jiffy-review — methodology & tiers

The jiffy review command performs a structured, four-pass review of an AI artifact bundle (skills, MCP definitions, agent configs, cursorrules, vector-store documents) and returns a confidence-tiered finding list. This page describes the model.

Four passes

Every jiffy review invocation runs these passes in order. Each pass consumes the prior pass's output; the server is authoritative (the CLI is a thin HTTP wrapper over /api/v1/review).

1. RECON — inventory. Lists every file submitted in the bundle

with its SHA-256 hash and byte length. Stable-sorted by path. No heuristics; purely catalogs what will be analyzed.

1. HUNTER — static rules. Runs the Sprint 25 MalSkills symbolic

rule set against an SDG derived from the artifact contents. Each hit carries a rule_id, severity, evidence_node_ids, and framework_codes (OWASP LLM 2025, MITRE ATLAS, NIST CSF 2.0).

1. ADVERSARIAL — attack-path detectors. Applies the 15 Jiffy

attack-path detectors (12 from Sprint 61, 3 added in Sprint R) to a minimal graph derived from the bundle. Also surfaces MalSkills pattern matches from the HUNTER pass so later triage can fold them.

1. TRIAGE — tier + CVSS assignment. Assigns each finding a

confidence_tier and, when derivable, an indicative CVSS 3.1 triple (vector, base, severity). Dedupes by the (detector_slug, target_artifact_uri) key, preferring the higher tier when the same slug lands twice.

Confidence tiers

Sprint R introduced a 3-tier validation scheme on top of Jiffy's existing intel confidence enum.

Tier–severity invariant

A theoretical tier finding cannot carry a high or critical severity. The publish path rejects such combinations (HTTP 400 from PATCH /api/admin/intel-entries/[id]), and migration 062's pre-check halts with exit 1 if any pre-existing row in the intel table would violate the rule after backfill. Operators re-review those rows manually; Jiffy does not auto-remediate.

Optional CVSS 3.1 metadata

Where an AIL value is known (from attestation.ail_level), Jiffy derives a CVSS 3.1 triple from the 16-cell decision table (web/src/lib/trust/cvss-decision-table.ts). The mapping is indicative, not authoritative — real CVSS analysts customize per-CVE. Customers who need bespoke CVSS override in their SIEM.

The CVSS output is exposed in two places:

1. /api/v1/trust response gains optional top-level ail_level and

cvss3 keys outside canonical_json. Signatures still verify byte-for-byte; the signing key is not rotated.

1. SARIF 2.1.0 output (properties.security-severity + cvss3_vector)

from both jiffy-review/sarif and scanner/sarif. GitHub Advanced Security, GitLab, and most SIEMs read security-severity natively.

MITRE ATT&CK coverage

Every rule emitted by the Sprint 25 symbolic engine has an explicit ATT&CK mapping at web/src/lib/jiffy-review/mitre-attack-mappings.ts. The source of truth is the TypeScript file; the table below is rendered at page-request time so the doc cannot drift. Rules with techniques: [] are LLM-specific patterns (prompt injection, jailbreak, content-layer stego) that have no clean core ATT&CK fit and are tracked under MITRE ATLAS AML.T0051 instead.

A machine-readable JSON export of the same matrix lives at /api/public/mitre-coverage.json (1h browser cache, 24h edge cache).

Jiffy covers 27 ATT&CK techniques across 8 tactics. 6 additional rules are LLM-specific and track under MITRE ATLAS AML.T0051.

Pipeline parity

The CLI (packages/jiffy-cli/src/commands/review.ts) is a thin HTTP wrapper; the server-side pipeline (web/src/lib/jiffy-review/review-pipeline.ts) is the single source of truth. A parity test (web/src/lib/jiffy-review/__tests__/review-parity.test.ts) asserts the CLI stdout JSON equals the server-handler JSON byte-for-byte (after redacting non-deterministic duration_ms fields) across three canonical fixture bundles (benign, plausible, confirmed). A drift would require someone to hand-port pipeline logic into the CLI — which the thin-wrapper design disallows.

Exit codes

Findings are not errors. A bundle that triggers every detector still exits 0 provided the HTTP request completes.

See also

• jiffy-review MCP tool — the MCP packaging of the

same pipeline for Claude Desktop / Cursor integrations.

• Arty design rules

for any UI derived from the CLI output.