdicts. It asks for one verdict per
 sub_capability including SECURE / NOT_PRESENT, so a report can say what was
-checked and what passed -- not only what failed.
+checked and what passed, not only what failed.
 
 Parsing is defensive: a missing or malformed reply yields no verdicts rather
 than raising, and unknown status values fall back to UNKNOWN.
@@ -75,7 +75,7 @@ def _render_capability(cap: Capability) -> str:
 def _build_prompt(path: str, content: str, cap: Capability, context: str = "") -> str:
     sub_names = ", ".join(cap.sub_capabilities) or "(none)"
     context_block = (
-        f"Related code (call sites / usages elsewhere -- for tracing where values come from, "
+        f"Related code (call sites / usages elsewhere, for tracing where values come from, "
         f"NOT under review):\n```\n{context}\n```\n\n"
         if context
         else ""
@@ -90,7 +90,7 @@ def _build_prompt(path: str, content: str, cap: Capability, context: str = "") -
         "For input-driven issues (injection, path traversal, SSRF), mark VULNERABLE only when "
         "untrusted/external input could plausibly reach the sink in the code shown. A constant, "
         "a stored data field, a value from trusted config, or a path or argument the operator "
-        "supplies (e.g. a CLI argument) is not attacker-controlled -- do not flag it.\n\n"
+        "supplies (e.g. a CLI argument) is not attacker-controlled; do not flag it.\n\n"
         "Respond with a single JSON object exactly like:\n" + _JSON_SHAPE
     )
 

{codejury-0.10.1 → codejury-0.10.2}/codejury/analysis/__init__.py

@@ -1,6 +1,6 @@
 """Static analysis for provenance (P1).
 
-The code-graph / data-flow engine that gives the verifier provenance -- whether a
+The code-graph / data-flow engine that gives the verifier provenance: whether a
 value reaching a sink is attacker-controlled, sanitized, or a trusted constant.
 This is the real fix for the taint precision floor that single-file LLM review
 cannot reach (see ROADMAP P1). Python / AST based to start.

{codejury-0.10.1 → codejury-0.10.2}/codejury/analysis/provenance.py

@@ -8,7 +8,7 @@ and literals a value derives from.
 The analysis is deliberately conservative and flow-insensitive: a name assigned
 more than once contributes the union of all its right-hand sides, so a possible
 source is never dropped (recall over precision). A value built only from literals
-is reported as ``is_constant`` -- the signal that distinguishes, for example,
+is reported as ``is_constant``, the signal that distinguishes, for example,
 SQL concatenated from constants (safe) from SQL concatenated from a parameter.
 
 This module finds where a value comes from; it does not decide what is a source
@@ -43,7 +43,7 @@ class Origin:
 
     @property
     def is_constant(self) -> bool:
-        """True when the value is built only from literals -- no param, call, attr,
+        """True when the value is built only from literals: no param, call, attr,
         free name, or unmodelled expression contributes."""
         return not (self.params or self.calls or self.attrs or self.globals_ or self.unknown)
 
@@ -65,7 +65,7 @@ def parse_function(source: str, name: str) -> ast.FunctionDef | ast.AsyncFunctio
 
 
 def find_calls(scope: ast.AST, callee: str) -> list[ast.Call]:
-    """Every call within ``scope`` whose function is named ``callee`` -- matching a
+    """Every call within ``scope`` whose function is named ``callee``, matching a
     bare name (``open``) or the final attribute (``execute`` in ``cur.execute``)."""
     return [node for node in ast.walk(scope) if isinstance(node, ast.Call) and _call_name(node) == callee]
 
@@ -97,7 +97,7 @@ def trace_value(func: ast.FunctionDef | ast.AsyncFunctionDef, expr: ast.AST) ->
         on_param=lambda n: Origin(params=frozenset({n})),
         on_global=lambda n: Origin(globals_=frozenset({n})),
         on_constant=lambda: _LITERAL,
-        on_cycle=Origin,  # assignment cycle -- no new information
+        on_cycle=Origin,  # assignment cycle, no new information
     )
 
 
@@ -182,7 +182,7 @@ def reduce_value(
     if isinstance(expr, (ast.List, ast.Tuple, ast.Set)):
         return combine([recurse(e) for e in expr.elts])
     if isinstance(expr, ast.Name):
-        if expr.id in seen:  # assignment cycle -- stop
+        if expr.id in seen:  # assignment cycle, stop
             return on_cycle()
         if expr.id in params:
             return on_param(expr.id)

{codejury-0.10.1 → codejury-0.10.2}/codejury/analysis/taint.py

@@ -6,7 +6,7 @@ sanitizer makes it SANITIZED (taint stops), a propagator carries taint through t
 the result, and a trusted origin or a literal is clean.
 
 The point is to let a later layer (P1-04) downgrade a taint finding only when the
-value is *provably* not attacker-controlled -- ``classification in SAFE`` -- so
+value is *provably* not attacker-controlled (``classification in SAFE``), so
 recall is preserved: anything uncertain is UNKNOWN or PARAM, never quietly safe.
 
 Two documented precision leans: a bare module-global name (e.g. ``STATIC_DIR``)
@@ -42,7 +42,7 @@ from codejury.resources import TAINT_FILE
 
 class Taint(str, Enum):
     EXTERNAL = "external"    # derives from an attacker source, not sanitized
-    UNKNOWN = "unknown"      # an unknown call / access -- cannot prove either way
+    UNKNOWN = "unknown"      # an unknown call / access; cannot prove either way
     PARAM = "param"          # depends on a parameter; resolve at the call site (cross-file)
     SANITIZED = "sanitized"  # had an external component, but a sanitizer neutralized it
     TRUSTED = "trusted"      # operator/config/global origin
@@ -131,14 +131,14 @@ def taint_of(
                 return Taint.TRUSTED
             if _callee_in(node, vocab.propagators) or _callee_in(node, vocab.safe_sinks):
                 return _combine([recurse(a) for a in node.args])
-            return Taint.UNKNOWN              # unknown call -- a cross-file hop may resolve it later
+            return Taint.UNKNOWN              # unknown call; a cross-file hop may resolve it later
         if isinstance(node, (ast.Attribute, ast.Subscript)):
             path = access_path(node)
             if path and _access_in(path, vocab.sources):
                 return Taint.EXTERNAL
             if path and _access_in(path, vocab.trusted):
                 return Taint.TRUSTED
-            if access_root(node) in params:   # attribute of a parameter -- resolve at the call site
+            if access_root(node) in params:   # attribute of a parameter; resolve at the call site
                 return on_param(access_root(node))
             return Taint.UNKNOWN              # unknown object attribute (e.g. self.x): not provably safe
         return Taint.UNKNOWN
@@ -150,7 +150,7 @@ def taint_of(
         combine=_combine,
         leaf=leaf,
         on_param=on_param,
-        on_global=lambda n: Taint.TRUSTED,    # free module global / builtin -- conventionally a constant
+        on_global=lambda n: Taint.TRUSTED,    # free module global / builtin; conventionally a constant
         on_constant=lambda: Taint.CONSTANT,
         on_cycle=lambda: Taint.CONSTANT,      # assignment cycle: no new information
     )
@@ -261,7 +261,7 @@ def worst_sink_taint(content: str, files: dict[str, str], vocab: TaintVocab) ->
     A "potential sink" is any call that is not a safe sink, sanitizer, or
     propagator (those are not where injection happens). Each such call's argument
     taint is classified with the cross-file resolver. A safe sink that consumes
-    tainted data (e.g. ``json.loads(request.data)``) contributes SANITIZED -- the
+    tainted data (e.g. ``json.loads(request.data)``) contributes SANITIZED: the
     data was handled safely. The worst contribution is returned.
 
     ``Taint.UNKNOWN`` when no inspectable sink is found (the artifact may still be

{codejury-0.10.1 → codejury-0.10.2}/codejury/assembly.py

@@ -1,4 +1,4 @@
-"""Assembly -- build an orchestration from a strategy name and run it over a source.
+"""Assembly: build an orchestration from a strategy name and run it over a source.
 
 Shared by the CLI and the task layer so the "which agents + which orchestrator"
 mapping and the per-artifact run loop live in one place.

{codejury-0.10.1 → codejury-0.10.2}/codejury/baseline.py

@@ -1,16 +1,16 @@
-"""Diff baseline -- report only findings new since a stored baseline report.
+"""Diff baseline: report only findings new since a stored baseline report.
 
-The keystone for PR-time noise control: run against a saved baseline report (the
-target branch's findings) and keep only the problem observations whose
+The keystone for PR-time noise control: run against a saved baseline report, the
+target branch's findings, and keep only the problem observations whose
 fingerprint is absent from the baseline, so a review shows what this change
-introduced -- not the codebase's pre-existing findings. Paired with --fail-on,
+introduced rather than the codebase's pre-existing findings. Paired with --fail-on,
 CI then gates on new issues only.
 
-The fingerprint is line-number-tolerant (lines shift between versions): it keys
+The fingerprint is line-number-tolerant because lines shift between versions: it keys
 on the capability, the kind/severity/status, the matched patterns, and the
-normalized evidence snippet -- never the line number. Only problem observations
-(Findings, VULNERABLE/PARTIAL Verdicts) are compared and dropped; SECURE /
-NOT_PRESENT verdicts and concessions are always kept.
+normalized evidence snippet, never the line number. Only problem observations,
+namely Findings and VULNERABLE/PARTIAL Verdicts, are compared and dropped; SECURE
+and NOT_PRESENT verdicts and concessions are always kept.
 """
 
 from __future__ import annotations
@@ -52,7 +52,7 @@ def filter_new(results: Results, baseline: Results) -> tuple[Results, int]:
 
 
 def _evidence_sig(o: Observation) -> str:
-    # fingerprints only the first evidence snippet -- enough to distinguish findings
+    # fingerprints only the first evidence snippet, enough to distinguish findings
     # in practice; two findings differing only in a later snippet would collide.
     evidence = getattr(o, "evidence", [])
     return " ".join(evidence[0].code.split()) if evidence and evidence[0].code else ""

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/business_logic.yaml

@@ -1,7 +1,7 @@
 id: business_logic
 name: Business Logic
 asvs_chapter: V11
-description: Correctness of stateful workflows against abuse -- ordering, races, replay, and value validation.
+description: Correctness of stateful workflows against abuse, covering ordering, races, replay, and value validation.
 
 sub_capabilities:
   state_and_sequence:

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/dependency_config.yaml

@@ -1,7 +1,7 @@
 id: dependency_config
 name: Dependencies and Configuration
 asvs_chapter: V14
-description: Software supply chain and deployment configuration -- known-vulnerable components and unsafe defaults.
+description: Software supply chain and deployment configuration, covering known-vulnerable components and unsafe defaults.
 
 sub_capabilities:
   dependencies:
@@ -50,7 +50,7 @@ sub_capabilities:
     correct_patterns:
       - id: TLS-OK-1
         description: >-
-          Leave TLS certificate verification at its secure default -- verify omitted or
+          Leave TLS certificate verification at its secure default: verify omitted or
           verify=True, the default SSL context, hostname checking on
         signals: ["verify=True", "create_default_context", "requests.get(", "requests.post("]
         why_ok: >-
@@ -63,7 +63,7 @@ sub_capabilities:
         cwe: CWE-295
         severity: HIGH
         description: >-
-          Disable TLS certificate or hostname verification -- verify=False, CERT_NONE,
+          Disable TLS certificate or hostname verification: verify=False, CERT_NONE,
           check_hostname=False, or an unverified SSL context
         signals: ["verify=False", "CERT_NONE", "check_hostname = False", "_create_unverified_context"]
         why_bad: An unverified TLS connection is open to a man-in-the-middle despite https://

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/excessive_agency.yaml

@@ -1,12 +1,12 @@
-# OWASP LLM Top 10 (2025) -- LLM06: Excessive Agency.
+# OWASP LLM Top 10 (2025), LLM06: Excessive Agency.
 id: excessive_agency
 name: Excessive Agency
 asvs_chapter: ""   # OWASP LLM06, not an ASVS chapter
 description: >-
   An LLM-driven agent acts on the world from model output. The risk is too much
   autonomy or privilege: a completion (which an attacker can steer via prompt
-  injection) triggers a high-impact or irreversible action -- delete, transfer,
-  send, run -- with no allowlist of permitted tools, no human confirmation, and
+  injection) triggers a high-impact or irreversible action, such as delete, transfer,
+  send, or run, with no allowlist of permitted tools, no human confirmation, and
   no least-privilege scoping. The fix is to gate actions: allowlist low-impact
   tools, require human approval for high-impact ones, and scope each tool's
   authority narrowly. This is about the action and its authority, not about

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/input_validation.yaml

@@ -54,7 +54,7 @@ sub_capabilities:
         cwe: CWE-78
         severity: CRITICAL
         description: >-
-          Pass interpolated input to an OS shell or subprocess -- os.system, os.popen,
+          Pass interpolated input to an OS shell or subprocess: os.system, os.popen,
           subprocess(..., shell=True), or eval/exec. A normal function, method, or
           library/API call is NOT this; flag only an actual shell or process invocation.
         signals: ["os.system(", "shell=True", "os.popen("]
@@ -80,7 +80,7 @@ sub_capabilities:
 
       - id: PATH-OK-2
         description: >-
-          Use a path that is not attacker-controlled -- a data field, a directory read from
+          Use a path that is not attacker-controlled: a data field, a directory read from
           trusted config, or a path the operator passes on the command line
         why_ok: >-
           Traversal needs an external attacker to control the path. A path stored as a
@@ -114,7 +114,7 @@ sub_capabilities:
 
       - id: SSRF-OK-2
         description: >-
-          Fetch a URL that is not attacker-controlled -- a constant, a value from trusted
+          Fetch a URL that is not attacker-controlled: a constant, a value from trusted
           config, or an operator-supplied argument
         why_ok: >-
           SSRF needs an external attacker to control the destination. A constant URL or one
@@ -130,7 +130,7 @@ sub_capabilities:
           constant URL, one from trusted config, or an operator-supplied argument.
         signals: ["requests.get(", "urllib.request.urlopen(", "httpx.", "request.args", "request.json"]
         why_bad: >-
-          The server makes the request, so attacker input reaches internal-only targets --
+          The server makes the request, so attacker input reaches internal-only targets:
           cloud metadata, localhost admin ports, internal APIs behind the firewall.
         example_bad: |
           requests.get(request.args["url"]).text
@@ -143,7 +143,7 @@ sub_capabilities:
     correct_patterns:
       - id: DESER-OK-1
         description: >-
-          Parse untrusted input with a data-only parser -- json.loads or yaml.safe_load --
+          Parse untrusted input with a data-only parser, json.loads or yaml.safe_load,
           that cannot instantiate arbitrary objects
         signals: ["json.loads", "yaml.safe_load"]
         why_ok: A data-only parser builds plain structures and has no code-execution path
@@ -153,7 +153,7 @@ sub_capabilities:
         cwe: CWE-502
         severity: CRITICAL
         description: >-
-          Deserialize externally controlled bytes with an object-constructing deserializer --
+          Deserialize externally controlled bytes with an object-constructing deserializer:
           pickle, marshal, yaml.load (unsafe Loader), or jsonpickle. NOT this: a data-only
           parser like json.loads or yaml.safe_load.
         signals: ["pickle.loads", "pickle.load(", "yaml.load(", "marshal.loads", "jsonpickle.decode"]

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/insecure_output_handling.yaml

@@ -1,11 +1,11 @@
-# OWASP LLM Top 10 (2025) -- LLM05: Improper Output Handling.
+# OWASP LLM Top 10 (2025), LLM05: Improper Output Handling.
 id: insecure_output_handling
 name: Insecure Output Handling
 asvs_chapter: ""   # OWASP LLM05, not an ASVS chapter
 description: >-
   Model output is untrusted. When a completion is passed to a downstream
   interpreter (eval/exec, a shell, SQL) or rendered as markup without validation
-  or encoding, the model -- or an attacker who steered it via prompt injection --
+  or encoding, the model, or an attacker who steered it via prompt injection,
   can reach code execution or XSS. Constrain and validate model output before use;
   encode it before rendering.
 

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/prompt_injection.yaml

@@ -1,9 +1,9 @@
-# OWASP LLM Top 10 (2025) -- LLM01: Prompt Injection.
+# OWASP LLM Top 10 (2025), LLM01: Prompt Injection.
 id: prompt_injection
 name: Prompt Injection
 asvs_chapter: ""   # OWASP LLM01, not an ASVS chapter
 description: >-
-  Untrusted text (the end user's input, or content the app retrieves -- web pages,
+  Untrusted text (the end user's input, or content the app retrieves: web pages,
   documents, tool/function results, RAG chunks) reaches the model in a position
   where the model can treat it as instructions. The fix is separation and least
   authority: keep untrusted content as data, never concatenate it into the

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/capabilities/secrets.yaml

@@ -11,13 +11,13 @@ sub_capabilities:
         signals: ["os.environ[", "os.getenv(", "secretsmanager", "vault"]
         why_ok: >-
           A variable that reads its value from the environment or a secret manager is the
-          correct pattern, not a violation -- nothing secret is written in the source.
+          correct pattern, not a violation; nothing secret is written in the source.
 
       - id: SEC-OK-2
         description: Receive a secret as a function or constructor parameter (dependency injection)
         signals: ["def __init__(self, *, api_key", "api_key: str | None = None", "api_key=api_key"]
         why_ok: >-
-          Accepting or forwarding a key through a parameter or variable is correct -- the value
+          Accepting or forwarding a key through a parameter or variable is correct; the value
           comes from the caller or the environment, not a literal in the source. Only an actual
           key string written in the code is a finding.
 
@@ -26,7 +26,7 @@ sub_capabilities:
         cwe: CWE-798
         severity: HIGH
         description: >-
-          Assign a literal credential string -- an actual key/token value written in the source.
+          Assign a literal credential string: an actual key/token value written in the source.
           A variable, parameter, env lookup, or a non-credential string (e.g. a model name or
           URL) that merely holds or forwards a value is NOT this.
         signals: ['api_key = "sk', 'token = "ghp_', 'aws_secret_access_key = "']
@@ -34,8 +34,8 @@ sub_capabilities:
         example_bad: |
           API_KEY = "sk_live_51HxQ....actual-secret-value"   # literal secret in source
         example_good: |
-          api_key = os.environ["API_KEY"]                    # read from env -- fine
-          client = Client(api_key=api_key)                   # passed as a parameter -- fine
+          api_key = os.environ["API_KEY"]                    # read from env, fine
+          client = Client(api_key=api_key)                   # passed as a parameter, fine
 
       - id: SEC-BAD-2
         cwe: CWE-259

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/golden/ag_fixed_enum_safe.yaml

@@ -1,5 +1,5 @@
 # Adversarial negative: the model chooses an action, but only among a fixed set
-# of low-impact, read-only actions -- no arbitrary dispatch, no high-impact op.
+# of low-impact, read-only actions: no arbitrary dispatch, no high-impact op.
 capability: excessive_agency
 vulnerable: false
 expected_verdict: SECURE

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/golden/ag_model_confirmed_vuln.yaml

@@ -1,5 +1,5 @@
 # Adversarial positive: looks gated, but the "confirmation" is set by the model
-# itself -- not a human -- so it is no gate at all.
+# itself, not a human, so it is no gate at all.
 capability: excessive_agency
 vulnerable: true
 expected_verdict: VULNERABLE

{codejury-0.10.1 → codejury-0.10.2}/codejury/data/golden/authn_sha256_checksum_safe.yaml

@@ -2,5 +2,5 @@ capability: authn
 vulnerable: false
 code: |
   def file_dedup_key(data: bytes) -> str:
-      # content hash for cache dedup -- NOT a password
+      # content hash for cache dedup, NOT a password
       return hashlib.sha256(data).hexdigest()