Deterministic hot path
Cheap, continuous and reproducible checks.
CodeMarine Dev · Frontier Models
Use frontier intelligence without making it the final authority.
Claude, Codex and approved security models can reason about novel vulnerabilities. CodeMarine supplies continuous deterministic coverage, bounded context and an independent validation gate.
Current CODEMARINE FINDINGAuthorization boundary changed
Reachable from two external entry points.
Planned SECURITY CONTEXT PACKET3 files · 2 call paths · revision bound
Planned APPROVED MODELDeep investigation
Novel impact, exploit path and proposed remediation.
Each layer does the job it is good at.
Models handle novel reasoning. CodeMarine handles continuous policy, evidence and validation.
FRONTIER MODELSCODEMARINE
Find novel, context-dependent vulnerabilities
Check known risk continuously and deterministically
Reason across business logic and intent
Track dependencies, agent tools and policy state
Explain impact and propose contextual fixes
Validate patches against revision, rules and tests
Investigate selected high-value cases
Control when code, data and budget may be shared
From signal to durable control.
The model investigates and proposes. CodeMarine validates the result against policy.
- 01CURRENT
Detect
CodeMarine scans the workspace, dependency graph and AI configuration.
- 02PLANNED
Route
Policy decides whether the case deserves local specialist or frontier investigation.
- 03PLANNED
Package
A bounded packet includes relevant files, call paths, evidence and sharing scope.
- 04PLANNED
Investigate
An approved provider returns a verified, rejected, uncertain or incomplete result.
- 05PLANNED
Validate
CodeMarine rescans an isolated patch and checks policy, provenance and tests.
- 06PLANNED
Retain
A verified discovery can become a tested deterministic regression rule.
Send less code. Send better context.
Give the model relevant files, call paths, evidence and policy instead of the whole repository.
Each packet records its revision, included files, redactions and sharing scope.
SCHEMAcodemarine.context/v1
- Revision
- 8fa2c1e
- Finding
- AUTHZ-021
- Source slices
- 3 bounded
- Call chains
- 2 reachable
- Secrets
- Excluded
- Coverage gaps
- Declared
Provider, model, budget and data policy are attached before transmission.
Local specialist tier
Compact security models narrow candidate files inside a constrained sandbox.
Frontier tier
Deep reasoning for selected novel or high-impact cases.
A useful middle tier, if it earns its place.
Small local models can narrow candidate files before a frontier call. Their output remains evidence, not proof.
- Read-only, network-disabled investigation scope
- Strict terminal allowlist and tool budget
- Model and weights revision recorded
- No clean-repository verdict from model output
- Independent verification before policy use
A model-reviewed patch is still a model-generated patch.
Build it in isolation, then rescan it before merge.
Expected revision
The patch must apply to the finding’s exact code revision.
Finding eliminated
The original issue is rescanned or explicitly adjudicated.
No new risk
Code, dependency and protected-file checks run again.
Tests pass
Applicable project and policy tests complete successfully.
Evidence retained
The decision, provider and validation results remain attributable.
Continuous protection without continuous model spend.
Run local checks on every change. Buy frontier reasoning only when semantic depth changes the decision.
CONTINUOUS PATHLocal deterministic checks
Run on every relevant change without a model call.
SELECTIVE PATHFrontier investigation
Runs only when policy escalates a case. Scope and budget are recorded.
Use frontier intelligence inside a governed workflow.
Escalate the cases that need deep reasoning, then validate every result against independent policy.
