codejury 0.21.0__tar.gz → 0.23.0__tar.gz

{codejury-0.21.0 → codejury-0.23.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.21.0
-Summary: AI code security review for diffs and whole repositories.
+Version: 0.23.0
+Summary: AI code security review for diffs and repos.
 Author: AISecLabs
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/aiseclabs/codejury
@@ -38,25 +38,15 @@ Dynamic: license-file
  ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚════╝  ╚═════╝ ╚═╝  ╚═╝   ╚═╝
 ```
 
-> AI code security review for diffs and whole repositories.
+An AI code security review tool. It works two ways. `review diff` audits a pull
+request diff for newly introduced exploitable risk in one command. `review repo`
+sets up an interactive agent such as Claude Code or Codex to audit a whole
+repository, mapping the attack surface, tracing inputs to sinks across files, and
+verifying each issue with a real PoC.
 
-codejury runs two paths matched to their nature.
-
-- **Diff Review** is coded. It audits a pull request diff for newly introduced
-  exploitable risk, as a single balanced LLM call or an adversarial Finder,
-  Challenger, and Judge pass that trades roughly 3x the cost for extra recall on
-  subtle flaws that span files. One command in, findings out.
-- **Repo Review** is agent driven. A whole repository is too large for one LLM
-  call, so codejury scaffolds a workspace and hands an interactive agent such as
-  Claude Code or Codex a methodology to run. The agent maps the attack surface,
-  traces inputs to sinks across files, verifies issues with a real PoC, and
-  iterates over rounds with a persistent memory.
-
-Security knowledge is data, not code. Vulnerability classes live in
-`codejury/data/vulnerabilities/*.md` with a vulnerable and a secure example per
-language, and the stack guides live under `data/languages`, `data/frameworks`,
-and `data/protocols`. The engine stays language neutral and names no framework,
-so adding a stack is a drop-in markdown file.
+Security knowledge is data, not code. Drop-in markdown guides hold the
+vulnerability classes, languages, frameworks, and protocols, so the engine names
+no language and adding a stack is a new file.
 
 ## Install
 
@@ -67,19 +57,21 @@ codejury install-slash-command             # Claude Code, ~/.claude/commands/
 codejury install-slash-command --agent codex   # Codex, ~/.codex/prompts/
 ```
 
-`install-slash-command` copies the `/codejury-review-repo` command into the agent's
-command directory. The command body is the same for every agent, only the
-directory differs, so pass `--dir` for any other agent. The repo review itself is
-agent neutral, so even without the command you can run `codejury review repo` and
-tell any agent to follow the methodology it writes.
+`install-slash-command` copies the `/codejury-review-repo` command into the
+agent's command directory. The command body is the same for every agent, only the
+directory differs, so pass `--dir` for any other agent.
 
 ## Diff Review
 
+The coded engine. It audits a diff in one command, as a single balanced LLM call
+or an adversarial Finder, Challenger, and Judge pass that trades roughly 3x the
+cost for extra recall on subtle flaws that span files.
+
 ```bash
-# audit a diff file
+# a diff file
 codejury review diff --file changes.diff
 
-# audit a git range in a repo
+# a git range in a repo
 codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
@@ -97,57 +89,25 @@ the `CODEJURY_API_KEY`, `CODEJURY_MODEL`, and `CODEJURY_API_BASE` environment
 variables. `codejury review diff --dry-run` exercises the engine with a mock
 provider and no key, and falls back to a built in demo diff when you pass none.
 
-### Choosing a Model and Mode
-
-Detection quality is dominated by the model first, then the mode. On real diff
-probes:
-
-- A strong model at the Claude Sonnet tier in standard mode caught every planted
-  vulnerability with almost no false positives. A weaker model raised false
-  positives in both modes, so the model is the lever that matters most.
-- Adversarial mode did not lower false positives over standard on those probes
-  and costs about 3x. Reach for it to gain recall on subtle logic that spans
-  files, not as a way to cut false positives.
-
-Default to standard mode with a strong model, set with `--model` or
-`CODEJURY_MODEL`. False positives are held down by the do not report list and the
-post filter, not by the mode.
-
-### Use in CI with GitHub Actions
-
-Audit every pull request and surface findings in the code scanning tab. Copy
-`examples/codejury-pr-review.yml` into `.github/workflows/`, add a
-`CODEJURY_API_KEY` repository secret, and it will
-
-1. diff the pull request against its base with `--git-range origin/<base>...HEAD`,
-2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
-3. fail the check on a HIGH or CRITICAL finding with `--fail-on high`.
-
-The job makes one model call per pull request in standard mode. The SARIF is
-uploaded even when the gate fails, so findings always show up on the pull
-request.
-
 ## Repo Review
 
-Repo Review does not scan and print findings. It sets up a review for an agent to
-run, because a whole repository needs many rounds of reading, cross-file tracing,
-and PoC work that an agent does, not a single call.
+The agent path. A whole repo is too large for one LLM call, so this sets up a
+review for an interactive agent rather than running a pipeline.
 
 ```bash
 codejury review repo /path/to/your/repo
 ```
 
-This detects the stack, seeds the entrypoint inventory and the downstream trace
+It detects the stack, seeds the entrypoint inventory and the downstream trace
 targets from a deterministic scan, writes the methodology to
-`<workspace>/METHODOLOGY.md`, and prints a short pointer. It creates the
-workspace:
+`<workspace>/METHODOLOGY.md`, and prints a short pointer. The workspace:
 
 ```
 entrypoints/   the candidate entrypoint files to start from
 issues/        one write-up per confirmed or suspected issue
 pocs/          a runnable PoC per issue, same name as the issue
 analysis/      _trace_targets.md, the round ledger, and trace notes
-security-review-memory.md
+METHODOLOGY.md and MEMORY.md
 ```
 
 Then run it with an interactive agent. In Claude Code or Codex:
@@ -157,22 +117,49 @@ Then run it with an interactive agent. In Claude Code or Codex:
 ```
 
 Any agent works, the slash command is just a shortcut. Without it, tell the agent
-to follow the `METHODOLOGY.md` the scaffold wrote.
-
-The agent follows `METHODOLOGY.md`: it maps the attack surface including non HTTP
-sources, traces each input to its sink through the downstream layers, runs an
-Authorization Model pass for missing-auth and IDOR, and follows a control into a
-library when an entrypoint delegates it. It keeps going until a Completeness Gate
-passes, two consecutive rounds that add nothing new. It confirms each issue with
-a real PoC against a sandbox or dev environment and asks you for any credential or
-test data it needs. Only a reproduced PoC is a confirmed finding, and nothing
-runs against production.
+to follow the `METHODOLOGY.md` the scaffold wrote. The agent maps the attack
+surface including non HTTP sources, traces each input to its sink through the
+downstream layers, runs an Authorization Model pass for missing-auth and IDOR,
+and follows a control into a library when an entrypoint delegates it. It iterates
+until a Completeness Gate passes, confirms each issue with a real PoC against a
+sandbox or dev environment, and asks you for any credential it needs. Only a
+reproduced PoC is a confirmed finding, and nothing runs against production.
 
 The supported stacks today are Python with Django, Celery, Flask, and FastAPI,
 Go with Gin and Echo, JavaScript and TypeScript with Express and NestJS, and the
 OAuth and OIDC protocol. The methodology still works on an unguided stack, it just
 leans more on the agent's own knowledge.
 
+## Choosing a Model and Mode
+
+Detection quality is dominated by the model first, then the mode. On real diff
+probes:
+
+- A strong model at the Claude Sonnet tier in standard mode caught every planted
+  vulnerability with almost no false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- Adversarial mode did not lower false positives over standard on those probes
+  and costs about 3x. Reach for it to gain recall on subtle logic that spans
+  files, not as a way to cut false positives.
+
+Default to standard mode with a strong model, set with `--model` or
+`CODEJURY_MODEL`. False positives are held down by the do not report list and the
+post filter, not by the mode.
+
+## Use in CI with GitHub Actions
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+`examples/codejury-pr-review.yml` into `.github/workflows/`, add a
+`CODEJURY_API_KEY` repository secret, and it will
+
+1. diff the pull request against its base with `--git-range origin/<base>...HEAD`,
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding with `--fail-on high`.
+
+The job makes one model call per pull request in standard mode. The SARIF is
+uploaded even when the gate fails, so findings always show up on the pull
+request.
+
 ## Findings
 
 Each finding carries a file and line, a severity and category, a concrete exploit

{codejury-0.21.0 → codejury-0.23.0}/README.md

@@ -7,25 +7,15 @@
  ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚════╝  ╚═════╝ ╚═╝  ╚═╝   ╚═╝
 ```
 
-> AI code security review for diffs and whole repositories.
-
-codejury runs two paths matched to their nature.
-
-- **Diff Review** is coded. It audits a pull request diff for newly introduced
-  exploitable risk, as a single balanced LLM call or an adversarial Finder,
-  Challenger, and Judge pass that trades roughly 3x the cost for extra recall on
-  subtle flaws that span files. One command in, findings out.
-- **Repo Review** is agent driven. A whole repository is too large for one LLM
-  call, so codejury scaffolds a workspace and hands an interactive agent such as
-  Claude Code or Codex a methodology to run. The agent maps the attack surface,
-  traces inputs to sinks across files, verifies issues with a real PoC, and
-  iterates over rounds with a persistent memory.
-
-Security knowledge is data, not code. Vulnerability classes live in
-`codejury/data/vulnerabilities/*.md` with a vulnerable and a secure example per
-language, and the stack guides live under `data/languages`, `data/frameworks`,
-and `data/protocols`. The engine stays language neutral and names no framework,
-so adding a stack is a drop-in markdown file.
+An AI code security review tool. It works two ways. `review diff` audits a pull
+request diff for newly introduced exploitable risk in one command. `review repo`
+sets up an interactive agent such as Claude Code or Codex to audit a whole
+repository, mapping the attack surface, tracing inputs to sinks across files, and
+verifying each issue with a real PoC.
+
+Security knowledge is data, not code. Drop-in markdown guides hold the
+vulnerability classes, languages, frameworks, and protocols, so the engine names
+no language and adding a stack is a new file.
 
 ## Install
 
@@ -36,19 +26,21 @@ codejury install-slash-command             # Claude Code, ~/.claude/commands/
 codejury install-slash-command --agent codex   # Codex, ~/.codex/prompts/
 ```
 
-`install-slash-command` copies the `/codejury-review-repo` command into the agent's
-command directory. The command body is the same for every agent, only the
-directory differs, so pass `--dir` for any other agent. The repo review itself is
-agent neutral, so even without the command you can run `codejury review repo` and
-tell any agent to follow the methodology it writes.
+`install-slash-command` copies the `/codejury-review-repo` command into the
+agent's command directory. The command body is the same for every agent, only the
+directory differs, so pass `--dir` for any other agent.
 
 ## Diff Review
 
+The coded engine. It audits a diff in one command, as a single balanced LLM call
+or an adversarial Finder, Challenger, and Judge pass that trades roughly 3x the
+cost for extra recall on subtle flaws that span files.
+
 ```bash
-# audit a diff file
+# a diff file
 codejury review diff --file changes.diff
 
-# audit a git range in a repo
+# a git range in a repo
 codejury review diff --repo /path/to/app --git-range origin/main...HEAD
 
 # from stdin
@@ -66,57 +58,25 @@ the `CODEJURY_API_KEY`, `CODEJURY_MODEL`, and `CODEJURY_API_BASE` environment
 variables. `codejury review diff --dry-run` exercises the engine with a mock
 provider and no key, and falls back to a built in demo diff when you pass none.
 
-### Choosing a Model and Mode
-
-Detection quality is dominated by the model first, then the mode. On real diff
-probes:
-
-- A strong model at the Claude Sonnet tier in standard mode caught every planted
-  vulnerability with almost no false positives. A weaker model raised false
-  positives in both modes, so the model is the lever that matters most.
-- Adversarial mode did not lower false positives over standard on those probes
-  and costs about 3x. Reach for it to gain recall on subtle logic that spans
-  files, not as a way to cut false positives.
-
-Default to standard mode with a strong model, set with `--model` or
-`CODEJURY_MODEL`. False positives are held down by the do not report list and the
-post filter, not by the mode.
-
-### Use in CI with GitHub Actions
-
-Audit every pull request and surface findings in the code scanning tab. Copy
-`examples/codejury-pr-review.yml` into `.github/workflows/`, add a
-`CODEJURY_API_KEY` repository secret, and it will
-
-1. diff the pull request against its base with `--git-range origin/<base>...HEAD`,
-2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
-3. fail the check on a HIGH or CRITICAL finding with `--fail-on high`.
-
-The job makes one model call per pull request in standard mode. The SARIF is
-uploaded even when the gate fails, so findings always show up on the pull
-request.
-
 ## Repo Review
 
-Repo Review does not scan and print findings. It sets up a review for an agent to
-run, because a whole repository needs many rounds of reading, cross-file tracing,
-and PoC work that an agent does, not a single call.
+The agent path. A whole repo is too large for one LLM call, so this sets up a
+review for an interactive agent rather than running a pipeline.
 
 ```bash
 codejury review repo /path/to/your/repo
 ```
 
-This detects the stack, seeds the entrypoint inventory and the downstream trace
+It detects the stack, seeds the entrypoint inventory and the downstream trace
 targets from a deterministic scan, writes the methodology to
-`<workspace>/METHODOLOGY.md`, and prints a short pointer. It creates the
-workspace:
+`<workspace>/METHODOLOGY.md`, and prints a short pointer. The workspace:
 
 ```
 entrypoints/   the candidate entrypoint files to start from
 issues/        one write-up per confirmed or suspected issue
 pocs/          a runnable PoC per issue, same name as the issue
 analysis/      _trace_targets.md, the round ledger, and trace notes
-security-review-memory.md
+METHODOLOGY.md and MEMORY.md
 ```
 
 Then run it with an interactive agent. In Claude Code or Codex:
@@ -126,22 +86,49 @@ Then run it with an interactive agent. In Claude Code or Codex:
 ```
 
 Any agent works, the slash command is just a shortcut. Without it, tell the agent
-to follow the `METHODOLOGY.md` the scaffold wrote.
-
-The agent follows `METHODOLOGY.md`: it maps the attack surface including non HTTP
-sources, traces each input to its sink through the downstream layers, runs an
-Authorization Model pass for missing-auth and IDOR, and follows a control into a
-library when an entrypoint delegates it. It keeps going until a Completeness Gate
-passes, two consecutive rounds that add nothing new. It confirms each issue with
-a real PoC against a sandbox or dev environment and asks you for any credential or
-test data it needs. Only a reproduced PoC is a confirmed finding, and nothing
-runs against production.
+to follow the `METHODOLOGY.md` the scaffold wrote. The agent maps the attack
+surface including non HTTP sources, traces each input to its sink through the
+downstream layers, runs an Authorization Model pass for missing-auth and IDOR,
+and follows a control into a library when an entrypoint delegates it. It iterates
+until a Completeness Gate passes, confirms each issue with a real PoC against a
+sandbox or dev environment, and asks you for any credential it needs. Only a
+reproduced PoC is a confirmed finding, and nothing runs against production.
 
 The supported stacks today are Python with Django, Celery, Flask, and FastAPI,
 Go with Gin and Echo, JavaScript and TypeScript with Express and NestJS, and the
 OAuth and OIDC protocol. The methodology still works on an unguided stack, it just
 leans more on the agent's own knowledge.
 
+## Choosing a Model and Mode
+
+Detection quality is dominated by the model first, then the mode. On real diff
+probes:
+
+- A strong model at the Claude Sonnet tier in standard mode caught every planted
+  vulnerability with almost no false positives. A weaker model raised false
+  positives in both modes, so the model is the lever that matters most.
+- Adversarial mode did not lower false positives over standard on those probes
+  and costs about 3x. Reach for it to gain recall on subtle logic that spans
+  files, not as a way to cut false positives.
+
+Default to standard mode with a strong model, set with `--model` or
+`CODEJURY_MODEL`. False positives are held down by the do not report list and the
+post filter, not by the mode.
+
+## Use in CI with GitHub Actions
+
+Audit every pull request and surface findings in the code scanning tab. Copy
+`examples/codejury-pr-review.yml` into `.github/workflows/`, add a
+`CODEJURY_API_KEY` repository secret, and it will
+
+1. diff the pull request against its base with `--git-range origin/<base>...HEAD`,
+2. write SARIF and upload it with `github/codeql-action/upload-sarif`,
+3. fail the check on a HIGH or CRITICAL finding with `--fail-on high`.
+
+The job makes one model call per pull request in standard mode. The SARIF is
+uploaded even when the gate fails, so findings always show up on the pull
+request.
+
 ## Findings
 
 Each finding carries a file and line, a severity and category, a concrete exploit

codejury-0.23.0/codejury/__init__.py

@@ -0,0 +1,15 @@
+"""AI code security review tool.
+
+Two paths matched to their nature: a coded diff-audit engine, a standard single
+call or an adversarial Finder/Challenger/Judge pass, and a whole-repo review run
+as a methodology by an interactive agent. Security knowledge lives in rich
+markdown vulnerability classes under data/vulnerabilities, injected into the
+audit prompt, not in a rendered schema.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("codejury")
+except PackageNotFoundError:  # running from a source tree without an install
+    __version__ = "0.0.0"

{codejury-0.21.0 → codejury-0.23.0}/codejury/cli.py

@@ -3,10 +3,10 @@
 Two paths matched to their nature:
 
 - ``review diff`` runs the coded diff engine over a unified diff: a single
-  balanced call (standard) or the adversarial Finder/Challenger/Judge pass.
+  balanced call in standard mode or the adversarial Finder/Challenger/Judge pass.
 - ``review repo <dir>`` scaffolds a workspace and prints the methodology for an
-  interactive agent to run a whole-repo review (it does not run an LLM pipeline,
-  which a single call cannot do for a whole codebase).
+  interactive agent to run a whole-repo review. It does not run an LLM pipeline,
+  which a single call cannot do for a whole codebase.
 
 ``review diff --dry-run`` exercises the engine with a mock provider and no key.
 The audit orchestration itself lives in ``codejury.review.diff.runner``.
@@ -98,7 +98,9 @@ def main(argv: list[str] | None = None) -> int:
     _add_audit_args(rsub.add_parser("diff", help="audit a unified diff (the coded engine)"))
     repo = rsub.add_parser("repo", help="scaffold a whole-repo review for an interactive agent")
     repo.add_argument("directory", help="target repository to review")
-    repo.add_argument("--workspace", default="codejury-review", help="where to create the review workspace")
+    repo.add_argument("--workspace", default="/var/tmp/codejury-review", help="where to create the review workspace")
+    repo.add_argument("--fresh", action="store_true",
+                      help="clear a previous review's output in the workspace first, MEMORY.md included")
 
     inst = sub.add_parser("install-slash-command",
                           help="install the /codejury-review-repo slash command for an agent")
@@ -137,8 +139,13 @@ def _dispatch(args, parser) -> int:
         return 1 if gate(kept, args.fail_on) else 0
 
     if args.command == "review" and scope == "repo":
-        res = scaffold(args.directory, args.workspace)
+        res = scaffold(args.directory, args.workspace, fresh=args.fresh)
         (Path(res.workspace) / "METHODOLOGY.md").write_text(res.methodology, encoding="utf-8")
+        if res.cleared:
+            print(f"Cleared {len(res.cleared)} prior-run paths in {res.workspace}, MEMORY.md included", file=sys.stderr)
+        elif res.had_prior_run:
+            print(f"A previous review's output is in {res.workspace}. Re-run with --fresh to clear it "
+                  "first, MEMORY.md included.", file=sys.stderr)
         print(f"Workspace ready: {res.workspace}", file=sys.stderr)
         if res.guides:
             print(f"Detected stack: {', '.join(res.guides)}, notes in {res.workspace}/_stack.md", file=sys.stderr)

codejury-0.23.0/codejury/data/commands/codejury-review-repo.md

@@ -0,0 +1,42 @@
+---
+description: Run a codejury whole-repo security review on a repository, interactively
+---
+Run a codejury whole-repo security review of: $ARGUMENTS
+
+1. Scaffold the workspace:
+
+   ```
+   codejury review repo $ARGUMENTS --workspace /var/tmp/codejury-review
+   ```
+
+   If `codejury` is not on PATH it is a pip-installed console script, so activate
+   the project venv first, for example `. .venv/bin/activate`, or run it through
+   that venv's Python, for example `python -m codejury`.
+
+   If the output reports that a previous review's output is already in the
+   workspace, ask me whether to clear it and start fresh. If I say yes, re-run the
+   same command with `--fresh`, which clears the prior issues, PoCs, round ledger,
+   and MEMORY.md for a clean slate. If I say no, continue and build on what is
+   there.
+
+2. Read `<workspace>/METHODOLOGY.md` and follow it to completion. It is the single
+   source of truth for how to run the review, the entrypoint map, the trace
+   targets, the Authorization Model pass, the dependency-control checks, the round
+   ledger, and the Completeness Gate. Do not improvise a different process.
+
+   Run every round to the Completeness Gate on your own. Do not pause between
+   rounds to ask whether to continue, do not stop early because a round felt
+   productive, and do not report the review done until the gate passes. The only
+   reasons to stop and ask me are in step 3.
+
+3. Verify each issue with a real PoC, human in the loop. Stop and ask me only for
+   what the PoC genuinely needs: a credential, a test account, an MFA step, or
+   go-ahead before a destructive action. Never touch production, never use real
+   credentials, and never run a destructive action without my go-ahead. Only a
+   reproduced PoC is a confirmed finding, so keep reviewing while a PoC is blocked
+   on me rather than waiting.
+
+4. Report confirmed findings, the ones with a reproduced PoC, separately from
+   suspected ones still blocked on verification, as a table: title, class,
+   `file:line`, exploit, verification status. The issue files live in the
+   workspace `issues/`.

{codejury-0.21.0 → codejury-0.23.0}/codejury/data/methodologies/repo-review.md

@@ -1,6 +1,6 @@
 # Repo Security Review: Agent Methodology
 
-The `review repo` path: a whole-repository security audit, run by an interactive
+The `review repo` path: a whole-repo security audit, run by an interactive
 coding agent such as Claude Code or Codex, not a one-shot LLM call. It maps the
 attack surface, traces inputs to sinks across files, verifies issues with a real
 PoC, and iterates over multiple rounds with a persistent memory. One round is
@@ -8,13 +8,13 @@ roughly 30 minutes. Run as many rounds as needed.
 
 Target repository: the directory you were given.
 Workspace: `<workspace>/<project>/`, created for you, holding `entrypoints/`,
-`issues/`, `analysis/`, and `security-review-memory.md`.
+`issues/`, `analysis/`, and `MEMORY.md`.
 
 ---
 
 ## On Start
 
-1. Read `security-review-memory.md` in the workspace if it exists:
+1. Read `MEMORY.md` in the workspace if it exists:
    - skip every pattern under "Confirmed false positives".
    - do not re-report anything under "Fixed".
    - weight the files under "High-risk areas" more heavily.
@@ -136,6 +136,40 @@ third-party. It is not auditing the library for its own bugs, which belongs to
 that library's own review. It is confirming that the control your endpoint relies
 on holds here.
 
+## Challenge Every Control, Presence Is Not Sufficiency
+
+A control being present is not the same as the control holding. The most common
+way a real review misses a real flaw is clearing a path the moment it sees a
+gate, a signature, or a single-use token, without asking whether that control
+actually defeats the specific attack. For every control you find on a path, do
+not clear on presence. Challenge it on these axes:
+
+- **Replay**. A signed or authenticated privileged request is replayable unless
+  the control BOTH consumes a one-time nonce AND enforces a freshness window such
+  as a timestamp or short expiry. That the caller is authenticated, that the
+  scheme fails closed, or that a TOTP is single-use is orthogonal to replay, so
+  do not let any of them clear it. Capture one valid signed request and ask: can
+  the exact same bytes be sent again and accepted? If nothing is consumed and no
+  window is checked, it replays.
+- **Concurrency and state**. A check-then-act is bypassable under concurrent
+  requests unless a lock is held across the act, even when the single-request
+  path looks single-use. A redeem, a balance debit, or a status transition that
+  reads then writes without a row lock or atomic guard double-spends under a race.
+- **Sibling coverage**. A gate on one endpoint does not cover its siblings. When
+  you find a missing-authorization or IDOR pattern, enumerate every endpoint
+  behind the same controller or gate and report the highest-impact instance, not
+  the first one you saw. A read variant flagged MEDIUM often has a create or push
+  sibling that is HIGH.
+- **Trusted-source assumptions**. A value is not safe just because a caller you
+  treat as trusted set it. If that caller is a distinct tenant or service, the
+  value is still attacker-influenced. A self-set `callback_url` that flows into a
+  server-side fetch is SSRF or a worker-blocking DoS unless there is an allowlist,
+  so do not clear it on "the owner set it".
+
+When a control passes one axis, it can still fail another, so run all four before
+you mark a path cleared. Record which axis you checked, not just that a control
+exists.
+
 ## Scope
 
 Report only HIGH / CRITICAL, exploitable, high-confidence issues. **Do not report**
@@ -205,6 +239,12 @@ from the inventory, trace it through the downstream layers, and log the round in
 bugs. The hard classes such as authorization, replay, and broken business state
 usually appear only after several rounds, so keep going.
 
+Run the rounds to the Completeness Gate on your own. Do not pause between rounds
+to ask whether to continue, and do not stop early because a round was productive.
+The one place to stop and ask the operator is PoC verification, when a PoC needs a
+credential, test data, or go-ahead for a destructive action. While a PoC is
+blocked on the operator, keep reviewing other sources rather than waiting.
+
 ## Completeness Gate
 
 Do not report the review complete until all of the following hold. A short run
@@ -217,6 +257,10 @@ reporting it as clean is the failure this gate exists to prevent.
   at the view.
 - The Authorization Model pass ran: the access gate is mapped, sibling endpoints
   compared, and IDOR and unauthenticated privileged paths checked.
+- Every control on a cleared path was challenged for sufficiency, not presence:
+  replay needs a nonce and a freshness window, check-then-act needs a lock,
+  sibling endpoints behind a shared gate were all enumerated, and a trusted-source
+  value flowing to a sink was still treated as attacker-influenced.
 - `analysis/_rounds.md` shows two consecutive rounds that added no new source, no
   new traced path, and no new issue.
 
@@ -226,6 +270,6 @@ If any item fails, run another round. State which items pass when you report.
 
 Report the confirmed findings, the ones with a reproduced PoC, separately from
 the suspected ones still blocked on verification, so the two are never conflated.
-Append a row to the audit history in `security-review-memory.md`, and ask the
+Append a row to the audit history in `MEMORY.md`, and ask the
 operator which findings were false positives. Record those under "Confirmed false
 positives" so future rounds skip them.

{codejury-0.21.0 → codejury-0.23.0}/codejury/domain/__init__.py

@@ -1,5 +1,5 @@
 """The framework's typed data model.
 
 Layers communicate only through these structures. This package depends on no
-concrete implementation (Provider / Source / ...).
+concrete implementation such as a Provider or a Source.
 """

{codejury-0.21.0 → codejury-0.23.0}/codejury/domain/finding.py

@@ -45,7 +45,7 @@ def _to_line(value: object) -> int | None:
 
 def finding_from_dict(data: dict[str, Any]) -> Finding | None:
     """Map one loosely-typed model finding onto a Finding, or None if it has no
-    location (invariant: every finding carries a file)."""
+    location, since every finding carries a file, that is the invariant."""
     if not isinstance(data, dict):
         return None
     file = str(data.get("file", "")).strip()

{codejury-0.21.0 → codejury-0.23.0}/codejury/json_parse.py

@@ -1,12 +1,12 @@
 """Best-effort extraction of a JSON object from model output.
 
 Models often wrap JSON in prose or code fences, and sometimes emit slightly
-malformed JSON (an unescaped quote, a trailing comma, a reply truncated at the
-token limit). This recovers the object: a direct parse, then a fenced ```json
-block, then the first balanced-brace span (string-aware, so braces inside string
-values do not throw off the count), then a json-repair fallback for malformed or
-truncated output. The repair step keeps a single bad character from silently
-dropping an entire findings list.
+malformed JSON, for example an unescaped quote, a trailing comma, or a reply
+truncated at the token limit. This recovers the object: a direct parse, then a
+fenced ```json block, then the first balanced-brace span, which is string-aware
+so braces inside string values do not throw off the count, then a json-repair
+fallback for malformed or truncated output. The repair step keeps a single bad
+character from silently dropping an entire findings list.
 """
 
 from __future__ import annotations
@@ -17,7 +17,7 @@ import re
 _FENCE = re.compile(r"```(?:json)?\s*(\{.*?\})\s*```", re.DOTALL)
 
 # Defensive ceiling: model output is bounded by max_tokens, but never scan an
-# unbounded string (the balanced-brace pass is superlinear on pathological input).
+# unbounded string, the balanced-brace pass is superlinear on pathological input.
 _MAX_SCAN = 1_000_000
 
 
@@ -49,7 +49,7 @@ def extract_json_object(text: str) -> dict | None:
 
 def _first_balanced_object(text: str) -> dict | None:
     """The first complete top-level {...} span, counting braces only outside of
-    string literals so braces inside a value (code in a description, "{x}") do not
+    string literals so braces inside a value, for example code in a description like "{x}", do not
     corrupt the depth count."""
     depth = 0
     start = -1
@@ -85,8 +85,8 @@ def _first_balanced_object(text: str) -> dict | None:
 
 
 def _repair(text: str) -> dict | None:
-    """Last resort: repair malformed or truncated JSON (unescaped quotes, trailing
-    commas, an unterminated reply). Optional dependency, a no-op if absent."""
+    """Last resort: repair malformed or truncated JSON such as unescaped quotes, trailing
+    commas, or an unterminated reply. Optional dependency, a no-op if absent."""
     try:
         from json_repair import repair_json
     except ImportError: