codejury 0.9.1__tar.gz → 0.10.1__tar.gz

{codejury-0.9.1 → codejury-0.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.9.1
+Version: 0.10.1
 Summary: General-purpose Application Security AI audit framework -- five-layer architecture, capabilities as first-class data
 Author: AISecLabs
 License-Expression: MIT
@@ -83,7 +83,7 @@ git diff | codejury audit --provider anthropic
 | `codejury run <task>` | Run a named task preset (see [Tasks](#tasks)). |
 | `codejury eval` | Score the golden cases; report precision / recall / F1, overall and per capability. |
 
-Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint}`,
+Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint,adaptive}`,
 `--provider {anthropic,openai,litellm}`, `--model`,
 `--format {text,markdown,json,sarif}`.
 
@@ -103,6 +103,11 @@ value reaching the sink is constant, sanitized, or trusted (using cross-file
 caller/callee context). It downgrades only on positive proof, so it removes false
 positives without dropping real findings.
 
+`--orchestrator adaptive` keeps cost down: it runs the single verifier first and
+escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+(verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
+confident files pay a single call; only the rest pay for debate.
+
 `--format sarif` emits a SARIF 2.1.0 log (validates against the official schema)
 for CI and security dashboards: each problem with a code location becomes a
 result carrying its capability (as the rule id), CWE, and a precise location.

{codejury-0.9.1 → codejury-0.10.1}/README.md

@@ -53,7 +53,7 @@ git diff | codejury audit --provider anthropic
 | `codejury run <task>` | Run a named task preset (see [Tasks](#tasks)). |
 | `codejury eval` | Score the golden cases; report precision / recall / F1, overall and per capability. |
 
-Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint}`,
+Shared flags: `--orchestrator {single,pipeline,debate,reflexion,challenge,taint,adaptive}`,
 `--provider {anthropic,openai,litellm}`, `--model`,
 `--format {text,markdown,json,sarif}`.
 
@@ -73,6 +73,11 @@ value reaching the sink is constant, sanitized, or trusted (using cross-file
 caller/callee context). It downgrades only on positive proof, so it removes false
 positives without dropping real findings.
 
+`--orchestrator adaptive` keeps cost down: it runs the single verifier first and
+escalates to a full debate only for artifacts worth it -- any VULNERABLE verdict
+(verify a flag before reporting) or a low-confidence PARTIAL/UNKNOWN one. Clean,
+confident files pay a single call; only the rest pay for debate.
+
 `--format sarif` emits a SARIF 2.1.0 log (validates against the official schema)
 for CI and security dashboards: each problem with a code location becomes a
 result carrying its capability (as the rule id), CWE, and a precise location.

{codejury-0.9.1 → codejury-0.10.1}/codejury/agents/debate.py

@@ -19,15 +19,18 @@ from codejury.agents.parsing import one_of, str_list, to_evidence, to_float
 from codejury.domain.artifact import CodeArtifact
 from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
-from codejury.domain.observation import Concession, Finding, Observation
+from codejury.domain.observation import Concession, Finding, Observation, Severity
 from codejury.infrastructure.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
 
-_SEVERITY = {"CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"}
+from typing import get_args
+
+_SEVERITY = set(get_args(Severity))  # single source of truth: the Severity Literal
 
 _FINDING_SHAPE = (
     '{"capability": "id.sub", "title": "...", "severity": "HIGH", "cwe": "CWE-89", '
-    '"description": "...", "evidence": [{"file": "...", "line": 0, "code": "..."}], "confidence": 0.0}'
+    '"description": "...", "recommendation": "...", "matched_anti": ["id"], '
+    '"evidence": [{"file": "...", "line": 0, "code": "..."}], "confidence": 0.0}'
 )
 
 _DEEP_LENS = (

{codejury-0.9.1 → codejury-0.10.1}/codejury/agents/mock.py

@@ -2,8 +2,7 @@
 
 It really calls the provider (so the dry-run exercises the agent -> provider
 path), then emits one Verdict per in-scope capability, parking the model's reply
-in ``reasoning``. It does no real parsing or judgement; the Phase 3 VerifierAgent
-will.
+in ``reasoning``. It does no real parsing or judgement; ``VerifierAgent`` does.
 """
 
 from __future__ import annotations

codejury-0.10.1/codejury/agents/parsing.py

@@ -0,0 +1,45 @@
+"""Shared coercion from loosely-typed model JSON into domain values.
+
+Agents parse model output that may omit, mistype, or invent fields. These
+helpers coerce defensively -- they never raise on bad input, they fall back.
+"""
+
+import math
+
+from codejury.domain.observation import Evidence
+
+
+def str_list(value: object) -> list[str]:
+    return [str(x) for x in value] if isinstance(value, list) else []
+
+
+def to_float(value: object, default: float) -> float:
+    # reject bool (it is an int subclass) and non-finite values (json.loads accepts
+    # NaN/Infinity); a NaN confidence would silently corrupt every downstream sort.
+    if isinstance(value, bool):
+        return default
+    try:
+        result = float(value)  # type: ignore[arg-type]
+    except (TypeError, ValueError):
+        return default
+    return result if math.isfinite(result) else default
+
+
+def one_of(value: object, allowed: set[str], default: str) -> str:
+    # `value in allowed` would raise TypeError on an unhashable model value
+    # (e.g. status -> [] or {}); guard so bad input falls back, never raises.
+    return value if isinstance(value, str) and value in allowed else default
+
+
+def to_evidence(items: object) -> list[Evidence]:
+    if not isinstance(items, list):
+        return []
+    out: list[Evidence] = []
+    for e in items:
+        if not isinstance(e, dict):
+            continue
+        line = e.get("line")
+        # a location needs a real 1-based line; reject 0, negatives, and bool (an int subclass)
+        valid_line = line if isinstance(line, int) and not isinstance(line, bool) and line >= 1 else None
+        out.append(Evidence(file=str(e.get("file", "")), line=valid_line, code=str(e.get("code", ""))))
+    return out

{codejury-0.9.1 → codejury-0.10.1}/codejury/agents/verifier.py

@@ -15,11 +15,13 @@ from codejury.agents.base import Agent
 from codejury.agents.parsing import one_of, str_list, to_evidence, to_float
 from codejury.domain.capability import Capability
 from codejury.domain.context import AnalysisContext
-from codejury.domain.observation import Observation, Verdict
+from codejury.domain.observation import Observation, Verdict, VerdictStatus
 from codejury.infrastructure.json_parse import extract_json_object
 from codejury.providers.base import Message, Provider
 
-_VALID_STATUS = {"SECURE", "VULNERABLE", "PARTIAL", "NOT_PRESENT", "UNKNOWN"}
+from typing import get_args
+
+_VALID_STATUS = set(get_args(VerdictStatus))  # single source of truth: the VerdictStatus Literal
 
 _SYSTEM = (
     "You are a security verifier. You check code against a checklist of correct and "
@@ -108,8 +110,10 @@ def _anti_pattern_cwes(cap: Capability) -> dict[str, tuple[int, str]]:
 
 
 def _resolve_cwe(matched_anti: list[str], cwe_by_id: dict[str, tuple[int, str]]) -> str:
+    # the most severe matched anti-pattern's CWE; ties broken by CWE id so the result
+    # is fully determined by the inputs, not by dict/list ordering.
     matched = [cwe_by_id[a] for a in matched_anti if a in cwe_by_id]
-    return max(matched, key=lambda rank_cwe: rank_cwe[0])[1] if matched else ""
+    return max(matched, key=lambda rank_cwe: (rank_cwe[0], rank_cwe[1]))[1] if matched else ""
 
 
 def _parse_verdicts(text: str, cap: Capability) -> list[Verdict]:

{codejury-0.9.1 → codejury-0.10.1}/codejury/analysis/provenance.py

@@ -72,7 +72,40 @@ def find_calls(scope: ast.AST, callee: str) -> list[ast.Call]:
 
 def trace_value(func: ast.FunctionDef | ast.AsyncFunctionDef, expr: ast.AST) -> Origin:
     """Trace where ``expr`` (an expression inside ``func``) gets its value from."""
-    return _classify(expr, _params(func), _assignments(func), frozenset())
+    params = _params(func)
+
+    def leaf(node: ast.AST, recurse) -> Origin:
+        if isinstance(node, ast.Call):
+            # the return value's provenance depends on the callee's semantics, which
+            # P1-03 decides with the vocabulary; here we just name the callee.
+            name = _call_name(node)
+            return Origin(calls=frozenset({name})) if name else _UNKNOWN
+        if isinstance(node, (ast.Attribute, ast.Subscript)):
+            dotted = _dotted(node)
+            origin = Origin(attrs=frozenset({dotted})) if dotted else _UNKNOWN
+            if _root_name(node) in params:  # e.g. request.args[...] where `request` is a parameter
+                origin = origin.merge(Origin(params=frozenset({_root_name(node)})))
+            return origin
+        return _UNKNOWN
+
+    return reduce_value(
+        expr,
+        params=params,
+        assigns=_assignments(func),
+        combine=_merge_origins,
+        leaf=leaf,
+        on_param=lambda n: Origin(params=frozenset({n})),
+        on_global=lambda n: Origin(globals_=frozenset({n})),
+        on_constant=lambda: _LITERAL,
+        on_cycle=Origin,  # assignment cycle -- no new information
+    )
+
+
+def _merge_origins(origins: list[Origin]) -> Origin:
+    out = Origin()
+    for o in origins:
+        out = out.merge(o)
+    return out
 
 
 def parameters(func: ast.FunctionDef | ast.AsyncFunctionDef) -> set[str]:
@@ -100,51 +133,63 @@ def access_root(node: ast.AST) -> str | None:
     return _root_name(node)
 
 
-def _classify(expr: ast.AST, params: set[str], assigns: dict[str, list[ast.AST]], seen: frozenset[str]) -> Origin:
+def reduce_value(
+    expr: ast.AST,
+    *,
+    params: set[str],
+    assigns: dict[str, list[ast.AST]],
+    combine,
+    leaf,
+    on_param,
+    on_global,
+    on_constant,
+    on_cycle,
+    seen: frozenset[str] = frozenset(),
+):
+    """Walk a value expression, folding it to a single result of the caller's type.
+
+    This is the structural recursion shared by provenance (P1-01) and taint
+    classification (P1-03): the composite forms that pass a value through (binops,
+    f-strings, conditionals, collections) and the local-name dispatch (parameter /
+    assignment chain / assignment cycle / free global) are handled here once. The
+    caller supplies the policy:
+
+    - ``combine(list)`` -> fold component results (also defines the empty result);
+    - ``on_constant() / on_param(name) / on_global(name) / on_cycle()`` -> leaf
+      results for a literal, a parameter, a free name, and an assignment cycle;
+    - ``leaf(node, recurse)`` -> everything else (calls, attribute/subscript
+      access, unmodelled nodes); ``recurse`` re-enters the walk for sub-expressions
+      (e.g. a taint propagator recursing into its arguments).
+    """
+
+    def recurse(e: ast.AST, _seen: frozenset[str] | None = None):
+        return reduce_value(
+            e, params=params, assigns=assigns, combine=combine, leaf=leaf,
+            on_param=on_param, on_global=on_global, on_constant=on_constant,
+            on_cycle=on_cycle, seen=seen if _seen is None else _seen,
+        )
+
     if isinstance(expr, ast.Constant):
-        return _LITERAL
+        return on_constant()
     if isinstance(expr, ast.JoinedStr):  # f-string: literal parts + interpolated exprs
-        origin = _LITERAL
-        for value in expr.values:
-            if isinstance(value, ast.FormattedValue):
-                origin = origin.merge(_classify(value.value, params, assigns, seen))
-        return origin
+        return combine([on_constant()] + [recurse(v.value) for v in expr.values if isinstance(v, ast.FormattedValue)])
     if isinstance(expr, ast.BinOp):
-        return _classify(expr.left, params, assigns, seen).merge(_classify(expr.right, params, assigns, seen))
-    if isinstance(expr, (ast.BoolOp,)):
-        return _merge_all(expr.values, params, assigns, seen)
-    if isinstance(expr, ast.IfExp):  # value is one branch or the other; the test does not flow in
-        return _classify(expr.body, params, assigns, seen).merge(_classify(expr.orelse, params, assigns, seen))
+        return combine([recurse(expr.left), recurse(expr.right)])
+    if isinstance(expr, ast.BoolOp):
+        return combine([recurse(v) for v in expr.values])
+    if isinstance(expr, ast.IfExp):  # one branch or the other; the test does not flow in
+        return combine([recurse(expr.body), recurse(expr.orelse)])
     if isinstance(expr, (ast.List, ast.Tuple, ast.Set)):
-        return _merge_all(expr.elts, params, assigns, seen)
-    if isinstance(expr, ast.Call):
-        # the return value's taint depends on the callee's semantics, which P1-03
-        # decides with the sanitizer/propagator catalog; here we just name the callee.
-        name = _call_name(expr)
-        return Origin(calls=frozenset({name})) if name else _UNKNOWN
-    if isinstance(expr, (ast.Attribute, ast.Subscript)):
-        dotted = _dotted(expr)
-        origin = Origin(attrs=frozenset({dotted})) if dotted else _UNKNOWN
-        root = _root_name(expr)
-        if root in params:  # e.g. request.args[...] where `request` is a parameter
-            origin = origin.merge(Origin(params=frozenset({root})))
-        return origin
+        return combine([recurse(e) for e in expr.elts])
     if isinstance(expr, ast.Name):
         if expr.id in seen:  # assignment cycle -- stop
-            return Origin()
+            return on_cycle()
         if expr.id in params:
-            return Origin(params=frozenset({expr.id}))
+            return on_param(expr.id)
         if expr.id in assigns:
-            return _merge_all(assigns[expr.id], params, assigns, seen | {expr.id})
-        return Origin(globals_=frozenset({expr.id}))  # module global, import, or builtin
-    return _UNKNOWN
-
-
-def _merge_all(exprs: list[ast.AST], params, assigns, seen) -> Origin:
-    origin = Origin()
-    for e in exprs:
-        origin = origin.merge(_classify(e, params, assigns, seen))
-    return origin
+            return combine([recurse(r, seen | {expr.id}) for r in assigns[expr.id]])
+        return on_global(expr.id)  # module global, import, or builtin
+    return leaf(expr, recurse)
 
 
 def _params(func: ast.AST) -> set[str]:

{codejury-0.9.1 → codejury-0.10.1}/codejury/analysis/taint.py

@@ -35,6 +35,7 @@ from codejury.analysis.provenance import (
     callee,
     find_calls,
     parameters,
+    reduce_value,
 )
 from codejury.resources import TAINT_FILE
 
@@ -108,65 +109,55 @@ def taint_of(
 
     ``resolve_param`` is an optional ``(name) -> Taint`` callback; when given, a
     value that reaches a parameter is resolved through it (the cross-file caller
-    hop, P1-03b) instead of returning PARAM.
+    hop, P1-03b) instead of returning PARAM. Shares the structural recursion with
+    provenance via ``reduce_value``; this is the vocabulary-aware policy.
     """
-    return _walk(func, expr, vocab, assignments(func), parameters(func), frozenset(), resolve_param)
-
-
-def _walk(func, expr, vocab, assigns, params, seen, resolve) -> Taint:
-    def w(e):
-        return _walk(func, e, vocab, assigns, params, seen, resolve)
-
-    if isinstance(expr, ast.Constant):
-        return Taint.CONSTANT
-    if isinstance(expr, ast.JoinedStr):
-        return _combine([Taint.CONSTANT] + [w(v.value) for v in expr.values if isinstance(v, ast.FormattedValue)])
-    if isinstance(expr, ast.BinOp):
-        return _combine([w(expr.left), w(expr.right)])
-    if isinstance(expr, ast.BoolOp):
-        return _combine([w(v) for v in expr.values])
-    if isinstance(expr, ast.IfExp):
-        return _combine([w(expr.body), w(expr.orelse)])
-    if isinstance(expr, (ast.List, ast.Tuple, ast.Set)):
-        return _combine([w(e) for e in expr.elts] or [Taint.CONSTANT])
-    if isinstance(expr, ast.Call):
-        if _callee_in(expr, vocab.sanitizers):
-            return Taint.SANITIZED            # a sanitizer cleans its result regardless of input
-        if _callee_in(expr, vocab.sources):
-            return Taint.EXTERNAL             # e.g. input()
-        # a method ON a source/trusted object, e.g. request.args.get("id") or os.environ.get("X")
-        func_path = access_path(expr.func)
-        if func_path and _access_in(func_path, vocab.sources):
-            return Taint.EXTERNAL
-        if func_path and _access_in(func_path, vocab.trusted):
-            return Taint.TRUSTED
-        if _callee_in(expr, vocab.propagators) or _callee_in(expr, vocab.safe_sinks):
-            return _combine([w(a) for a in expr.args] or [Taint.CONSTANT])
-        return Taint.UNKNOWN                  # unknown call -- a cross-file hop may resolve it later
-    if isinstance(expr, (ast.Attribute, ast.Subscript)):
-        path = access_path(expr)
-        if path and _access_in(path, vocab.sources):
-            return Taint.EXTERNAL
-        if path and _access_in(path, vocab.trusted):
-            return Taint.TRUSTED
-        root = access_root(expr)
-        if root in params:                    # attribute of a parameter -- resolve at call site
-            return resolve(root) if resolve else Taint.PARAM
-        return Taint.UNKNOWN                  # unknown object attribute (e.g. self.x): not provably safe
-    if isinstance(expr, ast.Name):
-        if expr.id in seen:
-            return Taint.CONSTANT             # assignment cycle: no new information
-        if expr.id in params:
-            return resolve(expr.id) if resolve else Taint.PARAM
-        if expr.id in assigns:
-            return _combine([_walk(func, r, vocab, assigns, params, seen | {expr.id}, resolve)
-                             for r in assigns[expr.id]])
-        return Taint.TRUSTED                  # free module global / builtin -- conventionally a constant
-    return Taint.UNKNOWN
+    params = parameters(func)
+
+    def on_param(name: str) -> Taint:
+        return resolve_param(name) if resolve_param else Taint.PARAM
+
+    def leaf(node: ast.AST, recurse) -> Taint:
+        if isinstance(node, ast.Call):
+            if _callee_in(node, vocab.sanitizers):
+                return Taint.SANITIZED        # a sanitizer cleans its result regardless of input
+            if _callee_in(node, vocab.sources):
+                return Taint.EXTERNAL         # e.g. input()
+            # a method ON a source/trusted object, e.g. request.args.get("id")
+            func_path = access_path(node.func)
+            if func_path and _access_in(func_path, vocab.sources):
+                return Taint.EXTERNAL
+            if func_path and _access_in(func_path, vocab.trusted):
+                return Taint.TRUSTED
+            if _callee_in(node, vocab.propagators) or _callee_in(node, vocab.safe_sinks):
+                return _combine([recurse(a) for a in node.args])
+            return Taint.UNKNOWN              # unknown call -- a cross-file hop may resolve it later
+        if isinstance(node, (ast.Attribute, ast.Subscript)):
+            path = access_path(node)
+            if path and _access_in(path, vocab.sources):
+                return Taint.EXTERNAL
+            if path and _access_in(path, vocab.trusted):
+                return Taint.TRUSTED
+            if access_root(node) in params:   # attribute of a parameter -- resolve at the call site
+                return on_param(access_root(node))
+            return Taint.UNKNOWN              # unknown object attribute (e.g. self.x): not provably safe
+        return Taint.UNKNOWN
+
+    return reduce_value(
+        expr,
+        params=params,
+        assigns=assignments(func),
+        combine=_combine,
+        leaf=leaf,
+        on_param=on_param,
+        on_global=lambda n: Taint.TRUSTED,    # free module global / builtin -- conventionally a constant
+        on_constant=lambda: Taint.CONSTANT,
+        on_cycle=lambda: Taint.CONSTANT,      # assignment cycle: no new information
+    )
 
 
 def _combine(taints: list[Taint]) -> Taint:
-    return max(taints, key=lambda t: _RANK[t])
+    return max(taints, key=lambda t: _RANK[t]) if taints else Taint.CONSTANT
 
 
 def _callee_in(call: ast.Call, names: tuple[str, ...]) -> bool:

{codejury-0.9.1 → codejury-0.10.1}/codejury/assembly.py

@@ -18,6 +18,7 @@ from codejury.domain.context import AnalysisContext
 from codejury.domain.result import AnalysisResult
 from codejury.infrastructure.cache import VerdictCache, verdict_key
 from codejury.orchestrators.base import Orchestrator
+from codejury.orchestrators.adaptive import AdaptiveOrchestrator
 from codejury.orchestrators.challenge import ChallengeOrchestrator
 from codejury.orchestrators.debate import DebateOrchestrator
 from codejury.orchestrators.pipeline import PipelineOrchestrator
@@ -31,7 +32,7 @@ from codejury.providers.openai import OpenAIProvider
 from codejury.providers.retry import RetryProvider
 from codejury.sources.base import Source
 
-STRATEGIES = ("single", "pipeline", "debate", "reflexion", "challenge", "taint")
+STRATEGIES = ("single", "pipeline", "debate", "reflexion", "challenge", "taint", "adaptive")
 PROVIDERS = ("anthropic", "openai", "litellm")
 DEFAULT_MODEL = os.environ.get("CODEJURY_MODEL", "claude-sonnet-4-6")
 DEFAULT_API_BASE = os.environ.get("CODEJURY_API_BASE")
@@ -59,6 +60,11 @@ def build_orchestration(
         roles = (FinderAgent, ChallengerAgent, JudgeAgent)
         agents = {cls.role: cls(provider=provider, model=model, max_tokens=max_tokens) for cls in roles}
         return agents, DebateOrchestrator()
+    if strategy == "adaptive":
+        roles = (FinderAgent, ChallengerAgent, JudgeAgent)
+        agents = {cls.role: cls(provider=provider, model=model, max_tokens=max_tokens) for cls in roles}
+        agents["verifier"] = VerifierAgent(provider=provider, model=model, max_tokens=max_tokens)
+        return agents, AdaptiveOrchestrator()
     if strategy == "reflexion":
         agents = {
             "actor": FinderAgent(provider=provider, model=model, max_tokens=max_tokens),
@@ -82,7 +88,7 @@ def build_orchestration(
 def provider_tag(provider: Provider) -> str:
     """A stable short name for a provider (unwrapping RetryProvider) for cache keys,
     so two providers that accept the same model string do not share cached verdicts."""
-    return type(getattr(provider, "_inner", provider)).__name__
+    return type(getattr(provider, "inner", provider)).__name__
 
 
 def orchestration_descriptor(provider: Provider, strategy: str, model: str, max_tokens: int) -> str:

{codejury-0.9.1 → codejury-0.10.1}/codejury/baseline.py

@@ -15,13 +15,11 @@ NOT_PRESENT verdicts and concessions are always kept.
 
 from __future__ import annotations
 
-from codejury.domain.observation import Concession, Finding, Observation, Verdict
+from codejury.domain.observation import Concession, Finding, Observation, Verdict, is_problem
 from codejury.domain.result import AnalysisResult
 
 Results = list[tuple[str, AnalysisResult]]
 
-_PROBLEM_STATUSES = ("VULNERABLE", "PARTIAL")
-
 
 def finding_key(o: Observation) -> tuple:
     """A location-tolerant fingerprint for matching a finding across versions."""
@@ -39,13 +37,13 @@ def filter_new(results: Results, baseline: Results) -> tuple[Results, int]:
 
     Returns (filtered_results, dropped_count). Non-problem observations are kept.
     """
-    seen = {finding_key(o) for _, r in baseline for o in r.observations if _is_problem(o)}
+    seen = {finding_key(o) for _, r in baseline for o in r.observations if is_problem(o)}
     filtered: Results = []
     dropped = 0
     for path, result in results:
         kept: list[Observation] = []
         for o in result.observations:
-            if _is_problem(o) and finding_key(o) in seen:
+            if is_problem(o) and finding_key(o) in seen:
                 dropped += 1
             else:
                 kept.append(o)
@@ -53,10 +51,8 @@ def filter_new(results: Results, baseline: Results) -> tuple[Results, int]:
     return filtered, dropped
 
 
-def _is_problem(o: Observation) -> bool:
-    return isinstance(o, Finding) or (isinstance(o, Verdict) and o.status in _PROBLEM_STATUSES)
-
-
 def _evidence_sig(o: Observation) -> str:
+    # fingerprints only the first evidence snippet -- enough to distinguish findings
+    # in practice; two findings differing only in a later snippet would collide.
     evidence = getattr(o, "evidence", [])
     return " ".join(evidence[0].code.split()) if evidence and evidence[0].code else ""

{codejury-0.9.1 → codejury-0.10.1}/codejury/cli.py

@@ -280,6 +280,7 @@ def main(argv: list[str] | None = None) -> int:
     scan_p.add_argument("--no-suppress", action="store_true", help="disable the known-noise suppression filter")
     scan_p.add_argument("--no-cache", action="store_true", help="bypass the verdict cache (always re-query the model)")
     scan_p.add_argument("--baseline", default=None, help="a prior JSON report; report only findings new since it")
+    scan_p.add_argument("--retries", type=int, default=0, help="provider retry attempts on failure")
     scan_p.add_argument("--fail-on", choices=_FAIL_ON, default=None, dest="fail_on", help="exit 1 if a finding at/above this severity is found")
 
     run_p = sub.add_parser("run", help="run a named task preset against a unified diff")
@@ -301,9 +302,19 @@ def main(argv: list[str] | None = None) -> int:
     eval_p.add_argument("--model", default=DEFAULT_MODEL)
     eval_p.add_argument("--api-base", default=DEFAULT_API_BASE, help="provider base URL (env: CODEJURY_API_BASE)")
     eval_p.add_argument("--api-key", default=DEFAULT_API_KEY, help="provider API key (env: CODEJURY_API_KEY)")
+    eval_p.add_argument("--retries", type=int, default=0, help="provider retry attempts on failure")
 
     args = parser.parse_args(argv)
+    try:
+        return _dispatch(args, parser)
+    except Exception as exc:
+        # expected failures (missing diff file, provider auth, malformed input) become
+        # one stderr line, not a traceback. eval's own message is preserved by command name.
+        print(f"{args.command or 'codejury'} failed: {exc}", file=sys.stderr)
+        return 1
 
+
+def _dispatch(args, parser) -> int:
     if args.command == "audit":
         results = audit(
             _read_diff(args.diff),
@@ -326,12 +337,15 @@ def main(argv: list[str] | None = None) -> int:
         capabilities = load_capabilities(args.capabilities)
         if args.only:
             wanted = {x.strip() for x in args.only.split(",")}
+            unknown = wanted - {c.id for c in capabilities}
+            if unknown:
+                print(f"warning: --only names unknown capability id(s): {', '.join(sorted(unknown))}", file=sys.stderr)
             capabilities = [c for c in capabilities if c.id in wanted]
         extensions = tuple(e if e.startswith(".") else "." + e for e in args.ext.split(","))
         results = scan(
             args.directory,
             capabilities,
-            provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base),
+            provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries),
             model=args.model,
             max_tokens=args.max_tokens,
             strategy=args.orchestrator,
@@ -359,19 +373,13 @@ def main(argv: list[str] | None = None) -> int:
         return _gate_exit(results, args.fail_on)
 
     if args.command == "eval":
-        try:
-            report = evaluate(
-                load_cases(args.dataset, split=args.split),
-                load_capabilities(args.capabilities),
-                provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base),
-                model=args.model,
-                strategy=args.orchestrator,
-            )
-        except Exception as exc:
-            # e.g. a missing API key surfaces as a provider auth error -- report it
-            # as one line, not a traceback (audit gets this via the orchestrator).
-            print(f"eval failed: {exc}")
-            return 1
+        report = evaluate(
+            load_cases(args.dataset, split=args.split),
+            load_capabilities(args.capabilities),
+            provider=make_provider(args.provider, api_key=args.api_key, api_base=args.api_base, retries=args.retries),
+            model=args.model,
+            strategy=args.orchestrator,
+        )
         print(json.dumps(report.to_dict(), indent=2) if args.fmt == "json" else _render_eval(report))
         return 0
 

{codejury-0.9.1 → codejury-0.10.1}/codejury/domain/capability.py

@@ -20,8 +20,12 @@ from typing import Any
 
 import yaml
 
+from typing import get_args
+
 from codejury.domain.observation import Severity
 
+_SEVERITIES = frozenset(get_args(Severity))
+
 
 @dataclass(frozen=True, kw_only=True)
 class CorrectPattern:
@@ -57,12 +61,18 @@ class AntiPattern:
 
     @classmethod
     def from_dict(cls, data: dict[str, Any]) -> AntiPattern:
+        severity = data.get("severity", "MEDIUM")
+        if severity not in _SEVERITIES:
+            raise ValueError(
+                f"anti_pattern {data.get('id')!r}: invalid severity {severity!r}; "
+                f"expected one of {', '.join(_SEVERITIES)}"
+            )
         return cls(
             id=data["id"],
             description=data.get("description", ""),
             signals=list(data.get("signals", [])),
             cwe=data.get("cwe", ""),
-            severity=data.get("severity", "MEDIUM"),
+            severity=severity,
             why_bad=data.get("why_bad", ""),
             example_bad=data.get("example_bad", ""),
             example_good=data.get("example_good", ""),
@@ -130,7 +140,10 @@ def load_capability(path: str | Path) -> Capability:
         data = yaml.safe_load(f)
     if not isinstance(data, dict):
         raise ValueError(f"{path}: expected a YAML mapping at the top level, got {type(data).__name__}")
-    return Capability.from_dict(data)
+    try:
+        return Capability.from_dict(data)
+    except (KeyError, ValueError) as exc:
+        raise ValueError(f"{path}: {exc}") from exc
 
 
 def load_capabilities(directory: str | Path) -> list[Capability]: