codejury 0.10.1__tar.gz → 0.10.3__tar.gz

codejury-0.10.3/PKG-INFO

@@ -0,0 +1,241 @@
+Metadata-Version: 2.4
+Name: codejury
+Version: 0.10.3
+Summary: General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data
+Author: AISecLabs
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/aiseclabs/codejury
+Project-URL: Repository, https://github.com/aiseclabs/codejury
+Keywords: security,appsec,static analysis,llm,owasp,asvs,code review
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.40; extra == "anthropic"
+Provides-Extra: openai
+Requires-Dist: openai>=1.0; extra == "openai"
+Provides-Extra: litellm
+Requires-Dist: litellm>=1.0; extra == "litellm"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: jsonschema>=4.0; extra == "dev"
+Dynamic: license-file
+
+# codejury
+
+An AI security auditor for code whose knowledge lives in versioned YAML, not in
+prompts. It reviews a diff or a whole repository against the OWASP ASVS and the
+OWASP LLM Top 10, and reports a verdict per dimension: both what is **vulnerable**
+and what is **verified safe**.
+
+The name is the idea. Code goes before a "jury" of adversarial roles, Finder,
+Challenger, and Judge, that argue and converge on a verdict.
+
+## Why it is built this way
+
+- **Knowledge is data.** Each OWASP ASVS area, and now the OWASP LLM Top 10, is a
+  YAML capability with safe patterns, anti-patterns, CWE ids, and examples. It is
+  versioned, reviewable in a PR, and editable by non-engineers, so the framework
+  core stays small.
+- **Verdicts, not just alerts.** Every capability yields `SECURE`, `VULNERABLE`,
+  `PARTIAL`, or `NOT_PRESENT`, so a report shows what was checked and passed, not
+  only what failed.
+- **Composable.** Seven orchestration strategies, three model backends, and diff,
+  repo, or function inputs are chosen per run and mix freely.
+- **Deterministic.** Providers run at temperature 0 and verdicts are cached, so
+  the same input gives the same result.
+
+## Install
+
+```bash
+pip install codejury                 # core and CLI
+pip install 'codejury[anthropic]'    # the provider you will use: anthropic, openai, or litellm
+```
+
+## Quickstart
+
+```bash
+# No API key needed: prove the pipeline runs end to end with mock layers
+codejury dry-run
+
+# A real audit of your staged changes
+export ANTHROPIC_API_KEY=sk-ant-...
+git diff | codejury audit --provider anthropic
+
+# CI gate: exit 1 if a high-severity issue is found
+git diff origin/main... | codejury audit --fail-on high -
+
+# Inline review comments on a GitHub pull request, needs GITHUB_TOKEN
+git diff origin/main... | codejury audit --github your-org/your-repo#123 -
+```
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `codejury dry-run` | Run the mock pipeline with no key, a smoke test. |
+| `codejury audit [diff]` | Audit a unified diff from a file or stdin (`-`). |
+| `codejury scan <dir>` | Audit a whole directory tree, capability by capability. |
+| `codejury run <task>` | Run a named task preset, see [Tasks](#tasks). |
+| `codejury eval` | Score the golden cases and report precision, recall, and F1, overall and per capability. |
+
+Shared flags: `--orchestrator`, `--provider {anthropic,openai,litellm}`,
+`--model`, `--format {text,markdown,json,sarif}`.
+
+```bash
+# Multi-round adversarial debate, rendered as Markdown
+git diff | codejury audit --orchestrator debate --format markdown - > report.md
+
+# Deep whole-repo scan, scoped to a few capabilities to bound the cost
+codejury scan ./myrepo --only secrets,input_validation,crypto
+```
+
+## Orchestration strategies
+
+`--orchestrator` chooses how the agents run. They mix freely with any provider,
+model, and input.
+
+| Strategy | What it does |
+|---|---|
+| `single` | One verifier pass. The default for `audit`. |
+| `pipeline` | One verifier, capability by capability. |
+| `debate` | Finder, Challenger, and Judge argue across rounds. |
+| `reflexion` | An actor and a critic iterate. |
+| `challenge` | Verify, then a recall-safe refuter drops only provably-safe taint flags. |
+| `taint` | Verify, then a static data-flow gate clears an `input_validation` finding only when provenance proves the value reaching the sink is constant, sanitized, or trusted. It uses cross-file caller and callee context and downgrades only on positive proof, so it removes false positives without dropping real findings. |
+| `adaptive` | Run the cheap single verifier first and escalate to a full debate only when it pays off: any `VULNERABLE` verdict, or a low-confidence `PARTIAL`/`UNKNOWN` one. Clean, confident files pay a single model call. |
+
+## CI and pull-request workflow
+
+- `--fail-on {critical,high,medium,low}` exits 1 when a finding at or above that
+  severity is present, so the audit gates a build.
+- `--github owner/repo#number` posts a review with inline comments on a pull
+  request, using `GITHUB_TOKEN`.
+- `--baseline <report.json>` reports only findings new since a saved report. Save
+  the target branch once, then a PR shows only what it introduced, matched by a
+  line-tolerant fingerprint so shifted code is not re-reported. Combine with
+  `--fail-on` to gate on new issues only.
+
+  ```bash
+  git checkout main && codejury scan . --format json > baseline.json
+  git checkout pr-branch && codejury scan . --baseline baseline.json --fail-on high
+  ```
+
+- `--format sarif` emits a SARIF 2.1.0 log that validates against the official
+  schema, for CI and security dashboards. Each problem with a code location
+  becomes a result carrying its capability as the rule id, the CWE, and a precise
+  location.
+- Findings in known-noise categories such as availability and DoS, rate limiting,
+  and memory safety outside C and C++ are dropped by versioned rules in
+  `codejury/data/suppressions.yaml`. Disable with `--no-suppress`.
+
+## Determinism and caching
+
+Providers query at temperature 0, and `audit` and `scan` cache each verdict on a
+hash of the normalized code, the in-scope capability fingerprints, and the
+orchestration. Re-auditing unchanged code returns the recorded verdicts without
+re-querying the model. Editing a capability YAML changes its fingerprint and
+invalidates affected entries. Pass `--no-cache` to always re-query.
+
+## Configuration
+
+Provider keys are read from the environment. codejury does **not** auto-load
+`.env`; copy `.env.example` and `source` it.
+
+| Variable | Used by |
+|---|---|
+| `ANTHROPIC_API_KEY` | `--provider anthropic` |
+| `OPENAI_API_KEY` | `--provider openai` |
+| `CODEJURY_API_BASE`, `CODEJURY_API_KEY`, `CODEJURY_MODEL` | defaults for `--api-base`, `--api-key`, and `--model`, for any provider |
+
+The `CODEJURY_*` variables make a LiteLLM proxy a one-liner:
+
+```bash
+# with CODEJURY_API_BASE, CODEJURY_API_KEY, CODEJURY_MODEL in a sourced .env
+git diff | codejury audit --provider litellm -
+```
+
+## Tasks
+
+A task is a named preset of capabilities, orchestrator, provider, and model. It
+lives in a YAML file. The API key always stays in the environment.
+
+```yaml
+# mytasks/proxy_scan.yaml  ->  codejury run proxy_scan --tasks mytasks
+name: proxy_scan
+orchestrator: debate
+provider: litellm
+model: your-alias
+api_base: https://litellm.example.com   # key comes from CODEJURY_API_KEY
+capabilities: [authn, input_validation, secrets]   # omit to check all
+```
+
+## Capabilities
+
+The library covers all 11 OWASP ASVS areas plus a growing set of OWASP LLM Top 10
+capabilities, one YAML each under `codejury/data/capabilities/`. These ids are
+what `--only` and a task's `capabilities:` accept:
+
+`authn`, `authz`, `session`, `input_validation`, `output_encoding`, `crypto`,
+`secrets`, `data_protection`, `error_logging`, `business_logic`,
+`dependency_config`, `prompt_injection`, `insecure_output_handling`,
+`excessive_agency`.
+
+To tune for your codebase, edit these files, adding patterns or sharpening
+wording. No code change is needed.
+
+## eval
+
+`codejury eval` scores the golden cases and reports a confusion matrix with
+precision, recall, and F1, overall and per capability. It takes `--dataset <dir>`
+for the golden directory, `--split <name>` to score only cases tagged with that
+`split:` such as a held-out set, `--orchestrator` to measure any strategy, and
+`--format {text,json}`. The JSON report is a stable, documented schema.
+
+## Architecture
+
+```
+Layer 5  Task            preset: source, capabilities, orchestrator, agents
+Layer 4  Capability      YAML domain knowledge: authn, authz, prompt_injection, ...
+Layer 3  Orchestrator    strategy: single, pipeline, debate, reflexion, challenge, taint, adaptive
+         Source          input: diff, repo, function
+         Agent           role: finder, challenger, judge, verifier, refuter
+Layer 2  Provider        model backend: anthropic, openai, litellm, mock
+Layer 1  Infrastructure  cross-cutting utilities: json parsing, verdict cache, retry
+         Analysis        provenance and taint code-graph engine
+```
+
+Layers talk only through typed data, and each is an abstract base class plus
+implementations, so the axes of task, orchestration, model, and input compose
+independently.
+
+## Limitations
+
+- **Prompts are a first pass.** Expect false positives and misses on real code.
+  Tune by editing the capability YAML and growing the golden set, and measure the
+  effect with `codejury eval`.
+- **Local-pattern checks are sharper than data-flow ones.** A capability judged
+  from one spot, such as weak crypto or a hardcoded secret, is reliable. Taint
+  classes such as path traversal and SSRF over-flag in single-file review because
+  the verifier cannot see whether a value is attacker-controlled. `--orchestrator
+  taint` adds a static provenance gate that clears findings it can prove safe and
+  is recall-safe, but it is shallow on real code where the value flows through
+  object or module attributes. Decisive taint precision needs a deeper code
+  graph, which is in progress.
+- **`scan` cost scales with files times capabilities.** It is a periodic deep
+  audit, not a quick check, so scope it with `--only`. Day to day, audit the diff.
+
+## Development
+
+```bash
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```

codejury-0.10.3/README.md

@@ -0,0 +1,211 @@
+# codejury
+
+An AI security auditor for code whose knowledge lives in versioned YAML, not in
+prompts. It reviews a diff or a whole repository against the OWASP ASVS and the
+OWASP LLM Top 10, and reports a verdict per dimension: both what is **vulnerable**
+and what is **verified safe**.
+
+The name is the idea. Code goes before a "jury" of adversarial roles, Finder,
+Challenger, and Judge, that argue and converge on a verdict.
+
+## Why it is built this way
+
+- **Knowledge is data.** Each OWASP ASVS area, and now the OWASP LLM Top 10, is a
+  YAML capability with safe patterns, anti-patterns, CWE ids, and examples. It is
+  versioned, reviewable in a PR, and editable by non-engineers, so the framework
+  core stays small.
+- **Verdicts, not just alerts.** Every capability yields `SECURE`, `VULNERABLE`,
+  `PARTIAL`, or `NOT_PRESENT`, so a report shows what was checked and passed, not
+  only what failed.
+- **Composable.** Seven orchestration strategies, three model backends, and diff,
+  repo, or function inputs are chosen per run and mix freely.
+- **Deterministic.** Providers run at temperature 0 and verdicts are cached, so
+  the same input gives the same result.
+
+## Install
+
+```bash
+pip install codejury                 # core and CLI
+pip install 'codejury[anthropic]'    # the provider you will use: anthropic, openai, or litellm
+```
+
+## Quickstart
+
+```bash
+# No API key needed: prove the pipeline runs end to end with mock layers
+codejury dry-run
+
+# A real audit of your staged changes
+export ANTHROPIC_API_KEY=sk-ant-...
+git diff | codejury audit --provider anthropic
+
+# CI gate: exit 1 if a high-severity issue is found
+git diff origin/main... | codejury audit --fail-on high -
+
+# Inline review comments on a GitHub pull request, needs GITHUB_TOKEN
+git diff origin/main... | codejury audit --github your-org/your-repo#123 -
+```
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `codejury dry-run` | Run the mock pipeline with no key, a smoke test. |
+| `codejury audit [diff]` | Audit a unified diff from a file or stdin (`-`). |
+| `codejury scan <dir>` | Audit a whole directory tree, capability by capability. |
+| `codejury run <task>` | Run a named task preset, see [Tasks](#tasks). |
+| `codejury eval` | Score the golden cases and report precision, recall, and F1, overall and per capability. |
+
+Shared flags: `--orchestrator`, `--provider {anthropic,openai,litellm}`,
+`--model`, `--format {text,markdown,json,sarif}`.
+
+```bash
+# Multi-round adversarial debate, rendered as Markdown
+git diff | codejury audit --orchestrator debate --format markdown - > report.md
+
+# Deep whole-repo scan, scoped to a few capabilities to bound the cost
+codejury scan ./myrepo --only secrets,input_validation,crypto
+```
+
+## Orchestration strategies
+
+`--orchestrator` chooses how the agents run. They mix freely with any provider,
+model, and input.
+
+| Strategy | What it does |
+|---|---|
+| `single` | One verifier pass. The default for `audit`. |
+| `pipeline` | One verifier, capability by capability. |
+| `debate` | Finder, Challenger, and Judge argue across rounds. |
+| `reflexion` | An actor and a critic iterate. |
+| `challenge` | Verify, then a recall-safe refuter drops only provably-safe taint flags. |
+| `taint` | Verify, then a static data-flow gate clears an `input_validation` finding only when provenance proves the value reaching the sink is constant, sanitized, or trusted. It uses cross-file caller and callee context and downgrades only on positive proof, so it removes false positives without dropping real findings. |
+| `adaptive` | Run the cheap single verifier first and escalate to a full debate only when it pays off: any `VULNERABLE` verdict, or a low-confidence `PARTIAL`/`UNKNOWN` one. Clean, confident files pay a single model call. |
+
+## CI and pull-request workflow
+
+- `--fail-on {critical,high,medium,low}` exits 1 when a finding at or above that
+  severity is present, so the audit gates a build.
+- `--github owner/repo#number` posts a review with inline comments on a pull
+  request, using `GITHUB_TOKEN`.
+- `--baseline <report.json>` reports only findings new since a saved report. Save
+  the target branch once, then a PR shows only what it introduced, matched by a
+  line-tolerant fingerprint so shifted code is not re-reported. Combine with
+  `--fail-on` to gate on new issues only.
+
+  ```bash
+  git checkout main && codejury scan . --format json > baseline.json
+  git checkout pr-branch && codejury scan . --baseline baseline.json --fail-on high
+  ```
+
+- `--format sarif` emits a SARIF 2.1.0 log that validates against the official
+  schema, for CI and security dashboards. Each problem with a code location
+  becomes a result carrying its capability as the rule id, the CWE, and a precise
+  location.
+- Findings in known-noise categories such as availability and DoS, rate limiting,
+  and memory safety outside C and C++ are dropped by versioned rules in
+  `codejury/data/suppressions.yaml`. Disable with `--no-suppress`.
+
+## Determinism and caching
+
+Providers query at temperature 0, and `audit` and `scan` cache each verdict on a
+hash of the normalized code, the in-scope capability fingerprints, and the
+orchestration. Re-auditing unchanged code returns the recorded verdicts without
+re-querying the model. Editing a capability YAML changes its fingerprint and
+invalidates affected entries. Pass `--no-cache` to always re-query.
+
+## Configuration
+
+Provider keys are read from the environment. codejury does **not** auto-load
+`.env`; copy `.env.example` and `source` it.
+
+| Variable | Used by |
+|---|---|
+| `ANTHROPIC_API_KEY` | `--provider anthropic` |
+| `OPENAI_API_KEY` | `--provider openai` |
+| `CODEJURY_API_BASE`, `CODEJURY_API_KEY`, `CODEJURY_MODEL` | defaults for `--api-base`, `--api-key`, and `--model`, for any provider |
+
+The `CODEJURY_*` variables make a LiteLLM proxy a one-liner:
+
+```bash
+# with CODEJURY_API_BASE, CODEJURY_API_KEY, CODEJURY_MODEL in a sourced .env
+git diff | codejury audit --provider litellm -
+```
+
+## Tasks
+
+A task is a named preset of capabilities, orchestrator, provider, and model. It
+lives in a YAML file. The API key always stays in the environment.
+
+```yaml
+# mytasks/proxy_scan.yaml  ->  codejury run proxy_scan --tasks mytasks
+name: proxy_scan
+orchestrator: debate
+provider: litellm
+model: your-alias
+api_base: https://litellm.example.com   # key comes from CODEJURY_API_KEY
+capabilities: [authn, input_validation, secrets]   # omit to check all
+```
+
+## Capabilities
+
+The library covers all 11 OWASP ASVS areas plus a growing set of OWASP LLM Top 10
+capabilities, one YAML each under `codejury/data/capabilities/`. These ids are
+what `--only` and a task's `capabilities:` accept:
+
+`authn`, `authz`, `session`, `input_validation`, `output_encoding`, `crypto`,
+`secrets`, `data_protection`, `error_logging`, `business_logic`,
+`dependency_config`, `prompt_injection`, `insecure_output_handling`,
+`excessive_agency`.
+
+To tune for your codebase, edit these files, adding patterns or sharpening
+wording. No code change is needed.
+
+## eval
+
+`codejury eval` scores the golden cases and reports a confusion matrix with
+precision, recall, and F1, overall and per capability. It takes `--dataset <dir>`
+for the golden directory, `--split <name>` to score only cases tagged with that
+`split:` such as a held-out set, `--orchestrator` to measure any strategy, and
+`--format {text,json}`. The JSON report is a stable, documented schema.
+
+## Architecture
+
+```
+Layer 5  Task            preset: source, capabilities, orchestrator, agents
+Layer 4  Capability      YAML domain knowledge: authn, authz, prompt_injection, ...
+Layer 3  Orchestrator    strategy: single, pipeline, debate, reflexion, challenge, taint, adaptive
+         Source          input: diff, repo, function
+         Agent           role: finder, challenger, judge, verifier, refuter
+Layer 2  Provider        model backend: anthropic, openai, litellm, mock
+Layer 1  Infrastructure  cross-cutting utilities: json parsing, verdict cache, retry
+         Analysis        provenance and taint code-graph engine
+```
+
+Layers talk only through typed data, and each is an abstract base class plus
+implementations, so the axes of task, orchestration, model, and input compose
+independently.
+
+## Limitations
+
+- **Prompts are a first pass.** Expect false positives and misses on real code.
+  Tune by editing the capability YAML and growing the golden set, and measure the
+  effect with `codejury eval`.
+- **Local-pattern checks are sharper than data-flow ones.** A capability judged
+  from one spot, such as weak crypto or a hardcoded secret, is reliable. Taint
+  classes such as path traversal and SSRF over-flag in single-file review because
+  the verifier cannot see whether a value is attacker-controlled. `--orchestrator
+  taint` adds a static provenance gate that clears findings it can prove safe and
+  is recall-safe, but it is shallow on real code where the value flows through
+  object or module attributes. Decisive taint precision needs a deeper code
+  graph, which is in progress.
+- **`scan` cost scales with files times capabilities.** It is a periodic deep
+  audit, not a quick check, so scope it with `--only`. Day to day, audit the diff.
+
+## Development
+
+```bash
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```

{codejury-0.10.1 → codejury-0.10.3}/codejury/__init__.py

@@ -1,6 +1,6 @@
-"""codejury -- a general-purpose Application Security AI audit framework.
+"""codejury: a general-purpose Application Security AI audit framework.
 
-Five layers: Task / (Capability + Orchestrator + Source + Agent) / Provider / Infrastructure.
+Five layers: Task, then Capability plus Orchestrator plus Source plus Agent, then Provider, then Infrastructure.
 Domain knowledge lives in YAML capability files as a first-class citizen,
 aligned with OWASP ASVS.
 """

{codejury-0.10.1 → codejury-0.10.3}/codejury/agents/__init__.py

@@ -1,4 +1,4 @@
-"""codejury.agents -- the audit roles (finder / challenger / judge / verifier).
+"""codejury.agents: the audit roles (finder / challenger / judge / verifier).
 
 An agent reads an AnalysisContext and emits observations. It talks to a model
 only through a Provider, never a vendor SDK, so the role logic stays independent

{codejury-0.10.1 → codejury-0.10.3}/codejury/agents/debate.py

@@ -35,8 +35,8 @@ _FINDING_SHAPE = (
 
 _DEEP_LENS = (
     "Look past surface patterns for the deepest flaw:\n"
-    "- Trust anchors: what does this code trust to authenticate or authorize -- a key, token, header, "
-    "signature, role, or caller -- and who controls that value? If the attacker supplies what is used to "
+    "- Trust anchors: what does this code trust to authenticate or authorize, such as a key, token, header, "
+    "signature, role, or caller, and who controls that value? If the attacker supplies what is used to "
     "verify them (e.g. their own public key, an unconfigured key that disables verification), passing the "
     "check proves nothing.\n"
     "- Order of operations: is an external, irreversible, or privileged action performed before the local "
@@ -101,7 +101,7 @@ class ChallengerAgent(_DebateAgent):
     def run(self, ctx: AnalysisContext) -> list[Observation]:
         parts = [
             "Challenge the findings below. For each one you believe is a false positive, write a rebuttal. "
-            "Add new_findings for any real issue that was missed -- especially a deeper flaw the finder "
+            "Add new_findings for any real issue that was missed, especially a deeper flaw the finder "
             "stopped short of.",
             _DEEP_LENS,
             _code(ctx.artifact),

{codejury-0.10.1 → codejury-0.10.3}/codejury/agents/mock.py

@@ -1,4 +1,4 @@
-"""MockAgent -- a minimal Agent for the dry-run and tests.
+"""MockAgent: a minimal Agent for the dry-run and tests.
 
 It really calls the provider (so the dry-run exercises the agent -> provider
 path), then emits one Verdict per in-scope capability, parking the model's reply

{codejury-0.10.1 → codejury-0.10.3}/codejury/agents/parsing.py

@@ -1,7 +1,7 @@
 """Shared coercion from loosely-typed model JSON into domain values.
 
 Agents parse model output that may omit, mistype, or invent fields. These
-helpers coerce defensively -- they never raise on bad input, they fall back.
+helpers coerce defensively: they never raise on bad input, they fall back.
 """
 
 import math

{codejury-0.10.1 → codejury-0.10.3}/codejury/agents/refuter.py

@@ -1,8 +1,8 @@
-"""RefuterAgent -- a skeptic that tries to dismiss flagged verdicts as false positives.
+"""RefuterAgent: a skeptic that tries to dismiss flagged verdicts as false positives.
 
 Used by the challenge orchestrator: the verifier flags issues, then the refuter
 gets the code plus the VULNERABLE verdicts (via ``ctx.history``) and argues which
-are false positives -- e.g. a value that is not actually attacker-controlled or a
+are false positives, e.g. a value that is not actually attacker-controlled or a
 sink that is not reachable. It returns a Concession per verdict it refutes.
 
 This is the cheap, focused alternative to a full debate: only flagged verdicts
@@ -53,7 +53,7 @@ class RefuterAgent(Agent):
             "is not attacker-controlled: a stored data field, or traced (here or in the call sites) to "
             "a trusted, config, or operator-supplied source. If its origin is not shown or could "
             "plausibly be external input, do NOT refute. For other issue types (hardcoded secrets, "
-            "weak crypto, ...), a literal value is often the vulnerability itself -- do NOT refute "
+            "weak crypto, ...), a literal value is often the vulnerability itself; do NOT refute "
             "those just because a value is constant.\n\n"
             "Respond with a single JSON object exactly like:\n" + _JSON_SHAPE
         )

{codejury-0.10.1 → codejury-0.10.3}/codejury/agents/verifier.py

@@ -1,9 +1,9 @@
-"""VerifierAgent -- check code against a capability's correct/anti patterns.
+"""VerifierAgent: check code against a capability's correct/anti patterns.
 
 It renders the capability into a prompt, calls the provider once per capability,
 and parses the JSON reply into Verdicts. It asks for one verdict per
 sub_capability including SECURE / NOT_PRESENT, so a report can say what was
-checked and what passed -- not only what failed.
+checked and what passed, not only what failed.
 
 Parsing is defensive: a missing or malformed reply yields no verdicts rather
 than raising, and unknown status values fall back to UNKNOWN.
@@ -75,7 +75,7 @@ def _render_capability(cap: Capability) -> str:
 def _build_prompt(path: str, content: str, cap: Capability, context: str = "") -> str:
     sub_names = ", ".join(cap.sub_capabilities) or "(none)"
     context_block = (
-        f"Related code (call sites / usages elsewhere -- for tracing where values come from, "
+        f"Related code (call sites / usages elsewhere, for tracing where values come from, "
         f"NOT under review):\n```\n{context}\n```\n\n"
         if context
         else ""
@@ -90,7 +90,7 @@ def _build_prompt(path: str, content: str, cap: Capability, context: str = "") -
         "For input-driven issues (injection, path traversal, SSRF), mark VULNERABLE only when "
         "untrusted/external input could plausibly reach the sink in the code shown. A constant, "
         "a stored data field, a value from trusted config, or a path or argument the operator "
-        "supplies (e.g. a CLI argument) is not attacker-controlled -- do not flag it.\n\n"
+        "supplies (e.g. a CLI argument) is not attacker-controlled; do not flag it.\n\n"
         "Respond with a single JSON object exactly like:\n" + _JSON_SHAPE
     )
 

{codejury-0.10.1 → codejury-0.10.3}/codejury/analysis/__init__.py

@@ -1,6 +1,6 @@
 """Static analysis for provenance (P1).
 
-The code-graph / data-flow engine that gives the verifier provenance -- whether a
+The code-graph / data-flow engine that gives the verifier provenance: whether a
 value reaching a sink is attacker-controlled, sanitized, or a trusted constant.
 This is the real fix for the taint precision floor that single-file LLM review
 cannot reach (see ROADMAP P1). Python / AST based to start.

{codejury-0.10.1 → codejury-0.10.3}/codejury/analysis/provenance.py

@@ -8,7 +8,7 @@ and literals a value derives from.
 The analysis is deliberately conservative and flow-insensitive: a name assigned
 more than once contributes the union of all its right-hand sides, so a possible
 source is never dropped (recall over precision). A value built only from literals
-is reported as ``is_constant`` -- the signal that distinguishes, for example,
+is reported as ``is_constant``, the signal that distinguishes, for example,
 SQL concatenated from constants (safe) from SQL concatenated from a parameter.
 
 This module finds where a value comes from; it does not decide what is a source
@@ -43,7 +43,7 @@ class Origin:
 
     @property
     def is_constant(self) -> bool:
-        """True when the value is built only from literals -- no param, call, attr,
+        """True when the value is built only from literals: no param, call, attr,
         free name, or unmodelled expression contributes."""
         return not (self.params or self.calls or self.attrs or self.globals_ or self.unknown)
 
@@ -65,7 +65,7 @@ def parse_function(source: str, name: str) -> ast.FunctionDef | ast.AsyncFunctio
 
 
 def find_calls(scope: ast.AST, callee: str) -> list[ast.Call]:
-    """Every call within ``scope`` whose function is named ``callee`` -- matching a
+    """Every call within ``scope`` whose function is named ``callee``, matching a
     bare name (``open``) or the final attribute (``execute`` in ``cur.execute``)."""
     return [node for node in ast.walk(scope) if isinstance(node, ast.Call) and _call_name(node) == callee]
 
@@ -97,7 +97,7 @@ def trace_value(func: ast.FunctionDef | ast.AsyncFunctionDef, expr: ast.AST) ->
         on_param=lambda n: Origin(params=frozenset({n})),
         on_global=lambda n: Origin(globals_=frozenset({n})),
         on_constant=lambda: _LITERAL,
-        on_cycle=Origin,  # assignment cycle -- no new information
+        on_cycle=Origin,  # assignment cycle, no new information
     )
 
 
@@ -182,7 +182,7 @@ def reduce_value(
     if isinstance(expr, (ast.List, ast.Tuple, ast.Set)):
         return combine([recurse(e) for e in expr.elts])
     if isinstance(expr, ast.Name):
-        if expr.id in seen:  # assignment cycle -- stop
+        if expr.id in seen:  # assignment cycle, stop
             return on_cycle()
         if expr.id in params:
             return on_param(expr.id)

{codejury-0.10.1 → codejury-0.10.3}/codejury/analysis/taint.py

@@ -6,7 +6,7 @@ sanitizer makes it SANITIZED (taint stops), a propagator carries taint through t
 the result, and a trusted origin or a literal is clean.
 
 The point is to let a later layer (P1-04) downgrade a taint finding only when the
-value is *provably* not attacker-controlled -- ``classification in SAFE`` -- so
+value is *provably* not attacker-controlled (``classification in SAFE``), so
 recall is preserved: anything uncertain is UNKNOWN or PARAM, never quietly safe.
 
 Two documented precision leans: a bare module-global name (e.g. ``STATIC_DIR``)
@@ -42,7 +42,7 @@ from codejury.resources import TAINT_FILE
 
 class Taint(str, Enum):
     EXTERNAL = "external"    # derives from an attacker source, not sanitized
-    UNKNOWN = "unknown"      # an unknown call / access -- cannot prove either way
+    UNKNOWN = "unknown"      # an unknown call / access; cannot prove either way
     PARAM = "param"          # depends on a parameter; resolve at the call site (cross-file)
     SANITIZED = "sanitized"  # had an external component, but a sanitizer neutralized it
     TRUSTED = "trusted"      # operator/config/global origin
@@ -131,14 +131,14 @@ def taint_of(
                 return Taint.TRUSTED
             if _callee_in(node, vocab.propagators) or _callee_in(node, vocab.safe_sinks):
                 return _combine([recurse(a) for a in node.args])
-            return Taint.UNKNOWN              # unknown call -- a cross-file hop may resolve it later
+            return Taint.UNKNOWN              # unknown call; a cross-file hop may resolve it later
         if isinstance(node, (ast.Attribute, ast.Subscript)):
             path = access_path(node)
             if path and _access_in(path, vocab.sources):
                 return Taint.EXTERNAL
             if path and _access_in(path, vocab.trusted):
                 return Taint.TRUSTED
-            if access_root(node) in params:   # attribute of a parameter -- resolve at the call site
+            if access_root(node) in params:   # attribute of a parameter; resolve at the call site
                 return on_param(access_root(node))
             return Taint.UNKNOWN              # unknown object attribute (e.g. self.x): not provably safe
         return Taint.UNKNOWN
@@ -150,7 +150,7 @@ def taint_of(
         combine=_combine,
         leaf=leaf,
         on_param=on_param,
-        on_global=lambda n: Taint.TRUSTED,    # free module global / builtin -- conventionally a constant
+        on_global=lambda n: Taint.TRUSTED,    # free module global / builtin; conventionally a constant
         on_constant=lambda: Taint.CONSTANT,
         on_cycle=lambda: Taint.CONSTANT,      # assignment cycle: no new information
     )
@@ -261,7 +261,7 @@ def worst_sink_taint(content: str, files: dict[str, str], vocab: TaintVocab) ->
     A "potential sink" is any call that is not a safe sink, sanitizer, or
     propagator (those are not where injection happens). Each such call's argument
     taint is classified with the cross-file resolver. A safe sink that consumes
-    tainted data (e.g. ``json.loads(request.data)``) contributes SANITIZED -- the
+    tainted data (e.g. ``json.loads(request.data)``) contributes SANITIZED: the
     data was handled safely. The worst contribution is returned.
 
     ``Taint.UNKNOWN`` when no inspectable sink is found (the artifact may still be