You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**4 critics** — Correctness, Completeness, Security (OWASP ASVS 5.0, CWE Top 25, NIST SA-11; see [SEC-02 workflow](docs/SEC02_BUSINESS_LOGIC_VALIDATION.md) for business logic validation guidance), Code Hygiene (ISO 25010:2023, CISQ) — all with evidence grounding
194
194
-**Parallel execution** — critics run concurrently (ThreadPoolExecutor, max 4); batch files run concurrently (max 3)
195
195
-**Re-validation loops** — Fixer proposes text replacements for CRITICAL/HIGH findings → applies them → re-runs only the critics that flagged the originals → reports improved/unchanged/regressed. Up to 3 loops, stops early when findings clear. `--fix-loops N` or `--depth thorough` (default 1 loop)
196
196
-**Learning memory** — tracks recurring failure patterns across runs in `known_issues.json`. High-frequency patterns auto-promote to mandatory checks injected into critic prompts. `quorum issues list|promote|reset` CLI. Disable with `--no-learning`
197
197
-**Multi-layer pre-screen** — 10 built-in deterministic checks + **DevSkim SAST** + **Ruff S-rules** (Python security) + **Bandit** (Python security, deduplicated with Ruff) + **PSScriptAnalyzer** (PowerShell security) — all run before any LLM, all gracefully degrade if not installed
198
-
-**Batch validation** — `--target ./dir/` or `--pattern "*.md"`to validate many files at once; get a consolidated `BatchVerdict`
198
+
-**Crash-resilient batch validation** — `--target ./dir/` or `--pattern "*.md"`with progressive manifest saves after each file. Graceful SIGTERM/SIGINT shutdown preserves all work. `--resume <batch-dir>` picks up where a crashed or interrupted run left off — only pay for remaining files
199
199
-**Cross-artifact consistency** — `--relationships quorum-relationships.yaml` to declare implements/documents/delegates/`threat_context` relationships between files and check them (`threat_context` type supports authorization boundary review per SEC-04)
200
200
-**Structured output resilience** — critic JSON responses strip markdown fences before parsing; reduces parse failures on model outputs that wrap JSON in code blocks
- Full audit trail for every run (timestamped run directory with prescreen.json, critic JSONs, verdict.json, fix-proposals-loop-N.json, report.md)
205
+
-**Cost tracking** — per-call token counts and cost via LiteLLM. Pre-run cost estimates with confirm prompt. `--max-cost $10` budget cap stops gracefully and saves work. Per-file cost breakdown in CLI output and run manifest
206
+
-**CSV audit reports** — `--audit-report` (auto-enabled at `--depth thorough`). Produces `audit-detail.csv` (per-file: SHA-256, timing, tokens, models, cost) and `audit-summary.csv` (aggregates: duration, tokens/sec, cost by model, pass/fail)
207
+
- Full audit trail for every run (timestamped run directory with prescreen.json, critic JSONs, verdict.json, fix-proposals-loop-N.json, report.md, audit CSVs)
206
208
- Available on PyPI: `pip install quorum-validator` | ClawHub: `openclaw skills add dacervera/quorum`
0 commit comments