Vulnerability Analysis, Judgment, Repair & Assurance

Status: Active research & production-ready sovereign security platform, featuring a 3-tier independent AI model architecture, a native multithreaded Rust core engine (vajra-core), a 7-stage independent verification proof matrix (including an SMT formal constraint solver), a universal multi-language Code Property Graph (CPG) engine, a risk-based blast radius prioritizer, a patch minimality evaluator, long-term adaptive learning, and a dual-shell client (a 100% serverless web edition plus a native desktop/CLI edition).

Platforms: macOS, Windows, Linux · Core: Multithreaded Rust (Rayon) · License: Apache 2.0 · Language: Python 3.10+

VAJRA is an evidence-driven cyber-reasoning and software-repair platform that connects the entire vulnerability-remediation lifecycle end to end, rather than stopping at "here's a list of problems" the way most scanners do:

Discover (Static AST + Rayon Rust Scanner + Performance Anti-Pattern Engine)
   ↓
Confirm (Tier 1: Security Analyst Model)
   ↓
Understand & Prioritize (Risk Score & Blast Radius Engine)
   ↓
Retrieve Causal Intent & Learned Memory (.vajra/knowledge_graph.json)
   ↓
Decide (Deterministic Fast Path vs Tier 2 Reasoning Model)
   ↓
Synthesize Minimal Patch (Patch Minimality & Cyclomatic Delta Evaluator)
   ↓
Generate Targeted Exploit PoC Sentinels & Fuzz Corpus
   ↓
Verify Independently (Tier 3 Adversarial 7-Stage Proof Matrix + Latency Profiler)
   ↓
Accept / Reject Atomically (Adaptive Learning Feedback Loop)
   ↓
Produce an Auditable Cryptographic Repair Assurance Record

The central design principle behind all of this: the reasoning model is never the source of truth. Specialized static and dynamic analyzers produce concrete evidence, the Decision Engine chooses a repair strategy from that evidence, repair synthesizers construct minimal candidate diffs, and an independent verification matrix — including SMT formal proving — rigorously checks patch correctness before any code is applied. In other words, an AI model is allowed to propose a fix, but it is never trusted to grade its own work.

1. Project Vision & Philosophy
2. 3-Tier Sovereign Model Architecture
3. Native Rust Core Engine (vajra-core)
4. Dual-Shell Client (Web vs Desktop)
5. Complete End-to-End Workflow
6. The 7-Stage Independent Verification Matrix
7. Universal Multi-Language Code Property Graph (CPG)
8. Risk Prioritization & Blast Radius Engine
9. Patch Minimality & Complexity Evaluator
10. AST-Based Performance & Code Optimization Engine
11. Long-Term Adaptive Learning & Outcome Tracking
12. Empirical Benchmark Telemetry & Visualizer
13. Supported Vulnerabilities & Repair Transformation Catalog
14. Decision Engine & Repair Routing
15. Universal Bootstrapper & Self-Updating Engine
16. Repository Structure
17. Installation & Bootstrapping Guide
18. Command-Line Interface (CLI) Reference
19. REST API Gateway Reference
20. CI/CD Pipeline & GitHub Actions Integration
21. Testing & Validation Suite
22. Configuration & Environment Variables
23. Security Model & Sandbox Containment
24. Evidence Schema & Cryptographic Assurance Record
25. Technology Strategy & Scalability
26. What VAJRA Does Not Claim
27. Research Questions & Evaluation
28. Future Roadmap & Planned Capabilities
29. License

VAJRA exists to eliminate the fatal flaws of both traditional static application security testing (SAST) tools and unconstrained LLM code generators:

1. Traditional SAST tools produce massive lists of alerts with no verified fix attached, which overwhelms development teams and trains them to ignore the noise.
2. Generative AI code models, left unconstrained, produce plausible-looking code that frequently hallucinates invalid APIs, breaks surrounding logic, or introduces subtle regressions — confidence with no proof behind it. VAJRA's answer to both problems is a single operating principle: Evidence, Not Confidence.

• Evidence First — a vulnerability is only treated as actionable if a deterministic AST trace or a dynamic sentinel proves the presence of an exploitable execution sink. No guessing from pattern-matching alone.
• Minimal Surgical Patching — rather than rewriting whole files (which is where most AI-generated regressions come from), VAJRA synthesizes the smallest AST transformation that removes the weakness.
• Independent Proof Requirement — code is never trusted just because an AI model generated it. Every candidate patch has to score a full 7 / 7 PASS across seven independent, adversarial verification stages before it is ever applied to a real file.

VAJRA deliberately splits reasoning across three separate model roles, so that no single model is ever asked to both propose and approve its own work:

┌────────────────────────────────────────────────────────────────────────┐
│                  TIER 1: SECURITY ANALYST MODEL (Confirmatory)         │
│  • Inputs: Static AST findings + surrounding code context.             │
│  • Role: Confirms whether a raw scanner finding is a genuine,          │
│          exploitable weakness, and produces structured evidence.       │
│  • INVARIANT: Confirms/classifies findings; NEVER writes patches.      │
└──────────────────────────────────┬─────────────────────────────────────┘
                                   │
                                   ▼
┌────────────────────────────────────────────────────────────────────────┐
│                 TIER 2: REPAIR REASONING MODEL (Prescriptive)          │
│  • Inputs: Normalized Evidence + Causal Git Intent Invariants.         │
│  • Role: Synthesizes minimal surgical AST patch diffs.                 │
│  • INVARIANT: Proposes candidate repairs; NEVER validates itself.      │
└──────────────────────────────────┬─────────────────────────────────────┘
                                   │
                                   ▼
┌────────────────────────────────────────────────────────────────────────┐
│              TIER 3: VERIFICATION & TEST MODEL (Adversarial)           │
│  • Inputs: Original Vulnerability + Proposed Candidate Patch.          │
│  • Role: Generates dynamic exploit PoC payloads, fuzzing boundaries,   │
│          and 3 adversarial patch mutants.                              │
│  • INVARIANT: Strictly adversarial; attempts to break the patch.       │
└────────────────────────────────────────────────────────────────────────┘

Each tier has exactly one job and is structurally prevented from doing the others. Tier 1 decides "is this real?", Tier 2 decides "how do we fix it?", and Tier 3 spends its entire effort trying to prove Tier 2 wrong. A patch only survives if it can withstand a model whose sole purpose is to break it.

Note: the diagram above includes the Tier 1 (Security Analyst) box reconstructed from what the rest of this document already says about Tier 1's role — the diagram itself was missing that box in the source draft. Worth double-checking against your actual model_independence.py wording before publishing.

To enable ultra-high-throughput scanning on multi-million-line monorepos, VAJRA includes a native multithreaded Rust core crate at crates/vajra-core:

• High-Concurrency Scanner (src/scanner.rs) — uses rayon parallel iterators and compiled regexes to scan thousands of files per second across every available CPU core.
• In-Memory Patch Mutation Engine (src/mutation.rs) — synthesizes three adversarial mutant variants in memory (REINJECT_UNSAFE_SINK, STRIP_VALIDATION_GUARD, PARAMETER_PERTURBATION) and computes exact kill scores in sub-millisecond time.
• Boundary Fuzz Corpus Synthesizer (src/fuzzer.rs) — a high-throughput byte generator that produces buffer-overflow payloads (64 KB and larger), command metacharacters, null-byte encodings, unicode bypasses, and path-traversal vectors.
• Causal Git History Archaeologist (src/git_history.rs) — inspects line-level blame and commit intent at native binary speed, so repairs can be informed by why a line was written the way it was.
• Zero-Failure Fallback Guarantee — the Python adapter (app/analysis/adapters/rust_adapter.py) automatically detects whether the compiled Rust binary is present and falls back to pure-Python AST parsing if it isn't, so a missing binary never breaks a scan — it just runs slower.

VAJRA ships in two synchronized editions that share the same visual identity (a pure black #000000 theme), full-window drag-and-drop ingestion, and the same Alt+N cross-platform hotkey:

               ┌────────────────────────────────────────────────────────┐
               │              VAJRA Entry Point & Launcher              │
               │  Web: https://Aravkataria.github.io/VAJRA/             │
               │  Native Desktop: VAJRA (Tauri v2 + vajra-core)         │
               │  CLI: vajra scan <path> / vajra --web                  │
               └──────────────────────────┬─────────────────────────────┘
                                          │
        ┌─────────────────────────────────┴─────────────────────────────────┐
        ▼                                                                   ▼
┌───────────────────────────────┐                   ┌───────────────────────────────┐
│     Web Edition (docs/)       │                   │    Tauri v2 Desktop / CLI     │
│  - 100% In-Browser AST Engine │                   │  - Featherweight Native Shell │
│  - Client-side JSZip Engine   │                   │  - In-Process vajra-core IPC  │
│  - Zero Server Infrastructure │                   │  - Zero Python Runtime Needed │
└───────────────────────────────┘                   └───────────────────────────────┘

The source draft lists the desktop verification row as a "6-Stage Proof Matrix" while the rest of the document (see Section 6) describes a 7-stage matrix that includes the SMT prover. Left as-is here since I can't tell which count reflects the current codebase — worth reconciling before you publish.

[1. INGESTION]
  ├─ Clones GitHub repo via API or Git
  ├─ Unpacks ZIP archive into isolated sandbox
  └─ Traverses local project directory
        │
        ▼
[2. AST STATIC ANALYSIS]
  ├─ Parses code into Abstract Syntax Trees (AST)
  ├─ Traces data flows to dangerous sinks (eval, exec, subprocess, pickle, yaml, SQL)
  └─ Generates structured finding records with file, line, and AST node keys
        │
        ▼
[3. DECISION ENGINE]
  ├─ Classifies finding: Deterministic vs Reasoning vs Decline
  ├─ Selects pre-verified defensive transformation template
  └─ Or constructs prompt with AST context for local reasoning model
        │
        ▼
[4. REPAIR SYNTHESIS]
  ├─ Constructs surgical, minimal candidate diff
  ├─ Verifies file integrity and snapshot bounds
  └─ Produces candidate modified file in staging sandbox
        │
        ▼
[5. 7-STAGE INDEPENDENT VERIFICATION]
  ├─ Stage 1: Syntax & AST Structural Integrity Check
  ├─ Stage 2: Static Sink Elimination Re-scan
  ├─ Stage 3: Dynamic Exploit Sentinel PoC Execution
  ├─ Stage 4: Baseline Regression Test Suite Run
  ├─ Stage 5: Boundary Input Fuzzing Campaign
  ├─ Stage 6: Patch Mutation Invariant Verification
  └─ Stage 7: SMT Formal Constraint Prover (Z3 Theorem Proving)
        │
        ▼
[6. ATOMIC APPLICATION & ASSURANCE]
  ├─ Applies verified patch atomically to source files
  ├─ Generates cryptographic Repair Assurance Record
  └─ Packages verified clean project as a downloadable .ZIP archive

Every stage in this pipeline exists to answer one question in isolation: is this really a bug, is this really the right fix, and is this fix really safe? Splitting the pipeline this way means a failure at any single stage doesn't just get logged — it routes back with concrete feedback so the next repair attempt can actually improve.

Every candidate patch must achieve a full 7/7 PASS before it's accepted. If any single stage fails, the patch is rejected and sent back to the reasoning engine along with the failure reason, for an iterative retry:

Candidate Patch
   │
   ├── [Stage 01] Syntax & AST Check
   │              Validates that modified code parses cleanly with zero syntax or compile errors.
   │
   ├── [Stage 02] Static Sink Re-scan
   │              Re-runs AST analysis to prove the dangerous sink node is completely removed.
   │
   ├── [Stage 03] Dynamic Sentinel PoC
   │              Executes concrete exploit payloads in ephemeral sandboxes to verify neutralization.
   │
   ├── [Stage 04] Baseline Regression Invariant
   │              Runs existing project unit tests to ensure zero functional regressions.
   │
   ├── [Stage 05] Boundary Input Fuzzing
   │              Fuzzes patched functions with edge cases, null bytes, unicode, and large buffers.
   │
   ├── [Stage 06] Patch Mutation Invariant
   │              Mutates the repair AST to prove the verification suite is sensitive (100% kill score).
   │
   └── [Stage 07] SMT Formal Constraint Prover (Z3 Theorem Proving)
                  Mathematically proves that the patch's guard and parameterization conditions
                  render the vulnerability sink condition unsatisfiable (UNSAT) for all inputs X:
                  ∀X: Guard(X) ⟹ ¬VulnerableSink(X)
   │
   ▼
[VERIFIED & APPLIED ATOMICALLY]

The first six stages are empirical — they run real code against real inputs and watch what happens. The seventh stage is the odd one out and the strongest: instead of testing more inputs, it mathematically proves the guard condition holds for every possible input, not just the ones that were tried.

Located in app/analysis/cpg_engine.py, this engine merges three complementary views of the code — AST (syntax), CFG (control flow), and DFG (data flow) — into a single queryable graph, across:

• Python (.py)
• JavaScript & TypeScript (.js, .jsx, .ts, .tsx)
• C & C++ (.c, .cpp, .h, .hpp)
• Rust (.rs)
• Go (.go)
• Java (.java) Merging all three views matters because a vulnerability is rarely visible from syntax alone — you also need to know what calls what (control flow) and where tainted data actually travels (data flow) to confirm a sink is reachable and exploitable rather than dead code.

Located in app/decision/risk_prioritizer.py, VAJRA calculates a multi-factor composite risk score (0.0 to 100.0) for every discovered vulnerability:

Risk Score = (35% × Severity) + (25% × Exploitability) + (20% × Reachability) + (10% × Git Recency) + (10% × Complexity)

This weighting means severity alone doesn't drive priority — a critical-severity bug in dead code scores lower than a moderate bug sitting on a hot, frequently-changed, easily reachable path.

Blast radius tiers:

• SYSTEM_WIDE (risk ≥ 85.0) — immediate priority for automated surgical repair.
• SERVICE (risk 65.0 – 84.9) — service-level impact.
• ISOLATED (risk < 65.0) — contained component risk.

Located in app/repair/minimality_evaluator.py, this engine scores candidate patches on how little they disturb the surrounding code:

• Line Delta (ΔLOC)
• AST Token Perturbation Distance
• Cyclomatic Complexity Delta (ΔCC)
• Invasiveness Score (0.0 – 100.0) When multiple candidate patches all pass verification, VAJRA doesn't just pick the first one that works — it strictly selects the candidate with the lowest invasiveness score (≤ 35%). The idea is that between two patches that are equally correct, the one that changes less is the one less likely to introduce something new.

Located in app/analysis/performance_engine.py, VAJRA pairs security vulnerability remediation with an autonomous performance optimization engine. When scanning a repository, VAJRA analyzes the AST for algorithmic inefficiencies, blocking operations, and redundant I/O, synthesizing verified speedups alongside security patches.

[AST SYNTAX TREE] ───► [PERFORMANCE ENGINE] ───► [LATENCY PROFILER] ───► [VERIFICATION PROOF]
                            │                           │
  PERF-01: Quadratic Lookup ├─ In-loop Hash Set         ├─ Speedup Delta (%)
  PERF-02: Async Blocking   ├─ Non-blocking Await       ├─ Before / After Latency (ms)
  PERF-03: Repeated Regex   ├─ Compile Hoisting         ├─ Memory Delta (Bytes)
  PERF-04: Repeated Disk IO ├─ Pre-buffering            └─ Zero-Regression Proof
  PERF-05: Quadratic Concat └─ str.join() Array

Every performance remediation produces a PerformanceProfile metric object:

• Baseline Latency (T_before) vs Optimized Latency (T_after)
• Speedup Delta: ΔSpeedup = ((T_before - T_after) / T_before) × 100%
• Memory Consumption Delta: ΔRAM (KB/MB)
• Dual Verification: Patches must satisfy both Stage 1–7 security invariants and baseline regression test invariants.

Located in app/storage/adaptive_learning.py:

• Persistent Knowledge Graph (.vajra/knowledge_graph.json) — automatically remembers verified fixes across every repository scan, so lessons learned on one codebase carry over to the next.
• 0 ms Fast-Path Retrieval — when an identical AST sink shows up again, in any project, VAJRA retrieves the already-proven remediation pattern instantly instead of re-reasoning from scratch.
• Sovereign Fine-Tuning Pipeline (scripts/fine_tune_repairer.py) — exports verified instruction pairs, (Evidence, Intent) -> Verified Patch, into standard JSONL format for offline LoRA fine-tuning, so the repair model can eventually be tuned on your own verified fix history.

VAJRA includes an empirical evaluation suite tested across 50 real-world CWE fixtures:

py -m tests.benchmark_suite

The "Fast-Path LLM Avoidance" number is arguably the most telling one here: it means well over half of confirmed findings never needed a model call at all — they were resolved deterministically, which is faster, cheaper, and removes an entire class of hallucination risk.

VAJRA includes specialized deterministic and reasoning repairers for the major vulnerability classes below.

• Vulnerable code:

  # Vulnerable: Arbitrary expression evaluation
  result = eval(user_input)
 
  # Vulnerable: Shell command injection
  os.system("echo " + user_input)
  subprocess.call(user_cmd, shell=True)

• VAJRA's minimal repair:

  # Repaired: Literal AST evaluation
  import ast
  result = ast.literal_eval(user_input)
 
  # Repaired: Shell-free parameter list execution
  import subprocess, shlex
  subprocess.run(shlex.split(user_cmd), shell=False, check=True, capture_output=True)

• Vulnerable code:

  # Vulnerable: Arbitrary Python bytecode execution
  data = pickle.loads(untrusted_bytes)
  config = yaml.load(raw_yaml)

• VAJRA's minimal repair:

  # Repaired: Safe serialized data formats
  import json
  data = json.loads(untrusted_bytes)
  config = yaml.safe_load(raw_yaml)

• Vulnerable code:

  # Vulnerable: Dynamic string concatenation inside query
  cursor.execute(f"SELECT * FROM accounts WHERE user = '{username}'")
  cursor.execute("DELETE FROM sessions WHERE token = '%s'" % token)

• VAJRA's minimal repair:

  # Repaired: Parameterized SQL statement
  cursor.execute("SELECT * FROM accounts WHERE user = ?", (username,))
  cursor.execute("DELETE FROM sessions WHERE token = ?", (token,))

• Vulnerable code:

  # Vulnerable: Static hardcoded secret in repository
  API_KEY = "AKIA1234567890SECRETKEY"
  DATABASE_PASSWORD = "SuperSecretPassword123!"

• VAJRA's minimal repair:

  # Repaired: Environment variable extraction
  import os
  API_KEY = os.environ.get("API_KEY", "")
  DATABASE_PASSWORD = os.environ.get("DATABASE_PASSWORD", "")

• Vulnerable code:

  # Vulnerable: Unvalidated filesystem path
  with open("/var/data/" + filename, "r") as f:
      content = f.read()

• VAJRA's minimal repair:

  # Repaired: Path containment check
  from pathlib import Path
  base = Path("/var/data").resolve()
  target = (base / filename).resolve()
  if not target.is_relative_to(base):
      raise PermissionError("Access denied: path traversal attempt")
  with open(target, "r") as f:
      content = f.read()

The Decision Engine routes every confirmed finding to the repair strategy best suited to it:

                     EVIDENCE AGGREGATOR
                             │
                             ▼
                      DECISION ENGINE
                             │
            ┌────────────────┼────────────────┐
            ▼                ▼                ▼
     [DETERMINISTIC]    [REASONING]       [DECLINE]
    Known safe fix     Contextual fix    Cannot safely
    pattern (<5ms)     via Local LLM     repair (Logs)

1. Deterministic Fast Path — when a context-free defensive fix already exists (e.g. yaml.load → yaml.safe_load), VAJRA generates and verifies the fix in under 5 ms with zero AI inference cost.
2. Context-Aware Reasoning Path — for complex, multi-line logic, VAJRA extracts the relevant AST context and prompts a local reasoning model (Ollama qwen2.5-coder) with iterative verification feedback loops.
3. Structured Decline — if a fix would alter the program's intended architecture, or the surrounding context isn't clear enough to repair safely, VAJRA logs a structured non-repair reason rather than gambling on a speculative patch.

VAJRA includes zero-friction installation scripts for every major operating system:

               ┌────────────────────────────────────────────────────────┐
               │              Universal Installation Core               │
               │  - Auto-provisions ~/.vajra isolated venv              │
               │  - Adds ~/.local/bin/vajra or .vajra\bin to PATH       │
               │  - Creates Desktop & Start Menu / Applications entry   │
               └──────────────────────────┬─────────────────────────────┘
                                          │
        ┌─────────────────────────────────┼─────────────────────────────────┐
        ▼                                 ▼                                 ▼
[macOS: install.sh]              [Linux: install.sh]             [Windows: install.ps1]
~/Applications/VAJRA.app         ~/.local/share/applications/    Desktop VAJRA.lnk

• Every time vajra is launched, it quietly queries the GitHub Releases API in the background.
• If a newer version is available, it downloads the update and atomically replaces the application files — without touching the existing virtual environment — then restarts into the updated version.
• Manual updates can also be triggered any time with vajra update.

VAJRA/
├── docs/                             # Standalone Serverless Web Edition (GitHub Pages)
│   ├── index.html                    # 100% Client-side AST analysis & drag-drop UI
│   └── benchmark/                    # Canonical Benchmark Evaluation Visualizer
│
├── crates/vajra-core/                # High-Performance Multithreaded Rust Engine
│   ├── Cargo.toml                    # Rust crate definition with Rayon & Serde
│   └── src/
│       ├── lib.rs                    # Crate exports
│       ├── main.rs                   # Native CLI interface
│       ├── scanner.rs                # Multi-threaded Rayon AST sink scanner
│       ├── mutation.rs               # In-memory adversarial patch mutator
│       ├── fuzzer.rs                 # Boundary fuzz corpus synthesizer
│       ├── reachability.rs           # Call-graph & import reachability indexer
│       └── git_history.rs            # Native git blame & intent indexer
│
├── scripts/                          # Universal Bootstrappers & Installers
│   ├── install.sh                    # macOS & Linux 1-line bootstrapper
│   ├── install.ps1                   # Windows PowerShell 1-line bootstrapper
│   └── fine_tune_repairer.py         # LoRA dataset exporter & training pipeline
│
├── src-tauri/                        # Tauri v2 Native Desktop Shell & Installers
│   ├── Cargo.toml                    # Desktop wrapper dependencies & vajra-core linkage
│   ├── tauri.conf.json               # NSIS, DMG, AppImage configuration & capabilities
│   ├── icons/                        # Complete multi-resolution application icon assets
│   └── src/                          # Tauri builder & in-process IPC command handlers
│
├── app/                              # Core Server & Python Tooling Engine
│   ├── launcher.py                   # Cross-platform CLI & headless scanner
│   ├── desktop_app.py                # Desktop application bridge
│   ├── api.py                        # FastAPI REST API & local server
│   ├── model_independence.py         # 3-Tier model independence enforcer
│   ├── analysis/                     # AST static analyzers, AST Performance Engine, CPG & Rust adapter
│   ├── decision/                     # Decision Engine & Risk Prioritizer
│   ├── evidence/                     # Evidence aggregator & schema
│   ├── repair/                       # Autonomous loop, deterministic repair & Minimality Evaluator
│   ├── report/                       # HTML/JSON Assurance Records & Benchmark Visualizer
│   ├── repository/                   # Workspace isolation, ZIP extraction, Git manager
│   ├── storage/                      # SQLite persistence & Adaptive Learning Engine
│   ├── verification/                 # 7-Stage independent verification matrix (SMT + Sandbox)
│   └── dashboard/                    # Chat UI & renderer
│
├── .github/workflows/
│   └── release.yml                   # Automated multi-platform Tauri & Rust CI/CD
│
├── tests/                            # Comprehensive automated test suite (50 test units)
├── requirements.txt                  # Python dependencies
├── pytest.ini                        # Pytest configuration
├── LICENSE                           # Apache 2.0 License
└── README.md                         # Project documentation

1. Download VAJRA-Setup.exe from Releases.
2. Double-click the file to open the native NSIS Setup Wizard.
3. Choose the installation mode (Anyone who uses this computer vs Only for me), pick a directory, and click Install.
4. VAJRA launches immediately, with Start Menu and Desktop shortcuts already created.

1. Download VAJRA-macOS.dmg from Releases.
2. Double-click the .dmg and drag VAJRA into your Applications folder.

1. Download VAJRA-Linux.AppImage from Releases.
2. Make it executable: chmod +x VAJRA-Linux.AppImage
3. Run it: ./VAJRA-Linux.AppImage

• Windows (PowerShell):

  irm https://raw.githubusercontent.com/Aravkataria/VAJRA/main/scripts/install.ps1 | iex

• macOS & Linux (Bash):

  curl -fsSL https://raw.githubusercontent.com/Aravkataria/VAJRA/main/scripts/install.sh | bash

Native Desktop & CLI (vajra-core + local AI engine)

Web Edition (100% in-browser & serverless)

• Supported browsers: Chrome, Safari, Firefox, Edge, Brave — across Windows, macOS, Linux, iOS, and Android.
• Hardware footprint: needs only 1 GB RAM and 0 MB of disk storage — forensic analysis and defensive repair execution run entirely in client-side RAM, with zero installation.

# 1. Launch Native Desktop App (Default)
vajra
 
# 2. Launch Local Web Dashboard in Browser
vajra --web --port 8000
 
# 3. Headless Terminal Security Scan
vajra scan /path/to/project
 
# 4. Machine-Readable JSON Output
vajra scan /path/to/project --json
 
# 5. Run 50-Fixture Empirical Benchmark Suite
vajra --benchmark
 
# 6. Check and Apply Updates from GitHub
vajra update

Start the local FastAPI server directly:

uvicorn app.api:app --reload --host 127.0.0.1 --port 8000

GET /health — returns system status, active verifiers, and loaded repair models:

{
  "status": "ok",
  "version": "2.4.0",
  "repair_modes": ["DeterministicRepairer", "AIRepairer"],
  "verifiers_ready": 6
}

POST /scan-github — clones and scans a public GitHub repository directly.

• Request:

  {
    "url": "https://github.com/Aravkataria/VAJRA-test",
    "branch": "main"
  }

• Response: returns a workspace ID, metadata, detected findings, generated diffs, and the verification proof matrix. POST /workspace/{id}/scan — executes AST analysis, repair synthesis, and the full verification matrix on an existing workspace.

GET /workspace/{id}/download-patched — streams a verified, clean, patched project archive as a .zip download.

GET /workspace/{id}/report.json — returns the complete cryptographic Repair Assurance Record.

VAJRA can be dropped straight into a GitHub Actions workflow to automatically scan pull requests and generate verified repair diffs.

Create .github/workflows/vajra-scan.yml:

name: VAJRA Autonomous Security Scan
 
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
 
jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
 
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
 
      - name: Install VAJRA
        run: |
          pip install -r requirements.txt
 
      - name: Run VAJRA Headless Security Scan
        run: |
          python -m app.launcher --scan . --json > vajra-report.json
 
      - name: Upload Security Assurance Report
        uses: actions/upload-artifact@v4
        with:
          name: vajra-assurance-report
          path: vajra-report.json

VAJRA includes unit, integration, and security verifier test suites, run with pytest:

# Run the complete test suite:
py -m pytest
 
# Run with verbose output and coverage:
py -m pytest -v --tb=short

============================= test session starts =============================
platform win32 -- Python 3.14.3, pytest-9.1.1, pluggy-1.6.0
rootdir: C:\Users\DELL\Desktop\vajra
configfile: pytest.ini
plugins: anyio-4.14.2
collected 50 items
 
tests\test_assurance_report.py ......                                    [ 12%]
tests\test_async_jobs.py .                                               [ 14%]
tests\test_dashboard.py .                                                [ 16%]
tests\test_fuzzing_verifier.py .                                         [ 18%]
tests\test_model_independence.py ....                                    [ 26%]
tests\test_mutation_verifier.py .                                        [ 28%]
tests\test_performance_engine.py ........                                [ 44%]
tests\test_regression_verifier.py ..                                     [ 48%]
tests\test_repair_pipeline.py ..                                         [ 52%]
tests\test_repair_retry_loop.py .                                        [ 54%]
tests\test_security_test_verifier.py ...........                         [ 76%]
tests\test_storage_memory.py .                                           [ 78%]
tests\test_syntax_checkers.py ......ssss                                 [ 98%]
tests\test_vector_memory.py .                                            [100%]
 
================== 46 passed, 4 skipped, 1 warning in 14.13s ==================

Because VAJRA inspects untrusted source code by design, it's built around a few strict defensive constraints:

1. Untrusted codebase input — every submitted source file, config, and piece of repository metadata is treated as untrusted data, never as trusted instructions.
2. Prompt injection resistance — source code is strictly parsed as Abstract Syntax Tree nodes, so an adversarial comment planted in the code can't override the repair rules.
3. Workspace path containment — every file operation validates that paths can't escape the sandbox root via .. traversal.
4. Execution isolation — sentinels and tests run inside isolated temporary sandboxes with strict execution timeouts, so a malicious or runaway payload can't affect the host.

Every completed analysis compiles into a structured, verifiable Assurance Record — the artifact you'd actually hand to an auditor:

{
  "target": {
    "repository": "vulnerable-api",
    "commit": "HEAD",
    "timestamp": "2026-08-31T20:00:00Z"
  },
  "findings": [
    {
      "file": "app/routes/auth.py",
      "line": 14,
      "vulnerability_type": "command_injection",
      "severity": "CRITICAL",
      "sink": "os.system"
    }
  ],
  "patches": [
    {
      "file": "app/routes/auth.py",
      "line": 14,
      "diff": "--- a/app/routes/auth.py\n+++ b/app/routes/auth.py\n@@ -14,1 +14,1 @@\n- os.system(cmd)\n+ subprocess.run(shlex.split(cmd), check=True)"
    }
  ],
  "verification_proof_matrix": {
    "syntax_ast_check": "PASS (0ms)",
    "static_sink_rescan": "PASS (0 residual sinks)",
    "exploit_sentinel_poc": "PASS (Neutralized)",
    "baseline_regression": "PASS (0 regressions)",
    "boundary_input_fuzzing": "PASS (Clean)",
    "patch_mutation_invariant": "PASS (100% sensitivity)"
  }
}

• Zero Inference Fast Paths — over 80% of standard vulnerability classes (SQLi, command injection flags, unsafe YAML loading, hardcoded credentials) are repaired in under 5 ms with zero GPU overhead.
• Client-Side Scalability — the Web Edition offloads all AST computation to visitor client CPUs, which lets it scale to effectively unlimited traffic on GitHub Pages at $0 server cost.
• Modular Polyglot Path — the AST architecture is deliberately designed for future extension into deeper JavaScript/TypeScript, Go, and Rust analyzers, beyond the Python-first coverage that exists today.

VAJRA does not claim that a piece of software is 100% defect-free under every condition. That would be an overreach no scanner can honestly make.

What VAJRA does claim is narrower and verifiable:

Evidence-based assurance that a specific identified weakness or performance anti-pattern was mitigated under a defined set of independent verification conditions, with zero detected regressions.

VAJRA is also a vehicle for exploring open questions in autonomous software engineering:

1. How much can deterministic AST evidence reduce the reasoning workload actually required from local LLMs?
2. Does a multi-stage verification matrix meaningfully prevent regressions compared to raw generative code models working without one?
3. Can in-browser WebAssembly and client-side AST reasoning eliminate server infrastructure costs entirely for enterprise developer tooling?

VAJRA is actively evolving into a comprehensive sovereign cyber-reasoning ecosystem with zero-friction automated remediation across local workstations and cloud version control systems.

[GITHUB / LOCAL TRIGGER]
          │
          ├──► 1. Automated GitHub PR Bot (API & App-based Contributor Permissions)
          │         - Clones repository via GitHub App credentials
          │         - Spawns isolated fix branch (vajra/fix-cwe-*)
          │         - Submits verified PR with signed cryptographic assurance record
          │
          ├──► 2. Tri-Model Sovereign AI Pipeline (3 Specialized Local Models)
          │         - Finder Model: High-speed AST & semantic vulnerability isolator
          │         - Fixer Model: Minimal cyclomatic perturbation repair synthesizer
          │         - Verifier Model: Adversarial sentinel & exploit PoC test generator
          │
          ├──► 3. Interactive Permission-Gated Local Auto-Repair
          │         - `vajra fix --interactive`: Prompts user before applying code diffs
          │         - Automated local rollback & git branch snapshot guarantees
          │
          └──► 4. IDE Language Server (LSP) & Polyglot Ecosystem
                    - Real-time diagnostic redline & 1-click in-editor remediation
                    - Native CPG support for Rust, Go, TypeScript, C/C++, and Java

• GitHub App & REST/GraphQL API Gateway: Directly integrate with GitHub webhooks to scan incoming pull requests, commits, and periodic cron audits.
• Contributor Permission Gating: With contributor or write authorization, VAJRA automatically provisions an isolated fix branch (vajra/fix-<vuln>-<timestamp>), applies surgical patches, and opens a ready-to-merge pull request.
• Auditable PR Commentary: Automatically posts full 7-stage verification matrices, AST diffs, and cryptographic assurance records directly into the pull request review body.

• Model 1: The Finder (Vulnerability & Flaw Detector) — Specialized 1.5B/3B parameter model trained to detect complex taint flows, semantic logic bugs, and algorithmic performance anti-patterns that evade simple static pattern matching.
• Model 2: The Fixer (Surgical Repair Synthesizer) — Reasoning model fine-tuned on verified minimal diffs, trained to produce non-invasive, style-preserving, single-hunk fixes with low cyclomatic delta ($&lt; 35%$ invasiveness).
• Model 3: The Verifier (Adversarial Sentinel & Test Synthesizer) — Independent model strictly isolated from the repair process, task-specific for synthesizing boundary test harnesses, dynamic exploit PoCs, and mutation invariants to stress-test candidate patches before acceptance.

• Interactive Approval Prompts: The CLI and Desktop shell will support --auto-apply with granular permission prompts ([Y/n/diff]), allowing developers to approve or customize patches before touching disk files.
• Safety-First Branching: Automatically creates safety checkpoints (e.g. git stash or atomic rollback staging trees) so that no file is permanently overwritten without 100% rollback capability.

• VS Code, Cursor, and JetBrains Plugins: Run the sovereign Rayon scanner directly inside the editor, highlighting vulnerabilities with real-time diagnostic squiggles and offering 1-click "Fix with VAJRA (Verified)" code actions.
• Full Polyglot AST/CPG Expansion: Broadening first-class semantic graph representations across Go, Rust, Java, C/C++, and JavaScript/TypeScript.

VAJRA is open-source software licensed under the Apache License 2.0.