codejury 0.9.1__tar.gz → 0.10.0__tar.gz

{codejury-0.9.1 → codejury-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.9.1
+Version: 0.10.0
 Summary: General-purpose Application Security AI audit framework -- five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT
@@ -83,7 +83,7 @@ git diff | codejury audit --provider anthropic
 | `codejury run <task>` | Run a named task preset (see [Tasks](#tasks)). |
 | `codejury eval` | Score the golden cases; report precision / recall / F1, overall and per capability. |
 
-Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint}`,
+Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint,adaptive}`,
 `--provider {anthropic,openai,litellm}`, `--model`,
 `--format {text,markdown,json,sarif}`.
 
@@ -103,6 +103,11 @@ value reaching the sink is constant, sanitized, or trusted (using cross-file
 caller/callee context). It downgrades only on positive proof, so it removes false
 positives without dropping real findings.
 
+`--orchestrator adaptive` keeps cost down: it runs the single verifier first and
+escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+(verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
+confident files pay a single call; only the rest pay for debate.
+
 `--format sarif` emits a SARIF 2.1.0 log (validates against the official schema)
 for CI and security dashboards: each problem with a code location becomes a
 result carrying its capability (as the rule id), CWE, and a precise location.

{codejury-0.9.1 → codejury-0.10.0}/README.md

@@ -53,7 +53,7 @@ git diff | codejury audit --provider anthropic
 | `codejury run <task>` | Run a named task preset (see [Tasks](#tasks)). |
 | `codejury eval` | Score the golden cases; report precision / recall / F1, overall and per capability. |
 
-Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint}`,
+Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint,adaptive}`,
 `--provider {anthropic,openai,litellm}`, `--model`,
 `--format {text,markdown,json,sarif}`.
 
@@ -73,6 +73,11 @@ value reaching the sink is constant, sanitized, or trusted (using cross-file
 caller/callee context). It downgrades only on positive proof, so it removes false
 positives without dropping real findings.
 
+`--orchestrator adaptive` keeps cost down: it runs the single verifier first and
+escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+(verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
+confident files pay a single call; only the rest pay for debate.
+
 `--format sarif` emits a SARIF 2.1.0 log (validates against the official schema)
 for CI and security dashboards: each problem with a code location becomes a
 result carrying its capability (as the rule id), CWE, and a precise location.

{codejury-0.9.1 → codejury-0.10.0}/codejury/analysis/provenance.py

@@ -72,7 +72,40 @@ def find_calls(scope: ast.AST, callee: str) -> list[ast.Call]:
 
 def trace_value(func: ast.FunctionDef | ast.AsyncFunctionDef, expr: ast.AST) -> Origin:
     """Trace where ``expr`` (an expression inside ``func``) gets its value from."""
-    return _classify(expr, _params(func), _assignments(func), frozenset())
+    params = _params(func)
+
+    def leaf(node: ast.AST, recurse) -> Origin:
+        if isinstance(node, ast.Call):
+            # the return value's provenance depends on the callee's semantics, which
+            # P1-03 decides with the vocabulary; here we just name the callee.
+            name = _call_name(node)
+            return Origin(calls=frozenset({name})) if name else _UNKNOWN
+        if isinstance(node, (ast.Attribute, ast.Subscript)):
+            dotted = _dotted(node)
+            origin = Origin(attrs=frozenset({dotted})) if dotted else _UNKNOWN
+            if _root_name(node) in params:  # e.g. request.args[...] where `request` is a parameter
+                origin = origin.merge(Origin(params=frozenset({_root_name(node)})))
+            return origin
+        return _UNKNOWN
+
+    return reduce_value(
+        expr,
+        params=params,
+        assigns=_assignments(func),
+        combine=_merge_origins,
+        leaf=leaf,
+        on_param=lambda n: Origin(params=frozenset({n})),
+        on_global=lambda n: Origin(globals_=frozenset({n})),
+        on_constant=lambda: _LITERAL,
+        on_cycle=Origin,  # assignment cycle -- no new information
+    )
+
+
+def _merge_origins(origins: list[Origin]) -> Origin:
+    out = Origin()
+    for o in origins:
+        out = out.merge(o)
+    return out
 
 
 def parameters(func: ast.FunctionDef | ast.AsyncFunctionDef) -> set[str]:
@@ -100,51 +133,63 @@ def access_root(node: ast.AST) -> str | None:
     return _root_name(node)
 
 
-def _classify(expr: ast.AST, params: set[str], assigns: dict[str, list[ast.AST]], seen: frozenset[str]) -> Origin:
+def reduce_value(
+    expr: ast.AST,
+    *,
+    params: set[str],
+    assigns: dict[str, list[ast.AST]],
+    combine,
+    leaf,
+    on_param,
+    on_global,
+    on_constant,
+    on_cycle,
+    seen: frozenset[str] = frozenset(),
+):
+    """Walk a value expression, folding it to a single result of the caller's type.
+
+    This is the structural recursion shared by provenance (P1-01) and taint
+    classification (P1-03): the composite forms that pass a value through (binops,
+    f-strings, conditionals, collections) and the local-name dispatch (parameter /
+    assignment chain / assignment cycle / free global) are handled here once. The
+    caller supplies the policy:
+
+    - ``combine(list)`` -> fold component results (also defines the empty result);
+    - ``on_constant() / on_param(name) / on_global(name) / on_cycle()`` -> leaf
+      results for a literal, a parameter, a free name, and an assignment cycle;
+    - ``leaf(node, recurse)`` -> everything else (calls, attribute/subscript
+      access, unmodelled nodes); ``recurse`` re-enters the walk for sub-expressions
+      (e.g. a taint propagator recursing into its arguments).
+    """
+
+    def recurse(e: ast.AST, _seen: frozenset[str] | None = None):
+        return reduce_value(
+            e, params=params, assigns=assigns, combine=combine, leaf=leaf,
+            on_param=on_param, on_global=on_global, on_constant=on_constant,
+            on_cycle=on_cycle, seen=seen if _seen is None else _seen,
+        )
+
     if isinstance(expr, ast.Constant):
-        return _LITERAL
+        return on_constant()
     if isinstance(expr, ast.JoinedStr):  # f-string: literal parts + interpolated exprs
-        origin = _LITERAL
-        for value in expr.values:
-            if isinstance(value, ast.FormattedValue):
-                origin = origin.merge(_classify(value.value, params, assigns, seen))
-        return origin
+        return combine([on_constant()] + [recurse(v.value) for v in expr.values if isinstance(v, ast.FormattedValue)])
     if isinstance(expr, ast.BinOp):
-        return _classify(expr.left, params, assigns, seen).merge(_classify(expr.right, params, assigns, seen))
-    if isinstance(expr, (ast.BoolOp,)):
-        return _merge_all(expr.values, params, assigns, seen)
-    if isinstance(expr, ast.IfExp):  # value is one branch or the other; the test does not flow in
-        return _classify(expr.body, params, assigns, seen).merge(_classify(expr.orelse, params, assigns, seen))
+        return combine([recurse(expr.left), recurse(expr.right)])
+    if isinstance(expr, ast.BoolOp):
+        return combine([recurse(v) for v in expr.values])
+    if isinstance(expr, ast.IfExp):  # one branch or the other; the test does not flow in
+        return combine([recurse(expr.body), recurse(expr.orelse)])
     if isinstance(expr, (ast.List, ast.Tuple, ast.Set)):
-        return _merge_all(expr.elts, params, assigns, seen)
-    if isinstance(expr, ast.Call):
-        # the return value's taint depends on the callee's semantics, which P1-03
-        # decides with the sanitizer/propagator catalog; here we just name the callee.
-        name = _call_name(expr)
-        return Origin(calls=frozenset({name})) if name else _UNKNOWN
-    if isinstance(expr, (ast.Attribute, ast.Subscript)):
-        dotted = _dotted(expr)
-        origin = Origin(attrs=frozenset({dotted})) if dotted else _UNKNOWN
-        root = _root_name(expr)
-        if root in params:  # e.g. request.args[...] where `request` is a parameter
-            origin = origin.merge(Origin(params=frozenset({root})))
-        return origin
+        return combine([recurse(e) for e in expr.elts])
     if isinstance(expr, ast.Name):
         if expr.id in seen:  # assignment cycle -- stop
-            return Origin()
+            return on_cycle()
         if expr.id in params:
-            return Origin(params=frozenset({expr.id}))
+            return on_param(expr.id)
         if expr.id in assigns:
-            return _merge_all(assigns[expr.id], params, assigns, seen | {expr.id})
-        return Origin(globals_=frozenset({expr.id}))  # module global, import, or builtin
-    return _UNKNOWN
-
-
-def _merge_all(exprs: list[ast.AST], params, assigns, seen) -> Origin:
-    origin = Origin()
-    for e in exprs:
-        origin = origin.merge(_classify(e, params, assigns, seen))
-    return origin
+            return combine([recurse(r, seen | {expr.id}) for r in assigns[expr.id]])
+        return on_global(expr.id)  # module global, import, or builtin
+    return leaf(expr, recurse)
 
 
 def _params(func: ast.AST) -> set[str]:

{codejury-0.9.1 → codejury-0.10.0}/codejury/analysis/taint.py

@@ -35,6 +35,7 @@ from codejury.analysis.provenance import (
     callee,
     find_calls,
     parameters,
+    reduce_value,
 )
 from codejury.resources import TAINT_FILE
 
@@ -108,65 +109,55 @@ def taint_of(
 
     ``resolve_param`` is an optional ``(name) -> Taint`` callback; when given, a
     value that reaches a parameter is resolved through it (the cross-file caller
-    hop, P1-03b) instead of returning PARAM.
+    hop, P1-03b) instead of returning PARAM. Shares the structural recursion with
+    provenance via ``reduce_value``; this is the vocabulary-aware policy.
     """
-    return _walk(func, expr, vocab, assignments(func), parameters(func), frozenset(), resolve_param)
-
-
-def _walk(func, expr, vocab, assigns, params, seen, resolve) -> Taint:
-    def w(e):
-        return _walk(func, e, vocab, assigns, params, seen, resolve)
-
-    if isinstance(expr, ast.Constant):
-        return Taint.CONSTANT
-    if isinstance(expr, ast.JoinedStr):
-        return _combine([Taint.CONSTANT] + [w(v.value) for v in expr.values if isinstance(v, ast.FormattedValue)])
-    if isinstance(expr, ast.BinOp):
-        return _combine([w(expr.left), w(expr.right)])
-    if isinstance(expr, ast.BoolOp):
-        return _combine([w(v) for v in expr.values])
-    if isinstance(expr, ast.IfExp):
-        return _combine([w(expr.body), w(expr.orelse)])
-    if isinstance(expr, (ast.List, ast.Tuple, ast.Set)):
-        return _combine([w(e) for e in expr.elts] or [Taint.CONSTANT])
-    if isinstance(expr, ast.Call):
-        if _callee_in(expr, vocab.sanitizers):
-            return Taint.SANITIZED            # a sanitizer cleans its result regardless of input
-        if _callee_in(expr, vocab.sources):
-            return Taint.EXTERNAL             # e.g. input()
-        # a method ON a source/trusted object, e.g. request.args.get("id") or os.environ.get("X")
-        func_path = access_path(expr.func)
-        if func_path and _access_in(func_path, vocab.sources):
-            return Taint.EXTERNAL
-        if func_path and _access_in(func_path, vocab.trusted):
-            return Taint.TRUSTED
-        if _callee_in(expr, vocab.propagators) or _callee_in(expr, vocab.safe_sinks):
-            return _combine([w(a) for a in expr.args] or [Taint.CONSTANT])
-        return Taint.UNKNOWN                  # unknown call -- a cross-file hop may resolve it later
-    if isinstance(expr, (ast.Attribute, ast.Subscript)):
-        path = access_path(expr)
-        if path and _access_in(path, vocab.sources):
-            return Taint.EXTERNAL
-        if path and _access_in(path, vocab.trusted):
-            return Taint.TRUSTED
-        root = access_root(expr)
-        if root in params:                    # attribute of a parameter -- resolve at call site
-            return resolve(root) if resolve else Taint.PARAM
-        return Taint.UNKNOWN                  # unknown object attribute (e.g. self.x): not provably safe
-    if isinstance(expr, ast.Name):
-        if expr.id in seen:
-            return Taint.CONSTANT             # assignment cycle: no new information
-        if expr.id in params:
-            return resolve(expr.id) if resolve else Taint.PARAM
-        if expr.id in assigns:
-            return _combine([_walk(func, r, vocab, assigns, params, seen | {expr.id}, resolve)
-                             for r in assigns[expr.id]])
-        return Taint.TRUSTED                  # free module global / builtin -- conventionally a constant
-    return Taint.UNKNOWN
+    params = parameters(func)
+
+    def on_param(name: str) -> Taint:
+        return resolve_param(name) if resolve_param else Taint.PARAM
+
+    def leaf(node: ast.AST, recurse) -> Taint:
+        if isinstance(node, ast.Call):
+            if _callee_in(node, vocab.sanitizers):
+                return Taint.SANITIZED        # a sanitizer cleans its result regardless of input
+            if _callee_in(node, vocab.sources):
+                return Taint.EXTERNAL         # e.g. input()
+            # a method ON a source/trusted object, e.g. request.args.get("id")
+            func_path = access_path(node.func)
+            if func_path and _access_in(func_path, vocab.sources):
+                return Taint.EXTERNAL
+            if func_path and _access_in(func_path, vocab.trusted):
+                return Taint.TRUSTED
+            if _callee_in(node, vocab.propagators) or _callee_in(node, vocab.safe_sinks):
+                return _combine([recurse(a) for a in node.args])
+            return Taint.UNKNOWN              # unknown call -- a cross-file hop may resolve it later
+        if isinstance(node, (ast.Attribute, ast.Subscript)):
+            path = access_path(node)
+            if path and _access_in(path, vocab.sources):
+                return Taint.EXTERNAL
+            if path and _access_in(path, vocab.trusted):
+                return Taint.TRUSTED
+            if access_root(node) in params:   # attribute of a parameter -- resolve at the call site
+                return on_param(access_root(node))
+            return Taint.UNKNOWN              # unknown object attribute (e.g. self.x): not provably safe
+        return Taint.UNKNOWN
+
+    return reduce_value(
+        expr,
+        params=params,
+        assigns=assignments(func),
+        combine=_combine,
+        leaf=leaf,
+        on_param=on_param,
+        on_global=lambda n: Taint.TRUSTED,    # free module global / builtin -- conventionally a constant
+        on_constant=lambda: Taint.CONSTANT,
+        on_cycle=lambda: Taint.CONSTANT,      # assignment cycle: no new information
+    )
 
 
 def _combine(taints: list[Taint]) -> Taint:
-    return max(taints, key=lambda t: _RANK[t])
+    return max(taints, key=lambda t: _RANK[t]) if taints else Taint.CONSTANT
 
 
 def _callee_in(call: ast.Call, names: tuple[str, ...]) -> bool:

{codejury-0.9.1 → codejury-0.10.0}/codejury/assembly.py

@@ -18,6 +18,7 @@ from codejury.domain.context import AnalysisContext
 from codejury.domain.result import AnalysisResult
 from codejury.infrastructure.cache import VerdictCache, verdict_key
 from codejury.orchestrators.base import Orchestrator
+from codejury.orchestrators.adaptive import AdaptiveOrchestrator
 from codejury.orchestrators.challenge import ChallengeOrchestrator
 from codejury.orchestrators.debate import DebateOrchestrator
 from codejury.orchestrators.pipeline import PipelineOrchestrator
@@ -31,7 +32,7 @@ from codejury.providers.openai import OpenAIProvider
 from codejury.providers.retry import RetryProvider
 from codejury.sources.base import Source
 
-STRATEGIES = ("single", "pipeline", "debate", "reflexion", "challenge", "taint")
+STRATEGIES = ("single", "pipeline", "debate", "reflexion", "challenge", "taint", "adaptive")
 PROVIDERS = ("anthropic", "openai", "litellm")
 DEFAULT_MODEL = os.environ.get("CODEJURY_MODEL", "claude-sonnet-4-6")
 DEFAULT_API_BASE = os.environ.get("CODEJURY_API_BASE")
@@ -59,6 +60,11 @@ def build_orchestration(
         roles = (FinderAgent, ChallengerAgent, JudgeAgent)
         agents = {cls.role: cls(provider=provider, model=model, max_tokens=max_tokens) for cls in roles}
         return agents, DebateOrchestrator()
+    if strategy == "adaptive":
+        roles = (FinderAgent, ChallengerAgent, JudgeAgent)
+        agents = {cls.role: cls(provider=provider, model=model, max_tokens=max_tokens) for cls in roles}
+        agents["verifier"] = VerifierAgent(provider=provider, model=model, max_tokens=max_tokens)
+        return agents, AdaptiveOrchestrator()
     if strategy == "reflexion":
         agents = {
             "actor": FinderAgent(provider=provider, model=model, max_tokens=max_tokens),

codejury-0.10.0/codejury/orchestrators/adaptive.py

@@ -0,0 +1,55 @@
+"""AdaptiveOrchestrator -- cheap triage, deep debate only where it pays off.
+
+Most files are clean, and debate is several model calls; running it everywhere
+wastes them. So this runs the single verifier first, then escalates to a full
+Finder -> Challenger -> Judge debate only when the cheap pass found something
+worth a second opinion:
+
+- **high-risk**: any VULNERABLE verdict -- a flagged vulnerability is verified by
+  the adversarial pass before it is reported / gates CI;
+- **disputed**: a PARTIAL or UNKNOWN verdict the verifier is unsure about
+  (confidence below the threshold).
+
+A clean artifact (only confident SECURE / NOT_PRESENT verdicts) pays one verifier
+call and stops. An escalated artifact is handed to the debate, whose deeper
+ruling supersedes the triage verdicts for that artifact.
+"""
+
+from __future__ import annotations
+
+from codejury.agents.base import Agent
+from codejury.domain.context import AnalysisContext
+from codejury.domain.observation import Verdict
+from codejury.domain.result import AnalysisResult
+from codejury.orchestrators.base import Orchestrator
+from codejury.orchestrators.debate import DebateOrchestrator
+
+_DISPUTABLE = ("PARTIAL", "UNKNOWN")
+
+
+class AdaptiveOrchestrator(Orchestrator):
+    def __init__(self, *, confidence_threshold: float = 0.7, debate: DebateOrchestrator | None = None) -> None:
+        self._threshold = confidence_threshold
+        self._debate = debate if debate is not None else DebateOrchestrator()
+
+    def run(self, agents: dict[str, Agent], context: AnalysisContext) -> AnalysisResult:
+        if "verifier" not in agents:
+            return AnalysisResult(error="adaptive requires agents: verifier")
+        try:
+            verdicts = agents["verifier"].run(context)
+        except Exception as exc:
+            return AnalysisResult(error=f"agent 'verifier' failed: {exc}")
+
+        if not self._needs_escalation(verdicts):
+            return AnalysisResult(observations=verdicts)  # cheap path: confident, low-risk
+        return self._debate.run(agents, context)          # deep path supersedes the triage
+
+    def _needs_escalation(self, verdicts: list) -> bool:
+        for v in verdicts:
+            if not isinstance(v, Verdict):
+                continue
+            if v.status == "VULNERABLE":  # high-risk: verify a flagged vuln adversarially
+                return True
+            if v.status in _DISPUTABLE and v.confidence < self._threshold:  # disputed
+                return True
+        return False

{codejury-0.9.1 → codejury-0.10.0}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.9.1
+Version: 0.10.0
 Summary: General-purpose Application Security AI audit framework -- five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT
@@ -83,7 +83,7 @@ git diff | codejury audit --provider anthropic
 | `codejury run <task>` | Run a named task preset (see [Tasks](#tasks)). |
 | `codejury eval` | Score the golden cases; report precision / recall / F1, overall and per capability. |
 
-Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint}`,
+Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint,adaptive}`,
 `--provider {anthropic,openai,litellm}`, `--model`,
 `--format {text,markdown,json,sarif}`.
 
@@ -103,6 +103,11 @@ value reaching the sink is constant, sanitized, or trusted (using cross-file
 caller/callee context). It downgrades only on positive proof, so it removes false
 positives without dropping real findings.
 
+`--orchestrator adaptive` keeps cost down: it runs the single verifier first and
+escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+(verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
+confident files pay a single call; only the rest pay for debate.
+
 `--format sarif` emits a SARIF 2.1.0 log (validates against the official schema)
 for CI and security dashboards: each problem with a code location becomes a
 result carrying its capability (as the rule id), CWE, and a precise location.

{codejury-0.9.1 → codejury-0.10.0}/codejury.egg-info/SOURCES.txt

@@ -120,6 +120,7 @@ codejury/infrastructure/json_parse.py
 codejury/integrations/__init__.py
 codejury/integrations/github.py
 codejury/orchestrators/__init__.py
+codejury/orchestrators/adaptive.py
 codejury/orchestrators/base.py
 codejury/orchestrators/challenge.py
 codejury/orchestrators/debate.py
@@ -146,6 +147,7 @@ codejury/sources/repo.py
 codejury/tasks/__init__.py
 codejury/tasks/base.py
 codejury/tasks/registry.py
+tests/test_adaptive.py
 tests/test_anthropic_provider.py
 tests/test_assembly.py
 tests/test_audit_pipeline.py

{codejury-0.9.1 → codejury-0.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.9.1"
+version = "0.10.0"
 description = "General-purpose Application Security AI audit framework -- five-layer architecture, capabilities as first-class data"
 readme = "README.md"
 requires-python = ">=3.12"

codejury-0.10.0/tests/test_adaptive.py

@@ -0,0 +1,71 @@
+import json
+
+from codejury.assembly import build_orchestration
+from codejury.domain.artifact import CodeArtifact
+from codejury.domain.capability import Capability
+from codejury.domain.context import AnalysisContext
+from codejury.orchestrators.adaptive import AdaptiveOrchestrator
+from codejury.providers.mock import MockProvider
+
+
+def _verdict(status, confidence=0.9):
+    return json.dumps({"verdicts": [{"sub_capability": "x", "status": status, "confidence": confidence}]})
+
+
+# A finder/judge JSON so an escalated debate produces a recognizable Finding.
+_FINDING = json.dumps({"findings": [{"title": "deep issue", "severity": "HIGH"}]})
+
+
+def _ctx():
+    return AnalysisContext(
+        artifact=CodeArtifact(kind="file", path="a.py", content="code"),
+        capabilities=[Capability(id="input_validation", name="input_validation")],
+    )
+
+
+def _build(provider):
+    return build_orchestration("adaptive", provider=provider, model="m", max_tokens=8)
+
+
+def test_clean_artifact_does_not_escalate():
+    # confident SECURE -> cheap path: the verifier's verdict is returned as-is,
+    # and the debate agents are never queried.
+    provider = MockProvider(default=_verdict("SECURE"))
+    agents, orch = _build(provider)
+    result = orch.run(agents, _ctx())
+    assert [v.status for v in result.observations if v.kind == "verdict"] == ["SECURE"]
+    assert len(provider.calls) == 1  # only the verifier ran
+
+
+def test_vulnerable_verdict_escalates_to_debate():
+    # high-risk: a VULNERABLE verdict triggers the debate (more than one model call).
+    provider = MockProvider(responses=[_verdict("VULNERABLE")], default=_FINDING)
+    agents, orch = _build(provider)
+    orch.run(agents, _ctx())
+    assert len(provider.calls) > 1  # verifier + debate rounds
+
+
+def test_low_confidence_partial_escalates():
+    provider = MockProvider(responses=[_verdict("PARTIAL", confidence=0.3)], default=_FINDING)
+    agents, orch = _build(provider)
+    orch.run(agents, _ctx())
+    assert len(provider.calls) > 1
+
+
+def test_confident_partial_does_not_escalate():
+    provider = MockProvider(default=_verdict("PARTIAL", confidence=0.95))
+    agents, orch = _build(provider)
+    orch.run(agents, _ctx())
+    assert len(provider.calls) == 1  # confident enough -> no debate
+
+
+def test_unknown_low_confidence_escalates():
+    provider = MockProvider(responses=[_verdict("UNKNOWN", confidence=0.5)], default=_FINDING)
+    agents, orch = _build(provider)
+    orch.run(agents, _ctx())
+    assert len(provider.calls) > 1
+
+
+def test_missing_verifier_errors():
+    result = AdaptiveOrchestrator().run({}, _ctx())
+    assert result.error and "verifier" in result.error