contract-review

From README

Contract Review (deep) (A04:2025) What this checks Bugs that only resolve across both sides of a contract — a helper whose body guarantees less than callers assume. security-review pattern-matches 45 OWASP/LLM categories; this exists for what that misses. Nightly CI or manual audits; not per-PR. Vulnerable patterns Deliberately none. Pattern lists bias the search; contract-audit uses one open question per hotspot — what does the caller assume that the body doesn't enforce? — and the orchestrator does not inspect code. Procedure Use the Agent tool to dispatch subagents. Don't audit yourself. Keep state in conversation memory; don't write files. Stage 0 — Threat model Dispatch one threat-modeling subagent. Keep its JSON in conversation context; thread it into every later subagent. Stage 1 — Hotspot seed Dispatch one hotspot-mapping subagent with the threat model JSON.