What is a Review Capsule?
A Review Capsule is a structured, portable record of a security review. Rather than relying on ephemeral chat messages or unstructured model outputs, Linmas generates an explicit evidence bundle bound to the evaluated input bytes.
The Review Capsule provides proof of what was evaluated, which policy rules were executed, and what findings were generated. It does not certify that software is invulnerable or replace the judgment of an accountable human reviewer.
Core Components of a Capsule
| Field | Description | Purpose |
|---|---|---|
| Input Identity | SHA-256 hash of the exact reviewed input payload | Ensures review evidence cannot be swapped with an unreviewed artifact |
| Normalized Finding | Structured risk description, severity level, and impact statement | Removes model ambiguity and adheres to a strict defensive schema |
| Policy Decision | Deterministic outcome (e.g. PASS or BLOCKED) | Evaluated by deterministic code against configured threshold rules |
| Human Review Flag | Always set to true (humanReviewRequired) | Enforces human accountability for all security decisions |
| Execution Metadata | Timestamp, skill version, and execution environment (offline replay vs live engine) | Provides an audit trail for compliance and peer review |
Why SHA-256 Input Binding Matters
AI coding tools often modify files iteratively. Binding the capsule to the exact SHA-256 digest of the input prevents silent substitution: if code changes after the review is completed, the digest no longer matches, requiring a re-review of the updated patch.
Using Capsules in CI/CD
Review Capsules can be archived alongside pull requests or build artifacts to maintain a record of defensive due diligence. Because the capsule format is deterministic JSON, automated pipelines can inspect decisions and ensure blocking findings are resolved before deployment.