Deterministic hot path
Cheap, continuous and reproducible checks.
Frontier Collaboration
Use frontier intelligence without making it the final authority.
Claude, Codex and future security models can reason about novel vulnerabilities. CodeMarine supplies continuous deterministic coverage, bounded context and an independent validation gate.
The collaboration workflow is the product direction. Deterministic scanning and graph context exist today. Automated escalation and patch validation are planned. Current CODEMARINE FINDINGAuthorization boundary changed
Reachable from two external entry points.
Planned SECURITY CONTEXT PACKET3 files · 2 call paths · revision bound
Planned APPROVED MODELDeep investigation
Novel impact, exploit path and proposed remediation.
Division of labor
Each layer does the job it is good at.
Pattern quantity does not replace semantic reasoning. Model intelligence does not replace reproducible policy. CodeMarine keeps those roles separate and connects them through evidence.
FRONTIER MODELSCODEMARINE
Find novel, context-dependent vulnerabilities
Check known risk continuously and deterministically
Reason across business logic and intent
Track dependencies, agent tools and policy state
Explain impact and propose contextual fixes
Validate patches against revision, rules and tests
Investigate selected high-value cases
Control when code, data and budget may be shared
Governed workflow
From signal to durable control.
The frontier model operates inside a defined workflow. It can add evidence, challenge a finding and propose a patch. It cannot silently erase deterministic policy.
- 01CURRENT
Detect
CodeMarine scans the workspace, dependency graph and AI configuration.
- 02PLANNED
Route
Policy decides whether the case deserves local specialist or frontier investigation.
- 03PLANNED
Package
A bounded packet includes relevant files, call paths, evidence and sharing scope.
- 04PLANNED
Investigate
An approved provider returns a verified, rejected, uncertain or incomplete result.
- 05PLANNED
Validate
CodeMarine rescans an isolated patch and checks policy, provenance and tests.
- 06PLANNED
Retain
A verified discovery can become a tested deterministic regression rule.
Security context packets
Send less code. Send better context.
CodeMarine already knows parts of the call graph, finding evidence and dependency state. A model should not waste time rediscovering them or receive unrelated source by default.
Every future packet must state its revision, included scope, coverage gaps, redactions and why each source range was selected.
SCHEMAcodemarine.context/v1
- Revision
- 8fa2c1e
- Finding
- AUTHZ-021
- Source slices
- 3 bounded
- Call chains
- 2 reachable
- Secrets
- Excluded
- Coverage gaps
- Declared
Provider, model, budget and data policy are attached before transmission.
Local specialist tier
Compact security models narrow candidate files inside a constrained sandbox.
Frontier tier
Deep reasoning for selected novel or high-impact cases.
Local specialist models
A useful middle tier, if it earns its place.
Small open-weight security models may reduce the search space before a frontier call. Their output remains a candidate, not proof. CodeMarine will benchmark this tier before claiming support or performance.
- Read-only, network-disabled investigation scope
- Strict terminal allowlist and tool budget
- Model and weights revision recorded
- No clean-repository verdict from model output
- Independent verification before policy use
Independent patch gate
A model-reviewed patch is still a model-generated patch.
Remediation should happen in an isolated worktree and return through CodeMarine before it reaches the developer’s checkout or merge path.
Expected revision
The patch must apply to the finding’s exact code revision.
Finding eliminated
The original issue is rescanned or explicitly adjudicated.
No new risk
Code, dependency and protected-file checks run again.
Tests pass
Applicable project and policy tests complete successfully.
Evidence retained
The decision, provider and validation results remain attributable.
Cost and privacy
Continuous protection without continuous model spend.
Use local deterministic checks on every relevant event. Buy frontier reasoning only for the cases where semantic depth changes the decision.
CONTINUOUS PATHLocal deterministic
High-frequency checks. No model required.SELECTIVE PATHFrontier investigation
Policy-controlled cases only. Scope and budget recorded.Bars illustrate workflow frequency, not measured customer volume.
Early access
Bring frontier intelligence into a governed security workflow.
Keep deterministic policy independent. Use the best model for the cases that need it.
