+- `/audit` gained an adjudication phase that runs between verification and artifact generation. Each verified finding faces a panel of three independent reviewers, each told to refute it from a different angle (reachability, threat model, severity), and only findings confirmed by a majority make it into reports and patches. Survivors get their severity recalibrated down to the realistic worst case, and dropped findings are listed in the README with the reason, so the gap between verified and written counts is always explained.
0 commit comments