Review rubric
Apply both lenses to the actual deliverables. These criteria are adapted from public sources; neither Jason Haddix nor any upstream author reviewed this package. One author applying two lenses is still one review.
| Lens | Criterion | Evidence required | Blocking failure | Source |
|---|---|---|---|---|
| Discovery and coverage | D1 — Map beyond the main endpoint | Explicit entry points, supporting systems, roles and unknowns | Invented assets or important supplied boundaries omitted | M2/M3; JH1 Discovery, Mapping and checklist |
| Discovery and coverage | D2 — Make priorities useful | Each priority traces to a boundary, evidence gap and expected secure result | Tool shopping list without investigation questions | M6; JH1 Privilege, Transport, Logic |
| Evidence and reporting | E1 — Keep scope separate from clues | Scope and ownership fields plus excluded/unresolved assets | A certificate, related company or prompt expands authorization | M1/M5; JH2 Setting Scope, JH3/JH4 behavior, project adaptation |
| Evidence and reporting | E2 — Distinguish lead, check and finding | Source/date, claim status, not-run tests and exact asset references | Heuristic alert treated as confirmed issue, or untested treated as safe | M4/M7; JH2 Scanner/Methodology, JH1 Philosophy |
| Evidence and reporting | E3 — Preserve provenance and limits | Attribution, adaptation labels and privacy boundary | Jason credited with a fork's unrelated research; real assessment data published | JH1/JH2 authorship; project data-handling adaptation |
For an out-of-scope case, discovery criteria pass only if the output explicitly avoids manufacturing a map and routes to the appropriate activity. Missing evidence is unverified, not a pass. Acceptance requires every applicable blocking criterion to pass; record an applicability reason for any exclusion.
Evaluation status
Validated for the bounded synthetic Codex run documented in the study validation note. Final practical cases: 4/4 accepted with the package loaded, versus 1/4 baseline outputs accepted under the frozen rubric. Final automatic discovery: 4/4. Initial failures, two revisions, explicit invocation versus automatic selection, review evidence gaps and shared-model limits are preserved in that note. These results establish neither universal expertise nor security effectiveness, practitioner approval or cross-client compatibility.