Triage memory-safety findings in source code

Goal

Produce a deduplicated, reviewed vulnerability report with source locations.

Steps

1. Record code-owner authorization, target directory, and read-only sandbox; pass an ENGAGEMENT_CONTEXT with scope and responsible-disclosure rules. [security]
2. Interview to build a threat model on the canary target, then use Agent SDK query() with allowed_tools=["Read","Grep","Glob"] and disallowed_tools=["Bash"] to find issues. [security]
3. Have a separate triage run re-read source to verify lines, merge same-root-cause findings, and recalibrate severity; emit explicit-schema JSON and validate with jsonschema. [security]

How to verify

Each reported issue maps to real source lines and survives independent verification; known canary bugs are found and no unauthorized directory is accessed.

Troubleshooting

Do not run against unauthorized targets; if the SDK/CLI is unavailable or output schema validation fails, stop automated grading and route to a human security reviewer.