Phase E — append-only memory + diff subcommand (PROMPT.md complete)

Closes the harness's feature set per PROMPT.md modes 2 (Diff Review)
and Phase 5 (Memory). Rules subcommand still pending (it needs
operator-authored .review-rules.md content first; documented as
Phase E follow-up).

internal/memory/ — append-only writer:
- AppendKnownRisks: one JSONL line per confirmed finding per run.
  O_APPEND only; never O_TRUNC. Empty findings list is a no-op
  (doesn't even create the file — keeps clean runs from polluting
  .memory/).
- AppendRunHistory: one JSONL line per run. Run summary stats +
  receipts hash for cross-link.
- WriteProjectProfile: the ONLY non-versioned memory file; snapshot
  semantics, overwrites are explicit + documented.
- 4 unit tests including TestAppendKnownRisks_NeverTruncates which
  is the audit's "no silent overwrite" gate — write twice, assert
  both writes' content survives.

Pipeline phase 5 wires it. Confirmed findings only — suspected
findings might still be wrong, keeping .memory/ authoritative.
Disabled if review-profile.memory.enabled = false.

internal/git/git.go — ChangedFiles helper:
- Probes unstaged + staged + branch diff against main/master.
- Dedup'd, stable order. Empty result on clean tree.
- Graceful failure: returns error if git binary missing or target
  isn't a git repo.

cli/repo.go — Diff subcommand:
- `review-harness diff <path>` runs the same pipeline as scrum but
  scoped to changed files only. Pipeline.Inputs gains DiffOnlyFiles
  filter applied post-Walk.
- Empty diff (clean tree, no commits ahead of base) → exit 0 with
  message; doesn't generate empty reports.
- LLM toggleable via --enable-llm same as scrum.

scanner/walk.go: added .memory to SkipDirs (universal — harness's
own audit trail, scanning it surfaces planted-secret evidence as
new findings — same class as B5 self-skip).

.gitignore tightened: /.memory/ → **/.memory/ to keep test-fixture
.memory dirs from leaking into version control (same fix as
reports/latest pattern).

Verified end-to-end:
- 4 memory unit tests PASS
- Append-only proven: insecure-repo run 1 → 16 known-risks lines;
  run 2 → 44 lines (16 + 28 from new run); run-history grew 1 → 2.
- Diff subcommand against this repo (5 uncommitted Phase E files
  staged) → exit 0, all reports produced, scoped to those 5 files
  only (0 findings on the diff-scoped scan vs 129 on full repo —
  changed files don't contain analyzer-flaggable patterns).

Phase A through E shipped today. Rules subcommand + tests for
internal/{config,scanner,git,llm,reporters,pipeline} remain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/pipeline/pipeline.go

@@ -18,6 +18,7 @@ import (
 	"local-review-harness/internal/config"
 	"local-review-harness/internal/git"
 	"local-review-harness/internal/llm"
+	"local-review-harness/internal/memory"
 	"local-review-harness/internal/reporters"
 	"local-review-harness/internal/scanner"
 	"local-review-harness/internal/validators"
@@ -31,6 +32,12 @@ type Inputs struct {
 	OutputDir     string
 	EmitScrum     bool // true → also emit scrum-test/risk-register/sprint-backlog/acceptance-gates markdown
 	EnableLLM     bool // Phase C: actually call the model. Off by default — operators opt in.
+
+	// DiffOnlyFiles, when non-nil, restricts the scan to JUST these
+	// repo-relative paths — the diff subcommand uses this to focus
+	// review on changed files rather than the full repo. Nil = scan
+	// everything.
+	DiffOnlyFiles []string
 }
 
 // Result is what the CLI shows the operator.
@@ -61,6 +68,24 @@ func RunRepo(ctx context.Context, in Inputs) (*Result, error) {
 
 	// --- Phase 0: repo intake ---
 	scan, err := scanner.Walk(in.RepoPath, true)
+	// Diff-mode: filter the scan to just the changed files. Phase 0
+	// intake stats stay accurate (operator wants to see what the
+	// repo looks like overall) but analyzers + LLM only see the
+	// changed slice. Pre-filter saves O(N) regex passes when N is
+	// 5000 files but only 3 changed.
+	if len(in.DiffOnlyFiles) > 0 && err == nil {
+		want := map[string]bool{}
+		for _, f := range in.DiffOnlyFiles {
+			want[f] = true
+		}
+		filtered := scan.Files[:0]
+		for _, f := range scan.Files {
+			if want[f.Path] {
+				filtered = append(filtered, f)
+			}
+		}
+		scan.Files = filtered
+	}
 	scanPhase := reporters.PhaseReceipt{Name: "repo_intake", Status: "ok"}
 	if err != nil {
 		scanPhase.Status = "failed"
@@ -229,11 +254,70 @@ func RunRepo(ctx context.Context, in Inputs) (*Result, error) {
 		receipt.Phases = append(receipt.Phases, reportPhase)
 	}
 
-	// --- Phase 5: memory (Phase E — deferred) ---
-	receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
-		Name: "memory_update", Status: "skipped",
-		Errors: []string{"Phase E not implemented in MVP"},
-	})
+	// --- Phase 5: memory (Phase E) ---
+	// Append-only writes under <repo>/.memory/. Persists confirmed
+	// findings + run summary so cross-run drift becomes observable.
+	// Per PROMPT.md hard rule: never silently overwrite.
+	memPhase := reporters.PhaseReceipt{Name: "memory_update", Status: "ok"}
+	if in.ReviewProfile.Memory.Enabled {
+		mw, merr := memory.NewWriter(in.RepoPath)
+		if merr != nil {
+			memPhase.Status = "degraded"
+			memPhase.Errors = append(memPhase.Errors, "memory writer: "+merr.Error())
+		} else {
+			// Confirmed findings only — suspected ones are still being
+			// validated and may not be real. Keeps the .memory/ log
+			// authoritative.
+			confirmed := []analyzers.Finding{}
+			for _, f := range findings {
+				if f.Status == analyzers.StatusConfirmed {
+					confirmed = append(confirmed, f)
+				}
+			}
+			if err := mw.AppendKnownRisks(runID, confirmed); err != nil {
+				memPhase.Status = "degraded"
+				memPhase.Errors = append(memPhase.Errors, "known-risks: "+err.Error())
+			}
+			runEntry := memory.RunHistoryEntry{
+				RunID:         runID,
+				RepoPath:      in.RepoPath,
+				StartedAt:     receipt.StartedAt,
+				FinishedAt:    time.Now().UTC().Format(time.RFC3339Nano),
+				TotalFindings: staticOut.Summary.Total,
+				Confirmed:     staticOut.Summary.Confirmed,
+				Critical:      staticOut.Summary.Critical,
+				High:          staticOut.Summary.High,
+				Medium:        staticOut.Summary.Medium,
+				Low:           staticOut.Summary.Low,
+				LLMEnabled:    in.EnableLLM,
+				ExitCode:      res.ExitCode,
+			}
+			if err := mw.AppendRunHistory(runEntry); err != nil {
+				memPhase.Status = "degraded"
+				memPhase.Errors = append(memPhase.Errors, "run-history: "+err.Error())
+			}
+			profile := memory.ProjectProfile{
+				RepoPath:          in.RepoPath,
+				LastSeenAt:        time.Now().UTC().Format(time.RFC3339Nano),
+				LastSeenCommit:    intake.LatestCommit,
+				LanguageBreakdown: intake.LanguageBreakdown,
+				FileCount:         intake.FileCount,
+			}
+			if err := mw.WriteProjectProfile(profile); err != nil {
+				memPhase.Status = "degraded"
+				memPhase.Errors = append(memPhase.Errors, "project-profile: "+err.Error())
+			}
+			memPhase.OutputFiles = []string{
+				".memory/known-risks.jsonl",
+				".memory/run-history.jsonl",
+				".memory/project-profile.json",
+			}
+		}
+	} else {
+		memPhase.Status = "skipped"
+		memPhase.Errors = append(memPhase.Errors, "memory disabled in review-profile")
+	}
+	receipt.Phases = append(receipt.Phases, memPhase)
 
 	// --- Receipt ---
 	receipt.Summary = staticOut.Summary