{
  "script_name": "secure-code-review-automation",
  "version": "1.0.0",
  "purpose": "Decision-support template for fine-tuned LLM-assisted secure code review triage.",
  "usage": {
    "description": "Populate the placeholders with your own policy, model, and workflow settings before use.",
    "required_inputs": [
      "diff_summary",
      "changed_files",
      "review_scope",
      "policy_rules",
      "model_endpoint",
      "output_schema"
    ]
  },
  "guardrails": {
    "allowed_actions": [
      "classify",
      "prioritize",
      "suggest_review_comment",
      "map_to_policy",
      "request_more_context"
    ],
    "disallowed_actions": [
      "approve_merge",
      "create_exception",
      "override_policy",
      "infer_runtime_state_without_evidence"
    ],
    "human_approval_required_for": [
      "high_severity_findings",
      "policy_exceptions",
      "merge_blocking_decisions"
    ]
  },
  "scope_controls": {
    "review_mode": "scoped-diff-only",
    "max_files": 25,
    "max_diff_lines": 2000,
    "allowed_paths": [
      "src/**",
      "services/**",
      "lib/**",
      "app/**"
    ],
    "redact_patterns": [
      "SECRET",
      "API_KEY",
      "PRIVATE_KEY",
      "PASSWORD",
      "TOKEN"
    ]
  },
  "model_configuration": {
    "model_name": "<fine-tuned-model-name>",
    "model_version": "<model-version>",
    "temperature": 0.1,
    "top_p": 0.9,
    "max_tokens": 512,
    "timeout_seconds": 30
  },
  "input_payload": {
    "pull_request_id": "<pr-id>",
    "repository": "<repository-name>",
    "branch": "<branch-name>",
    "diff_summary": "<summary-of-changes>",
    "changed_files": [],
    "review_scope": "<narrow-scope-definition>",
    "policy_rules": [],
    "historical_labels": []
  },
  "output_schema": {
    "type": "object",
    "required": [
      "finding_id",
      "risk_category",
      "severity",
      "confidence",
      "action",
      "rationale",
      "evidence",
      "needs_human_review"
    ],
    "properties": {
      "finding_id": {
        "type": "string"
      },
      "risk_category": {
        "type": "string",
        "enum": [
          "authentication",
          "authorization",
          "secrets",
          "cryptography",
          "input_validation",
          "deserialization",
          "configuration",
          "dependency",
          "other"
        ]
      },
      "severity": {
        "type": "string",
        "enum": [
          "low",
          "medium",
          "high",
          "critical"
        ]
      },
      "confidence": {
        "type": "number",
        "minimum": 0,
        "maximum": 1
      },
      "action": {
        "type": "string",
        "enum": [
          "ignore",
          "escalate",
          "comment",
          "request_context"
        ]
      },
      "rationale": {
        "type": "string"
      },
      "evidence": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "needs_human_review": {
        "type": "boolean"
      }
    }
  },
  "validation_checks": [
    "Verify the output matches the schema exactly.",
    "Reject malformed or free-form responses.",
    "Check that findings only reference evidence present in the scoped diff.",
    "Compare classifications against a frozen test set before deployment.",
    "Block any result that attempts to approve a merge or set policy exceptions.",
    "Redact secrets and sensitive tokens before model submission."
  ],
  "workflow": [
    "1. Load approved policy rules and current review scope.",
    "2. Redact secrets and normalize diff inputs.",
    "3. Submit only scoped changes to the model.",
    "4. Validate the model output against the schema.",
    "5. Apply deterministic policy checks.",
    "6. Route high-risk or low-confidence findings to a human reviewer.",
    "7. Record the model version, input hash, and decision outcome for auditability."
  ],
  "monitoring": {
    "metrics": [
      "false_negative_rate",
      "false_positive_rate",
      "policy_exception_rate",
      "schema_rejection_rate",
      "human_override_rate",
      "drift_indicator"
    ],
    "review_frequency": "weekly",
    "alerts_on": [
      "drift_indicator",
      "false_negative_rate",
      "schema_rejection_rate"
    ]
  },
  "deployment_notes": [
    "Use the model as decision support, not as an authoritative gate.",
    "Keep deterministic security checks outside the model.",
    "Version datasets, prompts, policies, and model artifacts separately.",
    "Re-run evaluation against the same frozen benchmark before each release.",
    "Limit access to training data and inference logs to approved operators only."
  ],
  "placeholder_examples": {
    "review_scope": "Only changes to authentication, authorization, secrets handling, input validation, or cryptographic code paths.",
    "policy_rules": [
      "Block unsafe secret handling.",
      "Escalate authz changes for specialist review.",
      "Request context for indirect deserialization paths."
    ],
    "historical_labels": [
      "blocked",
      "approved_with_comment",
      "escalated"
    ]
  }
}