Add inference-time threat evidence critic

[arthurpanhku]

What changed

• add an inference-time Evidence Critic for Design/STRIDE threat findings, using one batched verifier call, stable current-document passage IDs, exact locators, and fail-safe abstention
• normalize threat-model output and extend the report contract with support, contradiction, insufficient-evidence, confidence, and mandatory human-review fields
• add a public threat-evidence panel plus an architecture walkthrough for the demo path
• add grounding metrics, contract coverage, backend/frontend tests, and evaluation tests in CI
• update React Router to the patched 7.18.1 release required by the production dependency audit

Why

DocSentinel could previously emit threat citations without independently checking whether the cited document text actually supported each threat claim. This focused vertical slice makes claim-level evidence visible and measurable without training or fine-tuning.

Impact

• pure inference-time feature; no model training or fine-tuning required
• one additional batched inference call for eligible Design assessments when enabled
• all verifier verdicts remain advisory and require human review
• verifier or parse failures degrade to insufficient_evidence

Validation

• .venv/bin/ruff check .
• .venv/bin/pytest -q — 117 passed
• .venv/bin/pytest -q evals/tests — 5 passed
• .venv/bin/python scripts/export_contracts.py --check
• npm ci --prefix frontend
• npm audit --omit=dev --prefix frontend — 0 vulnerabilities
• npm run check --prefix frontend — 4 files / 6 tests passed
• npm run build --prefix frontend
• browser smoke test of client navigation, deep-link refresh, all three verdict states, and exact evidence locators

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router-dom@​6.30.4 ⏵ 7.18.1	+3	+2	-9

View full report