codejury 0.10.6__tar.gz → 0.11.0__tar.gz

{codejury-0.10.6 → codejury-0.11.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.10.6
-Summary: General-purpose Application Security AI audit framework: five-layer architecture, capabilities as first-class data
+Version: 0.11.0
+Summary: General-purpose Application Security AI audit framework: skills as first-class data, whole-repo full-review, attack paths with PoC verification
 Author: AISecLabs
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/aiseclabs/codejury

{codejury-0.10.6 → codejury-0.11.0}/codejury/__init__.py

@@ -1,8 +1,9 @@
 """codejury: a general-purpose Application Security AI audit framework.
 
-Five layers: Task, then Capability plus Orchestrator plus Source plus Agent, then Provider, then Infrastructure.
-Domain knowledge lives in YAML capability files as a first-class citizen,
-aligned with OWASP ASVS.
+Layers: Task, then Skill plus Selector plus Orchestrator plus Source plus Agent,
+then Provider, then Infrastructure. Domain knowledge lives in skill directories
+(a manifest plus a prose playbook) as a first-class citizen, aligned with OWASP
+ASVS and the OWASP LLM Top 10.
 """
 
 from importlib.metadata import PackageNotFoundError, version

{codejury-0.10.6 → codejury-0.11.0}/codejury/agents/debate.py

@@ -1,6 +1,6 @@
 """Finder / Challenger / Judge agents for the debate orchestrator.
 
-Each reads the artifact, the capability hints, and the accumulated history
+Each reads the artifact, the skill playbooks, and the accumulated history
 (prior findings and rebuttals) from the context, calls the provider once, and
 maps its JSON reply onto observations:
 
@@ -17,9 +17,9 @@ from __future__ import annotations
 from codejury.agents.base import Agent
 from codejury.agents.parsing import one_of, str_list, to_evidence, to_float
 from codejury.domain.artifact import CodeArtifact
-from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
 from codejury.domain.observation import Concession, Finding, Observation, Severity
+from codejury.domain.skill import Skill
 from codejury.infrastructure.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
 
@@ -77,7 +77,7 @@ class FinderAgent(_DebateAgent):
     )
 
     def run(self, ctx: AnalysisContext) -> list[Observation]:
-        parts = ["Review the code for security vulnerabilities.", _hints(ctx.capabilities), _DEEP_LENS, _code(ctx.artifact)]
+        parts = ["Review the code for security vulnerabilities.", _hints(ctx), _DEEP_LENS, _code(ctx.artifact)]
         if ctx.round_num > 1 and ctx.history:
             parts.append(_render_history(ctx.history))
             parts.append("Concede findings the rebuttals refute, keep the valid ones, and add any you missed.")
@@ -140,14 +140,13 @@ def _code(artifact: CodeArtifact) -> str:
     return f"Code under review ({artifact.path}):\n```\n{artifact.content}\n```"
 
 
-def _hints(capabilities: list[Capability]) -> str:
-    lines = []
-    for cap in capabilities:
-        for sub_name, sub in cap.sub_capabilities.items():
-            for ap in sub.anti_patterns:
-                tag = f"{ap.cwe} {ap.severity}" if ap.cwe else ap.severity
-                lines.append(f"- {cap.id}.{sub_name} [{tag}]: {ap.description}")
-    return "Look especially for:\n" + "\n".join(lines) if lines else ""
+def _hints(ctx: AnalysisContext) -> str:
+    """What to look for: the skill playbooks in scope."""
+    blocks = []
+    for s in ctx.skills:
+        standard = f" ({s.standard})" if s.standard else ""
+        blocks.append(f"## {s.id}: {s.name}{standard}\n{s.instructions}")
+    return "Apply these security skills:\n\n" + "\n\n".join(blocks) if blocks else ""
 
 
 def _render_history(history: list[Observation]) -> str:

{codejury-0.10.6 → codejury-0.11.0}/codejury/agents/mock.py

@@ -1,8 +1,8 @@
 """MockAgent: a minimal Agent for the dry-run and tests.
 
 It really calls the provider (so the dry-run exercises the agent -> provider
-path), then emits one Verdict per in-scope capability, parking the model's reply
-in ``reasoning``. It does no real parsing or judgement; ``VerifierAgent`` does.
+path), then emits one Verdict per in-scope skill, parking the model's reply in
+``reasoning``. It does no real parsing or judgement; ``SkillRunner`` does.
 """
 
 from __future__ import annotations
@@ -28,10 +28,10 @@ class MockAgent(Agent):
         )
         return [
             Verdict(
-                capability=cap.id,
+                capability=skill.id,
                 produced_by=self._role,
                 status="UNKNOWN",
                 reasoning=result.text,
             )
-            for cap in ctx.capabilities
+            for skill in ctx.skills
         ]

codejury-0.11.0/codejury/agents/skill_runner.py

@@ -0,0 +1,121 @@
+"""SkillRunner: execute a skill's playbook against a piece of code.
+
+The agent that rules code against a skill. It hands the model the skill's
+SKILL.md playbook verbatim and asks it to rule on each dimension the playbook
+names. One provider call per skill.
+
+Parsing is defensive: a missing or malformed reply yields no verdicts rather
+than raising, and unknown status values fall back to UNKNOWN. Invariant 3 is
+enforced here: a problem verdict (VULNERABLE / PARTIAL) with no code location is
+not reportable, so it is dropped.
+"""
+
+from __future__ import annotations
+
+from typing import get_args
+
+from codejury.agents.base import Agent
+from codejury.agents.parsing import one_of, to_evidence, to_float
+from codejury.domain.context import AnalysisContext
+from codejury.domain.observation import Observation, Verdict, VerdictStatus
+from codejury.domain.skill import Skill
+from codejury.infrastructure.json_parse import extract_json_object
+from codejury.providers.base import Message, Provider
+
+_VALID_STATUS = set(get_args(VerdictStatus))
+_PROBLEM = {"VULNERABLE", "PARTIAL"}  # statuses that require a code location
+
+_SYSTEM = (
+    "You are a security reviewer executing one specific check skill. Follow the "
+    "skill's playbook exactly, ruling on what is fine as well as what is wrong. "
+    "Respond with a single JSON object and nothing else."
+)
+
+_JSON_SHAPE = (
+    '{"verdicts": [{"dimension": "...", '
+    '"status": "SECURE|VULNERABLE|PARTIAL|NOT_PRESENT|UNKNOWN", "reasoning": "...", '
+    '"evidence": [{"file": "path", "line": 0, "code": "..."}], '
+    '"cwe": "CWE-...", "confidence": 0.0}]}'
+)
+
+
+class SkillRunner(Agent):
+    def __init__(self, *, provider: Provider, model: str, max_tokens: int = 2048) -> None:
+        self._provider = provider
+        self._model = model
+        self._max_tokens = max_tokens
+
+    def run(self, ctx: AnalysisContext) -> list[Observation]:
+        out: list[Observation] = []
+        for skill in ctx.skills:
+            prompt = _build_prompt(ctx.artifact.path, ctx.artifact.content, skill, ctx.artifact.context)
+            result = self._provider.complete(
+                system=_SYSTEM,
+                messages=[Message(role="user", content=prompt)],
+                model=self._model,
+                max_tokens=self._max_tokens,
+            )
+            out.extend(_parse_verdicts(result.text, skill))
+        return out
+
+
+def _render_skill(skill: Skill) -> str:
+    header = f"Skill: {skill.id} ({skill.name})"
+    if skill.standard:
+        header += f"\nStandard: {skill.standard}"
+    return f"{header}\n\n{skill.instructions}"
+
+
+def _build_prompt(path: str, content: str, skill: Skill, context: str = "") -> str:
+    context_block = (
+        f"Related code (call sites / usages elsewhere, for tracing where values come from, "
+        f"NOT under review):\n```\n{context}\n```\n\n"
+        if context
+        else ""
+    )
+    return (
+        "Apply the security check skill below to the code.\n\n"
+        f"{_render_skill(skill)}\n\n"
+        f"Code under review ({path}):\n```\n{content}\n```\n\n"
+        f"{context_block}"
+        "Output one verdict per dimension the skill covers, even when SECURE or "
+        "NOT_PRESENT, so the report says what was checked and what passed. Cite an "
+        "evidence file and line for every VULNERABLE or PARTIAL verdict.\n"
+        "For input-driven issues (injection, path traversal, SSRF), mark VULNERABLE only when "
+        "untrusted/external input could plausibly reach the sink in the code shown. A constant, "
+        "a stored data field, a value from trusted config, or a path or argument the operator "
+        "supplies (e.g. a CLI argument) is not attacker-controlled; do not flag it.\n\n"
+        "Respond with a single JSON object exactly like:\n" + _JSON_SHAPE
+    )
+
+
+def _has_location(evidence: list) -> bool:
+    return any(e.line is not None for e in evidence)
+
+
+def _parse_verdicts(text: str, skill: Skill) -> list[Verdict]:
+    obj = extract_json_object(text)
+    if not obj:
+        return []
+    out: list[Verdict] = []
+    for v in obj.get("verdicts", []):
+        if not isinstance(v, dict):
+            continue
+        status = one_of(v.get("status"), _VALID_STATUS, "UNKNOWN")
+        evidence = to_evidence(v.get("evidence"))
+        if status in _PROBLEM and not _has_location(evidence):
+            continue  # invariant 3: a problem with no code location is not reportable
+        dimension = str(v.get("dimension", "")).strip()
+        cwe = str(v.get("cwe", "")).strip() or skill.cwe
+        out.append(
+            Verdict(
+                capability=f"{skill.id}.{dimension}" if dimension else skill.id,
+                produced_by="skill",
+                status=status,
+                reasoning=str(v.get("reasoning", "")),
+                cwe=cwe,
+                evidence=evidence,
+                confidence=to_float(v.get("confidence"), 0.5),
+            )
+        )
+    return out

codejury-0.11.0/codejury/analysis/attack_path.py

@@ -0,0 +1,110 @@
+"""Suspected attack-path synthesis (P6-03).
+
+Turns a flagged problem into a source -> sink path, anchoring each hop to a real
+code location: the external-input expression (source) and the dangerous operation
+the finding already cites (sink). When the source is in the cross-file caller
+(``artifact.context``), the path crosses files.
+
+These paths are **suspected**, not proven: they are stitched from the taint
+vocabulary and the finding's evidence, not from a full data-flow graph, so they
+carry ``attack_path_proven=False``. A path is only ever emitted when a real
+external-input anchor exists; nothing is narrated without a code location (P6-05
+upgrades suspected to proven via the deeper graph).
+"""
+
+from __future__ import annotations
+
+import ast
+import dataclasses
+
+from codejury.analysis.provenance import access_path
+from codejury.analysis.taint import TaintVocab, load_vocab
+from codejury.domain.artifact import CodeArtifact
+from codejury.domain.observation import PathStep, is_problem
+from codejury.domain.result import AnalysisResult
+
+_CONTEXT_FILE = "<context>"
+
+
+def _matches(path: str, sources: tuple[str, ...]) -> bool:
+    return any(path == s or path.startswith(s + ".") for s in sources)
+
+
+def _find_source(code: str, sources: tuple[str, ...]) -> tuple[int, str] | None:
+    """The earliest external-input expression in ``code`` as (line, access path)."""
+    try:
+        tree = ast.parse(code)
+    except SyntaxError:
+        return None
+    best: tuple[int, str] | None = None
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.Attribute, ast.Subscript)):
+            path = access_path(node)
+        elif isinstance(node, ast.Call):
+            path = access_path(node.func)
+        else:
+            continue
+        line = getattr(node, "lineno", None)
+        if path and line and _matches(path, sources):
+            if best is None or line < best[0]:
+                best = (line, path)
+    return best
+
+
+def suspected_path(
+    *,
+    content: str,
+    context: str = "",
+    sink_file: str,
+    sink_line: int | None,
+    sink_note: str = "",
+    vocab: TaintVocab | None = None,
+) -> list[PathStep]:
+    """A suspected source -> sink path, or [] when no real source/sink anchor exists.
+
+    The source is the first external-input expression in the code under review,
+    or, failing that, in the cross-file caller context. The sink is the cited
+    location. Every returned step has a real line."""
+    if sink_line is None:
+        return []
+    vocab = vocab or load_vocab()
+    local = _find_source(content, vocab.sources)
+    if local:
+        source = PathStep(file=sink_file, line=local[0], role="source", note=local[1])
+    else:
+        upstream = _find_source(context, vocab.sources) if context else None
+        if not upstream:
+            return []  # no external-input anchor: do not fabricate a path
+        source = PathStep(file=_CONTEXT_FILE, line=upstream[0], role="source", note=upstream[1])
+    return [source, PathStep(file=sink_file, line=sink_line, role="sink", note=sink_note)]
+
+
+def attach_suspected_paths(
+    result: AnalysisResult, artifact: CodeArtifact, *, vocab: TaintVocab | None = None
+) -> AnalysisResult:
+    """Add a suspected attack path to each flagged problem that cites a location
+    and does not already carry one. Returns the result unchanged when nothing
+    applies, so it is cheap to call on every run."""
+    if result.error:
+        return result
+    vocab = vocab or load_vocab()
+    enriched = []
+    changed = False
+    for o in result.observations:
+        evidence = getattr(o, "evidence", None)
+        if is_problem(o) and evidence and not getattr(o, "attack_path", None):
+            sink = next((e for e in evidence if e.line is not None), None)
+            if sink is not None:
+                steps = suspected_path(
+                    content=artifact.content,
+                    context=artifact.context,
+                    sink_file=sink.file or artifact.path,
+                    sink_line=sink.line,
+                    sink_note=o.capability,
+                    vocab=vocab,
+                )
+                if steps:
+                    o = dataclasses.replace(o, attack_path=steps, attack_path_proven=False)
+                    changed = True
+        enriched.append(o)
+    return AnalysisResult(observations=enriched, error=result.error) if changed else result

codejury-0.11.0/codejury/analysis/repo_model.py

@@ -0,0 +1,162 @@
+"""RepoModel (P6-01): a deterministic, AST-built map of a repository.
+
+The first stage of a whole-repo audit. Before any model call, this records what
+the repo is: its files and its entrypoints, the functions where external input
+arrives (HTTP routes, CLI commands). Later stages review the API surface (P6-02)
+and trace attack paths (P6-03) on top of it.
+
+Entrypoint signatures live in data, ``data/entrypoints.yaml``, so a new framework
+is added without touching this analyzer. Detection is pure AST, no model call, so
+the model is deterministic and cacheable.
+"""
+
+from __future__ import annotations
+
+import ast
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from codejury.resources import ENTRYPOINTS_FILE
+
+
+@dataclass(frozen=True, kw_only=True)
+class Entrypoint:
+    file: str
+    line: int
+    function: str
+    kind: str            # "http" or "cli"
+    framework: str
+    route: str = ""
+    method: str = ""
+
+
+@dataclass(frozen=True, kw_only=True)
+class RepoModel:
+    root: str
+    files: tuple[str, ...]
+    entrypoints: tuple[Entrypoint, ...]
+
+
+@dataclass(frozen=True)
+class _Signatures:
+    decorators: tuple[dict, ...]
+    calls: tuple[dict, ...]
+
+
+def load_entrypoint_signatures(path: str | Path = ENTRYPOINTS_FILE) -> _Signatures:
+    with open(path, encoding="utf-8") as f:
+        data = yaml.safe_load(f) or {}
+    return _Signatures(decorators=tuple(data.get("decorators", [])), calls=tuple(data.get("calls", [])))
+
+
+def build_repo_model_from_dir(root: str | Path, *, signatures: _Signatures | None = None) -> RepoModel:
+    """Build a RepoModel by reading a directory. Reuses RepoSource's safe walk."""
+    from codejury.sources.repo import RepoSource
+
+    files = RepoSource(root, extensions=(".py",)).read_files()
+    return build_repo_model(root, files, signatures=signatures)
+
+
+def build_repo_model(root: str | Path, files: dict[str, str], *, signatures: _Signatures | None = None) -> RepoModel:
+    """Build a RepoModel from {path: content}. Files that do not parse are skipped."""
+    sigs = signatures or load_entrypoint_signatures()
+    entrypoints: list[Entrypoint] = []
+    for path, content in sorted(files.items()):
+        try:
+            tree = ast.parse(content)
+        except SyntaxError:
+            continue
+        entrypoints.extend(_entrypoints_in(path, tree, sigs))
+    return RepoModel(root=str(root), files=tuple(sorted(files)), entrypoints=tuple(entrypoints))
+
+
+def _entrypoints_in(path: str, tree: ast.Module, sigs: _Signatures) -> list[Entrypoint]:
+    out: list[Entrypoint] = []
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            for dec in node.decorator_list:
+                ep = _decorator_entrypoint(path, node, dec, sigs.decorators)
+                if ep is not None:
+                    out.append(ep)
+        elif isinstance(node, ast.Call):
+            ep = _call_entrypoint(path, node, sigs.calls)
+            if ep is not None:
+                out.append(ep)
+    return out
+
+
+def _decorator_name(dec: ast.AST) -> str | None:
+    func = dec.func if isinstance(dec, ast.Call) else dec
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    if isinstance(func, ast.Name):
+        return func.id
+    return None
+
+
+def _decorator_entrypoint(path, func, dec, deco_sigs) -> Entrypoint | None:
+    name = _decorator_name(dec)
+    if name is None:
+        return None
+    sig = next((s for s in deco_sigs if name in s["names"]), None)
+    if sig is None:
+        return None
+    call = dec if isinstance(dec, ast.Call) else None
+    return Entrypoint(
+        file=path,
+        line=func.lineno,
+        function=func.name,
+        kind=sig["kind"],
+        framework=sig["framework"],
+        route=_first_str_arg(call) if call else "",
+        method=_method(name, call, sig.get("method", "")),
+    )
+
+
+def _call_entrypoint(path, call, call_sigs) -> Entrypoint | None:
+    name = call.func.attr if isinstance(call.func, ast.Attribute) else (
+        call.func.id if isinstance(call.func, ast.Name) else None
+    )
+    sig = next((s for s in call_sigs if name in s["names"]), None)
+    if sig is None:
+        return None
+    return Entrypoint(
+        file=path,
+        line=call.lineno,
+        function=_view_name(call),
+        kind=sig["kind"],
+        framework=sig["framework"],
+        route=_first_str_arg(call),
+    )
+
+
+def _first_str_arg(call: ast.Call) -> str:
+    if call.args and isinstance(call.args[0], ast.Constant) and isinstance(call.args[0].value, str):
+        return call.args[0].value
+    return ""
+
+
+def _method(decorator_name: str, call: ast.Call | None, rule: str) -> str:
+    if rule == "name":
+        return decorator_name.upper()
+    if rule == "kwarg:methods" and call is not None:
+        for kw in call.keywords:
+            if kw.arg == "methods" and isinstance(kw.value, (ast.List, ast.Tuple)):
+                methods = [e.value for e in kw.value.elts if isinstance(e, ast.Constant) and isinstance(e.value, str)]
+                if methods:
+                    return ",".join(methods)
+        return "GET"  # the framework default when methods is omitted
+    return ""
+
+
+def _view_name(call: ast.Call) -> str:
+    # Django path("route", view): the view is the second positional argument
+    if len(call.args) >= 2:
+        view = call.args[1]
+        if isinstance(view, ast.Name):
+            return view.id
+        if isinstance(view, ast.Attribute):
+            return view.attr
+    return ""

{codejury-0.10.6 → codejury-0.11.0}/codejury/assembly.py

@@ -11,26 +11,27 @@ import os
 from codejury.agents.base import Agent
 from codejury.agents.debate import ChallengerAgent, FinderAgent, JudgeAgent
 from codejury.agents.refuter import RefuterAgent
-from codejury.agents.verifier import VerifierAgent
+from codejury.agents.skill_runner import SkillRunner
+from codejury.analysis.attack_path import attach_suspected_paths
+from codejury.analysis.taint import load_vocab
 from codejury.domain.artifact import CodeArtifact
-from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
 from codejury.domain.result import AnalysisResult
 from codejury.infrastructure.cache import VerdictCache, verdict_key
+from codejury.selection import Selector, SkillRouter
 from codejury.orchestrators.base import Orchestrator
 from codejury.orchestrators.adaptive import AdaptiveOrchestrator
 from codejury.orchestrators.challenge import ChallengeOrchestrator
 from codejury.orchestrators.debate import DebateOrchestrator
-from codejury.orchestrators.pipeline import PipelineOrchestrator
 from codejury.orchestrators.reflexion import ReflexionOrchestrator
 from codejury.orchestrators.single import SingleOrchestrator
+from codejury.orchestrators.skill_pipeline import SkillPipelineOrchestrator
 from codejury.orchestrators.taint_gate import TaintGateOrchestrator
 from codejury.providers.anthropic import AnthropicProvider
 from codejury.providers.base import Provider
 from codejury.providers.litellm import LiteLLMProvider
 from codejury.providers.openai import OpenAIProvider
 from codejury.providers.retry import RetryProvider
-from codejury.sources.base import Source
 
 STRATEGIES = ("single", "pipeline", "debate", "reflexion", "challenge", "taint", "adaptive")
 PROVIDERS = ("anthropic", "openai", "litellm")
@@ -53,9 +54,18 @@ def make_provider(
     return provider
 
 
-def build_orchestration(
+def build_skill_orchestration(
     strategy: str, *, provider: Provider, model: str, max_tokens: int
 ) -> tuple[dict[str, Agent], Orchestrator]:
+    """Skill-based orchestration. SkillRunner takes the verifier role; the debate
+    agents are skill-aware (FinderAgent reads the skill playbooks), so every
+    strategy build_orchestration offers is available here too.
+
+    The taint and challenge gates key on ``capability.split('.')[0]``, which a
+    skill verdict (``input_validation.<dimension>``) still satisfies."""
+    def runner() -> SkillRunner:
+        return SkillRunner(provider=provider, model=model, max_tokens=max_tokens)
+
     if strategy == "debate":
         roles = (FinderAgent, ChallengerAgent, JudgeAgent)
         agents = {cls.role: cls(provider=provider, model=model, max_tokens=max_tokens) for cls in roles}
@@ -63,7 +73,7 @@ def build_orchestration(
     if strategy == "adaptive":
         roles = (FinderAgent, ChallengerAgent, JudgeAgent)
         agents = {cls.role: cls(provider=provider, model=model, max_tokens=max_tokens) for cls in roles}
-        agents["verifier"] = VerifierAgent(provider=provider, model=model, max_tokens=max_tokens)
+        agents["verifier"] = runner()
         return agents, AdaptiveOrchestrator()
     if strategy == "reflexion":
         agents = {
@@ -72,17 +82,12 @@ def build_orchestration(
         }
         return agents, ReflexionOrchestrator()
     if strategy == "challenge":
-        agents = {
-            "verifier": VerifierAgent(provider=provider, model=model, max_tokens=max_tokens),
-            "refuter": RefuterAgent(provider=provider, model=model),
-        }
-        return agents, ChallengeOrchestrator()
-    verifier = {"verifier": VerifierAgent(provider=provider, model=model, max_tokens=max_tokens)}
+        return {"verifier": runner(), "refuter": RefuterAgent(provider=provider, model=model)}, ChallengeOrchestrator()
     if strategy == "pipeline":
-        return verifier, PipelineOrchestrator()
+        return {"verifier": runner()}, SkillPipelineOrchestrator()
     if strategy == "taint":
-        return verifier, TaintGateOrchestrator()
-    return verifier, SingleOrchestrator()
+        return {"verifier": runner()}, TaintGateOrchestrator()
+    return {"verifier": runner()}, SingleOrchestrator()
 
 
 def provider_tag(provider: Provider) -> str:
@@ -96,46 +101,44 @@ def orchestration_descriptor(provider: Provider, strategy: str, model: str, max_
     return f"{provider_tag(provider)}|{strategy}|{model}|{max_tokens}"
 
 
-def run_over_artifacts(
+def run_over_artifacts_with_skills(
     artifacts: list[CodeArtifact],
-    capabilities: list[Capability],
+    selector: Selector,
     agents: dict[str, Agent],
     orchestrator: Orchestrator,
     *,
+    router: SkillRouter | None = None,
     cache: VerdictCache | None = None,
     orchestration: str = "",
+    verify: bool = False,
 ) -> list[tuple[str, AnalysisResult]]:
-    """Run the orchestration over each artifact, returning (path, result) per artifact.
+    """Run the orchestration over each artifact on its selected skills.
+
+    The selector picks, per artifact, which skills apply (the deterministic
+    applies_to filter, then the optional router). verdict_key duck-types on each
+    skill's id and fingerprint, so the determinism cache works unchanged. When
+    ``verify`` is set, high-severity findings are PoC-checked in the sandbox and
+    upgraded to proven; the verify flag is folded into the cache key."""
+    from codejury.sandbox import load_poc_templates, verify_result
 
-    When ``cache`` is given, an unchanged artifact returns its recorded result
-    instead of re-running the orchestrator (determinism, invariant 2).
-    """
     results = []
+    vocab = load_vocab()  # once: the attack-path synthesizer reuses it per artifact
+    templates = load_poc_templates() if verify else []
+    orchestration = orchestration + ("|verify" if verify else "")
     for artifact in artifacts:
+        skills = selector.select(artifact, router=router)
         if cache is not None:
-            key = verdict_key(artifact, capabilities, orchestration=orchestration)
+            key = verdict_key(artifact, skills, orchestration=orchestration)
             hit = cache.get(key)
             if hit is not None:
                 results.append((artifact.path, hit))
                 continue
-        ctx = AnalysisContext(artifact=artifact, capabilities=capabilities)
+        ctx = AnalysisContext(artifact=artifact, skills=skills)
         result = orchestrator.run(agents, ctx)
+        result = attach_suspected_paths(result, artifact, vocab=vocab)
+        if verify:
+            result = verify_result(result, artifact.content, templates)
         if cache is not None:
             cache.put(key, result)
         results.append((artifact.path, result))
     return results
-
-
-def run_over_source(
-    source: Source,
-    capabilities: list[Capability],
-    agents: dict[str, Agent],
-    orchestrator: Orchestrator,
-    *,
-    cache: VerdictCache | None = None,
-    orchestration: str = "",
-) -> list[tuple[str, AnalysisResult]]:
-    return run_over_artifacts(
-        source.list_artifacts(), capabilities, agents, orchestrator,
-        cache=cache, orchestration=orchestration,
-    )