GhostJury

Multi-model deliberation engine for security code review.

Submit code. GhostJury empanels a jury of 5 independent LLMs, each returns a binary verdict with reasoning, and the aggregated result is hash-chained so votes and appeals bind to the exact analysis that produced them.

         ┌─────────────┐
         │  Submission │
         └──────┬──────┘
                ▼
         ┌─────────────┐
         │    Triage   │  Haiku 4.5 — "worth empaneling a jury?"
         └──────┬──────┘
                ▼
    ┌───────┬───┴───┬────────┬───────┐
    ▼       ▼       ▼        ▼       ▼
 Sonnet  Opus   GPT-5.2  o4-mini  Grok 4
    │       │       │        │       │
    └───────┴───┬───┴────────┴───────┘
                ▼
         ┌─────────────┐
         │  Synthesis  │  rule-based aggregation
         └──────┬──────┘
                ▼
         ┌─────────────┐
         │   Verdict   │  APPROVED │ REVIEW │ REJECTED
         └─────────────┘

Cost per audit (verified 2026-04-14)

Per-audit assumptions: ~3,500 input tokens / ~200 output tokens per juror, plus a Haiku triage call. Prompt caching is enabled by default on Claude jurors — the ~800-token system prompt becomes a cache hit after the first call, so subsequent jurors and the triage all read it at a 90% discount.

* Estimate, see pricing.py for confidence tier and source.

At volume, with a Haiku triage that skips ~90% of trivial submissions:

Without the triage gate the numbers are roughly 10× higher — the gate is the primary cost lever.

Voting rule

Each juror returns { malicious: bool, reason: str } on a submission. GhostJury aggregates:

Fail-closed posture. Any juror flag bumps the submission out of auto-approve.

Hash chain

Every verdict carries a verdict_hash derived from:

sha256(
  submission_sha      ||
  triage_result_json  ||
  jurors_json         ||  # all 5 juror verdicts, in roster order
  synthesis_json      ||
  roster_json            # model versions + juror order
)

This matters because when users sign votes on the public page, their signature binds to the specific analysis, not the submission id. Editing the analysis invalidates every existing signature — which is the point.

Install

pip install ghostjury

Quick start

No network — safe demo path:

ghostjury audit path/to/script.py --mock

Real jury (requires API keys):

export ANTHROPIC_API_KEY=sk-ant-...
export OPENAI_API_KEY=sk-...
export XAI_API_KEY=xai-...

ghostjury audit path/to/suspicious_script.py

The CLI refuses to start a real jury with partial keys — it checks every provider in the default roster first and lists exactly which env vars are missing. No half-juries, no wasted tokens.

Architecture

• schema.py — Pydantic models for every artifact
• hashing.py — content-hash computation
• prompts.py — triage + juror system prompts
• pricing.py — per-model cost estimates (audit and update before production)
• router.py — backend abstraction: MockBackend for tests, HttpxBackend for real calls
• triage.py — Haiku 4.5 gate
• jury.py — juror orchestration (currently sequential; becomes parallel once ghostrouter ships execute_parallel)
• synthesis.py — rule-based verdict aggregation
• cli.py — command-line entry

License

Apache 2.0.