f3ee4722a8
Implements the MVP cutline from the planning artifact: - Phase A: skeleton + CLI dispatch + provider interface + stub model doctor - Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline - Phase B fixtures: clean-repo, insecure-repo, degraded-repo 12 static analyzers per PROMPT.md "Suggested Static Checks For MVP": hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors, secret_patterns, large_files, todo_comments, missing_tests, env_file_committed, unsafe_file_io, exposed_mutation_endpoint, hardcoded_local_ip. Acceptance gates passing: - B1 (intake produces accurate counts) ✓ - B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓ - B3 (clean fixture produces 0 confirmed findings — no false positives) ✓ - B4 (scrum mode produces all 6 required markdown + JSON reports) ✓ - B5 (receipts.json marks degraded phases honestly) ✓ - F (self-review on this repo runs without crashing) ✓ — exit 66 (degraded because Phase C LLM review is hardcoded skipped) Phases C (LLM review), D (validation cross-check), E (memory + diff + rules subcommands) deferred per the cutline. The MVP delivers the evidence-first path; LLM is purely additive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
576 B
YAML
Executable File
34 lines
576 B
YAML
Executable File
# Example Review Profile
|
|
|
|
project_name: local-review-harness
|
|
mode: local-first
|
|
|
|
severity_thresholds:
|
|
fail_on_critical: true
|
|
fail_on_high: false
|
|
|
|
static_checks:
|
|
hardcoded_paths: true
|
|
raw_sql_interpolation: true
|
|
shell_execution: true
|
|
broad_cors: true
|
|
secret_patterns: true
|
|
large_files: true
|
|
todo_comments: true
|
|
missing_tests: true
|
|
|
|
limits:
|
|
large_file_lines: 800
|
|
max_file_bytes: 1000000
|
|
max_llm_chunk_chars: 12000
|
|
|
|
reports:
|
|
output_dir: reports/latest
|
|
markdown: true
|
|
json_receipts: true
|
|
|
|
memory:
|
|
enabled: true
|
|
path: .memory
|
|
append_only: true
|