local-review-harness

profit/local-review-harness

Fork 0

Commit Graph

Author	SHA1	Message	Date
Claude (review-harness setup)	ab550a7c5a	Apply B5 from 2026-04-30 scrum — scanner skip-list scoped to harness self Opus-only BLOCK from the cross-lineage scrum: pre-fix SkipDirs basename-matched bin/build/dist/target/reports for ANY repo, silently excluding legitimate source dirs on real targets. The lakehouse Rust repo has reports/ holding markdown; some Java/ Python/Go projects use bin/ as a source dir; target/ is project- specific. Skipping them globally produced silent false-negative scans the operator would never know about. Fix: trim SkipDirs to dirs that are universally not source code — .git, .hg, .svn (VCS metadata); node_modules, vendor (dep caches); __pycache__, .venv, venv (Python envs); .idea, .vscode (editor state). Removed: bin, build, dist, target, reports. For the harness's own self-skip (it shouldn't scan its own bin/ or reports/), added path-scoped skip via selfSkipsFor — detects "this is the harness repo" by the presence of BOTH cmd/review-harness/ AND internal/analyzers/ subdirs (combination unique to this codebase), then skips the absolute paths bin/ and reports/ for that scan only. Two regression tests: - TestWalk_DoesNotSkipBinReportsInTargetRepo plants files under bin/, reports/, build/, dist/, target/ in a synthetic target repo; asserts all 5 appear in scan, while .git/ + node_modules/ + vendor/ are still skipped. - TestWalk_SelfSkipsBinReportsInHarnessRepo plants the harness's marker dirs (cmd/review-harness/, internal/analyzers/) plus bin/ + reports/ + ordinary src/; asserts self-skip fires on bin/+reports/ but real src/ scans normally. Compiled artifacts inside bin/ are filtered by the analyzers' isTextLike extension check (.exe / .dll / .so), so target repos with bin/ holding compiled output don't waste cycles decoding it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-30 01:34:45 -05:00
Claude (review-harness setup)	f3ee4722a8	Phase A + B (MVP) — local review harness Implements the MVP cutline from the planning artifact: - Phase A: skeleton + CLI dispatch + provider interface + stub model doctor - Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline - Phase B fixtures: clean-repo, insecure-repo, degraded-repo 12 static analyzers per PROMPT.md "Suggested Static Checks For MVP": hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors, secret_patterns, large_files, todo_comments, missing_tests, env_file_committed, unsafe_file_io, exposed_mutation_endpoint, hardcoded_local_ip. Acceptance gates passing: - B1 (intake produces accurate counts) ✓ - B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓ - B3 (clean fixture produces 0 confirmed findings — no false positives) ✓ - B4 (scrum mode produces all 6 required markdown + JSON reports) ✓ - B5 (receipts.json marks degraded phases honestly) ✓ - F (self-review on this repo runs without crashing) ✓ — exit 66 (degraded because Phase C LLM review is hardcoded skipped) Phases C (LLM review), D (validation cross-check), E (memory + diff + rules subcommands) deferred per the cutline. The MVP delivers the evidence-first path; LLM is purely additive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-30 00:56:02 -05:00

Author

SHA1

Message

Date

Claude (review-harness setup)

ab550a7c5a

Apply B5 from 2026-04-30 scrum — scanner skip-list scoped to harness self

Opus-only BLOCK from the cross-lineage scrum: pre-fix SkipDirs
basename-matched bin/build/dist/target/reports for ANY repo,
silently excluding legitimate source dirs on real targets. The
lakehouse Rust repo has reports/ holding markdown; some Java/
Python/Go projects use bin/ as a source dir; target/ is project-
specific. Skipping them globally produced silent false-negative
scans the operator would never know about.

Fix: trim SkipDirs to dirs that are universally not source code —
.git, .hg, .svn (VCS metadata); node_modules, vendor (dep caches);
__pycache__, .venv, venv (Python envs); .idea, .vscode (editor state).
Removed: bin, build, dist, target, reports.

For the harness's own self-skip (it shouldn't scan its own bin/
or reports/), added path-scoped skip via selfSkipsFor — detects
"this is the harness repo" by the presence of BOTH
cmd/review-harness/ AND internal/analyzers/ subdirs (combination
unique to this codebase), then skips the absolute paths bin/ and
reports/ for that scan only.

Two regression tests:
- TestWalk_DoesNotSkipBinReportsInTargetRepo plants files under
  bin/, reports/, build/, dist/, target/ in a synthetic target
  repo; asserts all 5 appear in scan, while .git/ + node_modules/
  + vendor/ are still skipped.
- TestWalk_SelfSkipsBinReportsInHarnessRepo plants the harness's
  marker dirs (cmd/review-harness/, internal/analyzers/) plus
  bin/ + reports/ + ordinary src/; asserts self-skip fires on
  bin/+reports/ but real src/ scans normally.

Compiled artifacts inside bin/ are filtered by the analyzers'
isTextLike extension check (.exe / .dll / .so), so target repos
with bin/ holding compiled output don't waste cycles decoding it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-30 01:34:45 -05:00

Claude (review-harness setup)

f3ee4722a8

Phase A + B (MVP) — local review harness

Implements the MVP cutline from the planning artifact:
- Phase A: skeleton + CLI dispatch + provider interface + stub model doctor
- Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline
- Phase B fixtures: clean-repo, insecure-repo, degraded-repo

12 static analyzers per PROMPT.md "Suggested Static Checks For MVP":
hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors,
secret_patterns, large_files, todo_comments, missing_tests,
env_file_committed, unsafe_file_io, exposed_mutation_endpoint,
hardcoded_local_ip.

Acceptance gates passing:
- B1 (intake produces accurate counts) ✓
- B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓
- B3 (clean fixture produces 0 confirmed findings — no false positives) ✓
- B4 (scrum mode produces all 6 required markdown + JSON reports) ✓
- B5 (receipts.json marks degraded phases honestly) ✓
- F  (self-review on this repo runs without crashing) ✓ — exit 66 (degraded
  because Phase C LLM review is hardcoded skipped)

Phases C (LLM review), D (validation cross-check), E (memory + diff +
rules subcommands) deferred per the cutline. The MVP delivers the
evidence-first path; LLM is purely additive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-30 00:56:02 -05:00

2 Commits