codejury 1.0.0__tar.gz → 1.0.1__tar.gz

{codejury-1.0.0 → codejury-1.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 1.0.0
+Version: 1.0.1
 Summary: AI-assisted security review for code diffs and whole repositories.
 Author: AISecLabs
 License-Expression: MIT
@@ -35,7 +35,7 @@ Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: jsonschema>=4.0; extra == "dev"
 Dynamic: license-file
 
-```
+```text
  ██████╗ ██████╗ ██████╗ ███████╗     ██╗██╗   ██╗██████╗ ██╗   ██╗
 ██╔════╝██╔═══██╗██╔══██╗██╔════╝     ██║██║   ██║██╔══██╗╚██╗ ██╔╝
 ██║     ██║   ██║██║  ██║█████╗       ██║██║   ██║██████╔╝ ╚████╔╝
@@ -44,6 +44,10 @@ Dynamic: license-file
  ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚════╝  ╚═════╝ ╚═╝  ╚═╝   ╚═╝
 ```
 
+[![PyPI](https://img.shields.io/pypi/v/codejury)](https://pypi.org/project/codejury/)
+[![Python](https://img.shields.io/pypi/pyversions/codejury)](https://pypi.org/project/codejury/)
+[![License: MIT](https://img.shields.io/pypi/l/codejury)](https://github.com/aiseclabs/codejury/blob/master/LICENSE)
+
 AI-assisted security review for code diffs and whole repositories.
 
 The tool has two review paths:
@@ -75,7 +79,7 @@ codejury install-slash-command --agent codex    # Codex
 `install-slash-command` copies `/codejury-review-repo` into the selected agent's command
 directory. Pass `--dir` to install it somewhere else.
 
-## Configure A Model Backend
+## Configure a Model Backend
 
 Set a provider key through flags or environment variables:
 
@@ -156,12 +160,16 @@ codejury review repo /path/to/repo
 The workspace contains:
 
 ```text
-inventory/      attack surface, authorization model, candidates, severity rubric
+inventory/      attack surface, authorization model, seeded entrypoints, severity rubric
 units/          one review unit per candidate entrypoint
-issues/         issue write-ups
+candidates/     agent proposals, one write-up per candidate finding
+findings/       confirmed findings, written by finalize
 pocs/           runnable PoCs, when available
+findings.json   ranked machine-readable findings
 METHODOLOGY.md  full review process
 _stack.md       detected stack notes
+_refuted.md     refuted candidates and why
+_pocs.md        PoC reconciliation, planned versus delivered
 ```
 
 Then run the interactive slash command in Claude Code or Codex:
@@ -181,9 +189,10 @@ codejury review repo /path/to/repo --finalize
 codejury review repo /path/to/repo --gate
 ```
 
-`--finalize` deduplicates issue files, verifies survivors, records refuted candidates in
-`_refuted.md`, and writes ranked `findings.json`. `--gate` fails until the workspace has
-an enumerated surface, reviewed units, and calibrated findings.
+`--finalize` deduplicates candidate files, verifies survivors, writes the confirmed
+`findings/`, records refuted candidates in `_refuted.md` and PoC reconciliation in
+`_pocs.md`, and writes ranked `findings.json`. `--gate` fails until the workspace has an
+enumerated surface, reviewed units, and calibrated candidates.
 
 For a headless run, use:
 
@@ -221,7 +230,7 @@ The tool is intentionally scoped to real exploitable application security issues
 not report dependency CVEs, style notes, generic best practices, speculation, or risks that
 only matter if production configuration leaks.
 
-## Model And Mode Guidance
+## Model and Mode Guidance
 
 Detection quality is dominated by model quality first, then mode.
 
@@ -241,7 +250,7 @@ cp examples/codejury-pr-review.yml .github/workflows/codejury-pr-review.yml
 Add `CODEJURY_API_KEY` as a repository secret. The workflow reviews the pull request diff,
 uploads SARIF to code scanning, and fails on HIGH or CRITICAL findings.
 
-## Extend The Knowledge
+## Extend the Knowledge
 
 Add security knowledge as markdown:
 

{codejury-1.0.0 → codejury-1.0.1}/README.md

@@ -1,4 +1,4 @@
-```
+```text
  ██████╗ ██████╗ ██████╗ ███████╗     ██╗██╗   ██╗██████╗ ██╗   ██╗
 ██╔════╝██╔═══██╗██╔══██╗██╔════╝     ██║██║   ██║██╔══██╗╚██╗ ██╔╝
 ██║     ██║   ██║██║  ██║█████╗       ██║██║   ██║██████╔╝ ╚████╔╝
@@ -7,6 +7,10 @@
  ╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚════╝  ╚═════╝ ╚═╝  ╚═╝   ╚═╝
 ```
 
+[![PyPI](https://img.shields.io/pypi/v/codejury)](https://pypi.org/project/codejury/)
+[![Python](https://img.shields.io/pypi/pyversions/codejury)](https://pypi.org/project/codejury/)
+[![License: MIT](https://img.shields.io/pypi/l/codejury)](https://github.com/aiseclabs/codejury/blob/master/LICENSE)
+
 AI-assisted security review for code diffs and whole repositories.
 
 The tool has two review paths:
@@ -38,7 +42,7 @@ codejury install-slash-command --agent codex    # Codex
 `install-slash-command` copies `/codejury-review-repo` into the selected agent's command
 directory. Pass `--dir` to install it somewhere else.
 
-## Configure A Model Backend
+## Configure a Model Backend
 
 Set a provider key through flags or environment variables:
 
@@ -119,12 +123,16 @@ codejury review repo /path/to/repo
 The workspace contains:
 
 ```text
-inventory/      attack surface, authorization model, candidates, severity rubric
+inventory/      attack surface, authorization model, seeded entrypoints, severity rubric
 units/          one review unit per candidate entrypoint
-issues/         issue write-ups
+candidates/     agent proposals, one write-up per candidate finding
+findings/       confirmed findings, written by finalize
 pocs/           runnable PoCs, when available
+findings.json   ranked machine-readable findings
 METHODOLOGY.md  full review process
 _stack.md       detected stack notes
+_refuted.md     refuted candidates and why
+_pocs.md        PoC reconciliation, planned versus delivered
 ```
 
 Then run the interactive slash command in Claude Code or Codex:
@@ -144,9 +152,10 @@ codejury review repo /path/to/repo --finalize
 codejury review repo /path/to/repo --gate
 ```
 
-`--finalize` deduplicates issue files, verifies survivors, records refuted candidates in
-`_refuted.md`, and writes ranked `findings.json`. `--gate` fails until the workspace has
-an enumerated surface, reviewed units, and calibrated findings.
+`--finalize` deduplicates candidate files, verifies survivors, writes the confirmed
+`findings/`, records refuted candidates in `_refuted.md` and PoC reconciliation in
+`_pocs.md`, and writes ranked `findings.json`. `--gate` fails until the workspace has an
+enumerated surface, reviewed units, and calibrated candidates.
 
 For a headless run, use:
 
@@ -184,7 +193,7 @@ The tool is intentionally scoped to real exploitable application security issues
 not report dependency CVEs, style notes, generic best practices, speculation, or risks that
 only matter if production configuration leaks.
 
-## Model And Mode Guidance
+## Model and Mode Guidance
 
 Detection quality is dominated by model quality first, then mode.
 
@@ -204,7 +213,7 @@ cp examples/codejury-pr-review.yml .github/workflows/codejury-pr-review.yml
 Add `CODEJURY_API_KEY` as a repository secret. The workflow reviews the pull request diff,
 uploads SARIF to code scanning, and fails on HIGH or CRITICAL findings.
 
-## Extend The Knowledge
+## Extend the Knowledge
 
 Add security knowledge as markdown:
 

{codejury-1.0.0 → codejury-1.0.1}/codejury/cli.py

@@ -9,19 +9,20 @@ Two paths matched to their nature:
   which a single call cannot do for a whole codebase.
 
 ``review diff --dry-run`` exercises the engine with a mock provider and no key.
-The audit orchestration itself lives in ``codejury.review.diff.runner``.
+The audit orchestration itself lives in ``codejury.review.diff.engine``.
 """
 
 from __future__ import annotations
 
 import argparse
+import os
 import subprocess
 import sys
 from pathlib import Path
 
 from codejury import __version__
 from codejury.report import gate, render
-from codejury.review.diff.runner import audit_diff
+from codejury.review.diff.engine import audit_diff
 from codejury.providers.factory import (
     DEFAULT_API_BASE,
     DEFAULT_API_KEY,
@@ -39,6 +40,12 @@ _FORMATS = ("text", "markdown", "json", "sarif")
 _FAIL_ON = ("critical", "high", "medium", "low")
 
 
+def _default_workspace() -> str:
+    """A user-private default, since the workspace holds the auth model, exploit paths, and PoCs."""
+    base = os.environ.get("XDG_STATE_HOME") or str(Path.home() / ".local" / "state")
+    return str(Path(base) / "codejury" / "reviews")
+
+
 def _read_diff(args) -> str:
     if args.file:
         with open(args.file, encoding="utf-8") as f:
@@ -102,7 +109,9 @@ def main(argv: list[str] | None = None) -> int:
     _add_audit_args(rsub.add_parser("diff", help="audit a unified diff (the coded engine)"))
     repo = rsub.add_parser("repo", help="scaffold a whole-repo review for an interactive agent")
     repo.add_argument("directory", help="target repository to review")
-    repo.add_argument("--workspace", default="/var/tmp/codejury-review", help="where to create the review workspace")
+    repo.add_argument("--workspace", default=_default_workspace(),
+                      help="where to create the review workspace, defaults to a user-private "
+                           "directory under XDG_STATE_HOME or ~/.local/state")
     repo.add_argument("--fresh", action="store_true",
                       help="clear a previous review's output in the workspace first")
     repo.add_argument("--gate", action="store_true",
@@ -112,7 +121,7 @@ def main(argv: list[str] | None = None) -> int:
                       help="run the coded multi-pass engine over the repo, not just scaffold, "
                            "covers every unit each pass, cycles lenses, unions until convergence")
     repo.add_argument("--finalize", action="store_true",
-                      help="post-process an existing workspace's issues in code: dedup, "
+                      help="post-process an existing workspace's candidates in code: dedup, "
                            "adversarially verify, and write the ranked report, resumable")
     repo.add_argument("--dry-run", action="store_true",
                       help="run only: drive the engine with a mock provider and no key, to smoke-test the pipeline")
@@ -211,9 +220,10 @@ def _dispatch(args, parser) -> int:
         )
         kept = len(fr.verify.confirmed) if fr.verify else fr.deduped
         refuted = len(fr.verify.refuted) if fr.verify else 0
-        print(f"Finalize done: parsed {fr.parsed} issues -> {fr.deduped} after dedup -> "
+        print(f"Finalize done: parsed {fr.parsed} candidates -> {fr.deduped} after dedup -> "
               f"{kept} confirmed, {refuted} refuted, see {fr.workspace}/_refuted.md.")
-        print(f"Ranked report in {fr.workspace}/findings.json")
+        print(f"Confirmed findings in {fr.workspace}/findings/ and {fr.workspace}/findings.json, "
+              f"PoC reconciliation in {fr.workspace}/_pocs.md")
         if fr.verify and fr.verify.errors:
             print(f"WARNING: {fr.verify.errors} verification calls failed. Re-run to resume.", file=sys.stderr)
             return 1   # fail loud: an incomplete verification is not a clean finalize, invariant 3
@@ -259,7 +269,7 @@ def _dispatch(args, parser) -> int:
             print(f"WARNING: {failures} model calls failed, e.g. provider errors or rate limits. "
                   "Results may be understated. Lower --concurrency or raise --retries and re-run.",
                   file=sys.stderr)
-        print(f"Findings written to {res.scaffold.workspace}/issues/ and {res.scaffold.workspace}/findings.json")
+        print(f"Findings written to {res.scaffold.workspace}/findings/ and {res.scaffold.workspace}/findings.json")
         return 1 if failures else 0   # fail loud: a partial run must not exit clean, invariant 3
 
     if args.command == "review" and scope == "repo":
@@ -275,13 +285,13 @@ def _dispatch(args, parser) -> int:
             print(f"Detected stack: {', '.join(res.guides)}, notes in {res.workspace}/_stack.md", file=sys.stderr)
         print(f"Seeded {len(res.candidate_files)} candidate entrypoint files and "
               f"{len(res.trace_targets)} logic-layer trace targets into "
-              f"{res.workspace}/inventory/_candidates.md", file=sys.stderr)
+              f"{res.workspace}/inventory/_entrypoints.md", file=sys.stderr)
         print(f"Methodology: {res.workspace}/METHODOLOGY.md", file=sys.stderr)
         print(
-            "This command sets up the review, it does not find the issues itself. Next, have an "
+            "This command sets up the review, it does not find anything itself. Next, have an "
             f"interactive agent follow {res.workspace}/METHODOLOGY.md to run the review, or use the "
-            "/codejury-review-repo command in Claude Code or Codex. Findings are written to "
-            f"{res.workspace}/issues/."
+            "/codejury-review-repo command in Claude Code or Codex. The agent proposes findings in "
+            f"{res.workspace}/candidates/, finalize confirms them into {res.workspace}/findings/."
         )
         return 0
 

{codejury-1.0.0 → codejury-1.0.1}/codejury/guides.py

@@ -87,6 +87,8 @@ def logic_layer_globs(guides: list[Guide]) -> tuple[str, ...]:
 def load_guides(languages_dir=LANGUAGES_DIR, frameworks_dir=FRAMEWORKS_DIR, protocols_dir=PROTOCOLS_DIR) -> list[Guide]:
     # a guide's kind comes from its frontmatter, never from the directory it sits in, so the two cannot drift
     out: list[Guide] = []
+    # languages first, then frameworks, then protocols, select_guides keeps this order so a
+    # language guide outranks a framework guide when both fire on the same target
     for directory in (languages_dir, frameworks_dir, protocols_dir):
         out += [_guide(path, meta, body) for path, meta, body in iter_md_docs(directory)]
     return out

{codejury-1.0.0 → codejury-1.0.1}/codejury/knowledge/guides/languages/python.md

@@ -4,8 +4,6 @@ title: Python
 kind: language
 detect:
   files: ["*.py"]
-  manifest: []
-  imports: []
 entrypoint_files: ["*__main__.py", "*main.py", "*cli.py", "*/cli/*.py", "*/commands/*.py"]
 entrypoint_markers: ["argparse", "ArgumentParser", "click.command", "click.group", "@click.command", "@click.group"]
 logic_layers: ["*/services/*.py", "*services.py", "*/managers/*.py", "*managers.py", "*/dao/*.py", "*dao.py", "*/repositories/*.py", "*/repository/*.py"]

{codejury-1.0.0 → codejury-1.0.1}/codejury/knowledge/guides/protocols/oauth.md

@@ -3,7 +3,7 @@ id: oauth
 title: OAuth and OIDC
 kind: protocol
 detect:
-  content: ["grant_type", "authorization_code", "redirect_uri", "code_challenge", "response_type", "client_secret", "openid-configuration"]
+  content: ["grant_type", "authorization_code", "redirect_uri", "code_challenge", "response_type", "client_secret", "openid-configuration", "exchange_code"]
 ---
 # OAuth and OIDC Review Notes
 

{codejury-1.0.0 → codejury-1.0.1}/codejury/knowledge/vulnerabilities/cross-site-request-forgery.md

@@ -21,6 +21,20 @@ def change_email():
 ```
 Secure: keep CSRF protection on. Validate the token, or set the session cookie `SameSite="Lax"` and check the Origin header.
 
+### OAuth Login CSRF
+
+An OAuth callback that redeems the `code` and starts a session is a state-changing request. When it does not check a `state` value bound to the user's session, an attacker can hand the victim a code from the attacker's account and log the victim into it, login CSRF.
+
+Vulnerable:
+```python
+@app.route("/oauth/callback")
+def callback():
+    token = exchange_code(request.args["code"])   # no state check, any code is accepted
+    login(token)
+    return redirect("/")
+```
+Secure: issue a random `state` at authorize time, keep it in the session, and reject the callback unless the returned `state` matches.
+
 ### Not a Finding
 
 An endpoint authenticated by a bearer token read from JavaScript and sent in the `Authorization` header, not by an ambient cookie, is not CSRF. CSRF needs a credential the browser attaches automatically.

{codejury-1.0.0 → codejury-1.0.1}/codejury/knowledge/vulnerabilities/server-side-request-forgery.md

@@ -22,8 +22,8 @@ if urlparse(url).hostname not in ALLOWED_HOSTS:
 return requests.get(url).text
 ```
 
-A hostname allowlist alone is often not enough. Enforce `https`, reject credentials in the URL, resolve the host and block private, loopback, and link-local ranges, and re-check after each redirect. Prefer an exact destination allowlist.
+Stronger hardening adds defense in depth: enforce `https`, reject credentials in the URL, resolve the host and block private, loopback, and link-local ranges, and re-check after each redirect. Prefer an exact destination allowlist.
 
 ### Not a Finding
 
-A URL fetched only after an exact allowlist plus internal-IP blocking, with redirects controlled, is not SSRF. A constant or trusted-config URL is not SSRF.
+A URL fetched only after the parsed hostname is checked against a fixed allowlist by exact equality or membership before the fetch is the expected control and is not reportable without a concrete bypass. Report it only when the check is bypassable, such as a substring, suffix, or `startswith` match, an attacker-controlled allowlist, or a redirect followed with no re-check. Missing internal-IP blocking or redirect re-checks on top of an exact allowlist is hardening advice, not by itself an exploitable finding. A constant or trusted-config URL is not SSRF.

{codejury-1.0.0 → codejury-1.0.1}/codejury/playbook/false-positive-traps.md

@@ -17,7 +17,7 @@ recurring misjudgement, add it here.
 - `transaction.atomic()` plus a real row lock serializes concurrent redeems even
   on READ COMMITTED. The race only exists if no lock is taken on the contended row.
 
-## Input That Looks Attacker-Controlled But Is Not
+## Input That Looks Attacker-Controlled but Is Not
 
 - An id, ticket, or key read from the session, a signed cookie, or a server-set
   field is not attacker-controlled even though it arrives in the request object.
@@ -25,7 +25,7 @@ recurring misjudgement, add it here.
 - A value the framework derives from an authenticated identity, not from the
   request body, is trusted input.
 
-## Controls That Live Off the Handler Body
+## Controls That Live off the Handler Body
 
 - The auth, ownership, or signature check may be in a decorator, a middleware, a
   permission class, a base class, or a wrapper, not in the handler you are reading.
@@ -36,14 +36,14 @@ recurring misjudgement, add it here.
 
 - "The caller is authenticated", "the scheme fails closed", or "the token is
   single-use" do not by themselves make a request non-replayable. Conversely, if a
-  nonce IS consumed and a freshness window IS enforced, the replay concern is moot.
+  nonce is consumed and a freshness window is enforced, the replay concern is moot.
   Controlling fact: is the exact signed request accepted twice, or is a nonce
   consumed and a timestamp window checked?
 
 ## Trust Boundaries
 
 - A cross-service or cross-tenant read is only a finding if the two sides are
-  actually distinct trust domains. Decide ONCE whether a given principal, an internal
+  actually distinct trust domains. Decide once whether a given principal, an internal
   service role, a sibling tenant, a worker, is inside or outside the boundary, then
   apply that one answer to every finding touching it. Do not confirm one finding by
   treating the principal as hostile and refute another by treating the same principal

{codejury-1.0.0 → codejury-1.0.1}/codejury/playbook/methodology.md

@@ -31,7 +31,8 @@ The one irreducible human dependency, the credentials and go-ahead to run a PoC
 safely, is deferred to a separate phase and never asked for mid-run.
 
 Workspace: `<workspace>/<project>/`, created for you, holding `inventory/`,
-`units/`, `issues/`, and `pocs/`.
+`units/`, `candidates/`, `pocs/`, and `findings/`. You write proposals into
+`candidates/` and PoCs into `pocs/`. Finalize confirms them into `findings/`.
 
 ---
 
@@ -132,7 +133,7 @@ mandate below:
      owner vs tenant vs service, or only prove the caller is some valid user?
      Compare the unit's siblings and versions for a dropped or weakened check.
    - **Replay**: does a signed or authenticated privileged request both consume a
-     one-time nonce AND enforce a freshness window? A signature alone is not enough.
+     one-time nonce and enforce a freshness window? A signature alone is not enough.
    - **Concurrency**: is a check-then-act serialized by a lock held across the act?
      Read the real mechanism. A `select_for_update` whose result is discarded still
      holds the row lock on a production RDBMS inside a transaction, so judge against
@@ -169,8 +170,9 @@ cleared it, so a wrong clear is visible.
   on a privileged path that looks bounded lands at MEDIUM or higher and is reported,
   not refuted. When unsure between two levels, report at the higher and say why.
 
-Write each confirmed finding to `issues/<name>.md` with a runnable PoC at
-`pocs/<name>.<ext>`:
+Write each candidate finding to `candidates/<name>.md` with a runnable PoC at
+`pocs/<name>.<ext>` under the same `<name>`, so finalize can match the PoC to the
+confirmed finding it writes into `findings/`:
 
 ```markdown
 # <title>
@@ -216,6 +218,6 @@ evidence.
 
 The persistent workspace carries the settled work across runs, so a re-run extends
 coverage instead of restarting. A unit already marked `- Status: reviewed` is not
-re-reviewed, the findings in `issues/` are not re-derived, and a finding already
+re-reviewed, the proposals in `candidates/` are not re-derived, and a finding already
 verified is not re-litigated. A re-run, including after a usage limit, picks up the
 units still open and stops when the gate passes.

{codejury-1.0.0 → codejury-1.0.1}/codejury/playbook/slash-command.md

@@ -12,16 +12,20 @@ review in passing here is the shallow whole-repo pass this method exists to repl
 1. SCAFFOLD. Build the workspace, the deterministic worklist you do not invent:
 
    ```
-   codejury review repo $ARGUMENTS --workspace /var/tmp/codejury-review
+   codejury review repo $ARGUMENTS
    ```
 
+   The workspace defaults to a user-private directory under `XDG_STATE_HOME` or
+   `~/.local/state`, the same path for all three steps below, so they share one workspace.
+   Pass `--workspace <path>` to override it.
+
    If `codejury` is not on PATH it is a pip-installed console script, so activate the
    project venv first, for example `. .venv/bin/activate`, or run `python -m codejury`.
    If it reports a previous review's output in the workspace, ask me whether to clear
    it, and if I say yes, re-run with `--fresh`.
 
    RESUMING. If a previous run was interrupted, for example by a usage limit, just run
-   this command again WITHOUT clearing the workspace, answer no when it asks to clear. It
+   this command again without clearing the workspace, answer no when it asks to clear. It
    resumes and does not redo finished work: a unit already marked `- Status: reviewed`
    is skipped in the fan-out, and `--finalize` does not re-verify a finding it already
    settled. So an interruption loses no completed work, keep resuming in new sessions
@@ -55,19 +59,20 @@ review in passing here is the shallow whole-repo pass this method exists to repl
    libraries they call, hunts the high-impact classes, verifies each control on the
    code it actually reads, refutes its own candidates, grades every real finding by
    the rubric, CRITICAL through LOW, never refuted for low impact, writes each to
-   `issues/<name>.md`, and flips its unit to `- Status: reviewed`.
+   `candidates/<name>.md` with its PoC at `pocs/<name>.<ext>` under the same `<name>`,
+   and flips its unit to `- Status: reviewed`.
 
    Do not review units in this main context, only orchestrate. After the first pass,
    run more passes giving the units a different lead lens each time, authorization,
    then replay, then concurrency, then data exposure, then business logic, adding only
-   findings not already in `issues/`. The union grows along a different axis each pass.
+   findings not already in `candidates/`. The union grows along a different axis each pass.
    Stop when two consecutive passes add no new issue.
 
 4. FINALIZE. In code, do not dedup or verify in prose. Once the fan-out has covered the
    surface, run:
 
    ```
-   codejury review repo $ARGUMENTS --workspace /var/tmp/codejury-review --finalize
+   codejury review repo $ARGUMENTS --finalize
    ```
 
    In Claude Code, add `--reviewer claude-cli` to verify through your Claude Code access
@@ -82,7 +87,7 @@ review in passing here is the shallow whole-repo pass this method exists to repl
 5. GATE. Let codejury, not your judgment, decide whether the review may stop:
 
    ```
-   codejury review repo $ARGUMENTS --workspace /var/tmp/codejury-review --gate
+   codejury review repo $ARGUMENTS --gate
    ```
 
    If it exits non-zero it lists what is unmet: the surface not enumerated, a unit not
@@ -100,5 +105,6 @@ follow-up run I start later, do not pause to ask me mid-run.
 End with one report and then stop: confirmed findings as a table of title, class,
 `file:line`, severity, and status, the blocked findings each with its `Needs:`, the
 consolidated verification-needs list, and the coverage, units reviewed over units in
-the inventory. The issue files live in the workspace `issues/`. Do not ask me to
-continue, just finish and report.
+the inventory. The proposals live in the workspace `candidates/`, the confirmed
+findings finalize writes in `findings/`. Do not ask me to continue, just finish and
+report.

{codejury-1.0.0 → codejury-1.0.1}/codejury/playbook/unit-review.md

@@ -27,8 +27,15 @@ For every control on the path, decide on the code you actually read, never on th
 presence of a named control:
 
 - **Authorization granularity**: does the check scope to the right principal, owner
-  vs tenant vs service, or only prove the caller is some valid user? Compare sibling
-  endpoints and endpoint versions for a check present on one and dropped on another.
+  vs tenant vs service, or only prove the caller is some valid user? Compare siblings
+  for a control present on most and dropped on one. Siblings are not only sibling
+  endpoints and endpoint versions, but repeated branches in one handler, a query run
+  once per object type in a fan out, or one method in a set of similar methods. Where
+  most scope to the owner and one does not, that one is the likely IDOR.
+- **Disclosure on a list endpoint**: a list or ReadAll that returns a secret field, a
+  hash, token, password, or key, hands it to every caller allowed to list, including one
+  meant to see only a less privileged subset. Returning the hash of a write or admin
+  share to a viewer with read access is an escalation, not a clean list.
 - **Replay**: does a signed or authenticated privileged request both consume a
   one-time nonce and enforce a freshness window? A signature alone is not enough.
 - **Concurrency**: is a check-then-act serialized by a lock held across the act? A
@@ -47,7 +54,7 @@ report clean. The only things you do not report are dependency or component CVEs
 of this tool's scope, and a candidate the facts refute, the controlling fact holds when
 you read the code. Everything else that is real is reported, graded by the rubric.
 
-A weaker signal is a LOWER severity, not a dropped finding. A best-practice or
+A weaker signal is a lower severity, not a dropped finding. A best-practice or
 hardening gap, a config default, a debug or env-gated path, or a finding whose impact
 looks bounded is graded LOW or MEDIUM and surfaced, never suppressed. Noise is managed
 by severity, the reader sorts by it, it is not managed by you hiding findings. An
@@ -68,8 +75,8 @@ non-finding with a plausible word: "it is idempotent", "it yields the same token
 "it only returns status" lower the severity per the rubric, they do not make the
 finding disappear.
 
-Write each confirmed or blocked finding to `issues/<name>.md`: Risk, Type, Source as
+Write each confirmed or blocked finding to `candidates/<name>.md`: Risk, Type, Source as
 `METHOD /path`, Status, Analysis citing `file:line`, Attack Path, and Fix. Save a
-runnable PoC to `pocs/<name>.<ext>`. Record any cleared control with the controlling
-fact that cleared it, so a wrong clear is visible. Then set this unit's Status to
-`reviewed`.
+runnable PoC to `pocs/<name>.<ext>` under the same `<name>`, so finalize can match it.
+Record any cleared control with the controlling fact that cleared it, so a wrong clear
+is visible. Then set this unit's Status to `reviewed`.

{codejury-1.0.0 → codejury-1.0.1}/codejury/providers/anthropic.py

@@ -18,11 +18,18 @@ from codejury.providers.base import CompletionResult, Message, Provider
 
 class AnthropicProvider(Provider):
     def __init__(
-        self, *, api_key: str | None = None, base_url: str | None = None, client: Any | None = None
+        self,
+        *,
+        api_key: str | None = None,
+        base_url: str | None = None,
+        client: Any | None = None,
+        temperature: float | None = 0.0,
     ) -> None:
         self._api_key = api_key
         self._base_url = base_url
         self._client = client
+        # determinism: temperature 0 so the same input yields the same verdicts, invariant 2
+        self._temperature = temperature
 
     def _get_client(self) -> Any:
         if self._client is None:
@@ -53,16 +60,39 @@ class AnthropicProvider(Provider):
         if cache and system:
             system_param = [{"type": "text", "text": system, "cache_control": {"type": "ephemeral"}}]
 
-        response = self._get_client().messages.create(
-            model=model,
-            max_tokens=max_tokens,
-            temperature=0,  # determinism: same input gives the same verdicts, invariant 2
-            timeout=600,
-            system=system_param,
-            messages=[{"role": m.role, "content": m.content} for m in messages],
-        )
+        request: dict[str, Any] = {
+            "model": model,
+            "max_tokens": max_tokens,
+            "timeout": 600,
+            "system": system_param,
+            "messages": [{"role": m.role, "content": m.content} for m in messages],
+        }
+        response = self._create(request)
         return CompletionResult(text=_extract_text(response))
 
+    def _create(self, request: dict[str, Any]) -> Any:
+        client = self._get_client()
+        if self._temperature is None:
+            return client.messages.create(**request)
+        try:
+            return client.messages.create(temperature=self._temperature, **request)
+        except Exception as exc:
+            if not _is_temperature_rejected(exc):
+                raise
+            # drop it for this provider so later calls skip the rejected param, no wasted retry
+            self._temperature = None
+            return client.messages.create(**request)
+
+
+def _is_temperature_rejected(exc: Exception) -> bool:
+    """True when the API refused the call only because this model does not accept the
+    temperature param, the one error recovered from by dropping it. Matched on the message,
+    not a model name list, so a new reasoning model needs no code change."""
+    status = getattr(exc, "status_code", None)
+    if status != 400 and "BadRequest" not in type(exc).__name__:
+        return False
+    return "temperature" in str(exc).lower()
+
 
 def _extract_text(response: Any) -> str:
     content = getattr(response, "content", None)

{codejury-1.0.0 → codejury-1.0.1}/codejury/providers/litellm.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 from typing import Any, Callable
 
 from codejury.providers.base import CompletionResult, Message, Provider
-from codejury.providers.openai_format import choice_text
+from codejury.providers.chat_format import choice_text
 
 
 class LiteLLMProvider(Provider):

{codejury-1.0.0 → codejury-1.0.1}/codejury/providers/openai.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 from typing import Any
 
 from codejury.providers.base import CompletionResult, Message, Provider
-from codejury.providers.openai_format import choice_text
+from codejury.providers.chat_format import choice_text
 
 
 class OpenAIProvider(Provider):

codejury-1.0.0/codejury/review/diff/engine.py → codejury-1.0.1/codejury/review/diff/audit.py

@@ -1,6 +1,7 @@
-"""Standard diff-audit engine: one model call over a diff, parsed into Findings.
+"""Standard diff audit: one model call over a diff, parsed into Findings. The single-call
+unit the orchestrator in engine.py drives.
 
-The cheap, balanced default. The adversarial Finder/Challenger/Judge engine
+The cheap, balanced default. The adversarial Finder/Challenger/Judge runner
 builds on the same Finding domain for the cases that need higher
 coverage and lower false positives.
 """

codejury-1.0.0/codejury/review/diff/runner.py → codejury-1.0.1/codejury/review/diff/engine.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 import dataclasses
 
 from codejury.review.diff.adversarial import AdversarialAuditRunner
-from codejury.review.diff.engine import AuditRunner
+from codejury.review.diff.audit import AuditRunner
 from codejury.review.diff.filter import FindingsFilter
 from codejury.review.diff.vulnerabilities import allowed_categories, normalize_category
 from codejury.finding import Finding