audit-integrity

Apply a self-critique loop that re-verifies every finding cites concrete evidence like file paths, line numbers, or CVE IDs, then score the output across completeness, accuracy, actionability, consistency, and coverage. Any category scoring below 8 out of 10 triggers rework before delivery.

Use anti-rationalization guards that prohibit silent suppression of suspected false positives or out-of-scope items. Every potential false positive must be included with documented rationale for human review, and every clean category must state 'None detected' explicitly.

Yes, it includes domain-specific extensions for SAST/SCA agents covering taint trace completeness and dependency manifest coverage. It also supports STRIDE threat modeling, SonarQube-style code quality, and multi-tool pipeline agents with tailored checklists.

The retry protocol requires one retry with a refined query, then explicit documentation of the failure if the second attempt fails. Agents must distinguish 'tool found nothing' from 'tool failed to execute' and never silently skip a phase.

The self-learning system creates lesson records for false positives and missed findings, plus memory records for architecture decisions and codebase conventions. Agents check these artifacts at scan start and update or deprecate conflicting entries.