Independent models read every file an AUR maintainer committed — the PKGBUILD, the .install hooks, the patches — looking for one thing: code injected into the packaging. They vote, and a stronger model rules on anything they flag. The application itself is never judged.
Every package audited
How a verdict is reached
Cheap models read every committed file and vote; a stronger one rules on anything they flag.
The boundary. Only the files in the package’s AUR repository are read — every one of them, wherever it sits, whatever it is called. What makepkg downloads from upstream is upstream’s and is never read: a malicious upstream is not an AUR attack, and an AUR maintainer cannot inject into it.
The audits. Cheap models — two or more, so they can disagree — each read every file on their own and return a verdict with the lines that earned it. Free models add advisory reads: the same audit, but the judge only reads it and it counts toward nothing. Any verdict that accuses is asked once more against the rules and kept only if it softens — a pass that can undo a false alarm and never create one.
The judge. When the audits disagree, or agree on a warning, a stronger model reads every report and rules. Most flags end here, cleared.
Escalation. A package still flagged gets a fresh audit from a stronger model that has not read it, then a fresh ruling — twice at most. Two distinct models saying unsafe with the judge agreeing is confirmed; still split after two rounds is models disagree.
Published. Every report, every ruling and every quoted line lands on this page. Nothing is edited by hand: a package the pipeline gets wrong is audited again, or the code is fixed.
Everything that decides a verdict is public; one private instance runs it.
Everything that decides a verdict is open source: the auditor, its prompts, the pipeline and the container image are all in github.com/mgalgs/aur-sleuth, and so are the reports, on its audit-reports branch.
What is private is the one instance that runs them: its schedule and daily budget, its API keys and deploy key, and the operations page that starts runs, reviews what a run produced, and publishes. A publish pushes the reviewed reports and the page rebuilt from them back to the same public repository. The results are inspectable even though the machine that produced them is not.