Phase A + B (MVP) — local review harness

Implements the MVP cutline from the planning artifact:
- Phase A: skeleton + CLI dispatch + provider interface + stub model doctor
- Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline
- Phase B fixtures: clean-repo, insecure-repo, degraded-repo

12 static analyzers per PROMPT.md "Suggested Static Checks For MVP":
hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors,
secret_patterns, large_files, todo_comments, missing_tests,
env_file_committed, unsafe_file_io, exposed_mutation_endpoint,
hardcoded_local_ip.

Acceptance gates passing:
- B1 (intake produces accurate counts) ✓
- B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓
- B3 (clean fixture produces 0 confirmed findings — no false positives) ✓
- B4 (scrum mode produces all 6 required markdown + JSON reports) ✓
- B5 (receipts.json marks degraded phases honestly) ✓
- F  (self-review on this repo runs without crashing) ✓ — exit 66 (degraded
  because Phase C LLM review is hardcoded skipped)

Phases C (LLM review), D (validation cross-check), E (memory + diff +
rules subcommands) deferred per the cutline. The MVP delivers the
evidence-first path; LLM is purely additive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -0,0 +1,86 @@
+# local-review-harness
+
+Local-first code review harness. Walks a repository, runs evidence-bearing static checks, generates Scrum-style reports. **No cloud dependencies.** LLM review is local-Ollama-only (Phase C, not yet shipped).
+
+Per `FIRST_COMMAND_FOR_CLAUDE_CODE.md` + `PROMPT.md` — "AI may suggest. Code validates. Reports must show evidence." Findings without grep-able evidence get rejected; the validator phase rejects model claims that cite missing files.
+
+## Status
+
+**Phase A + Phase B (MVP) shipped.** What works today:
+- `review-harness repo <path>` — Phase 0 intake + Phase 1 static scan
+- `review-harness scrum <path>` — same pipeline + full Scrum report bundle
+- `review-harness model doctor` — stub (real Ollama probe in Phase C)
+- 12 static analyzers covering hardcoded paths, shell exec, raw SQL, wildcard CORS, secret patterns, large files, TODO/FIXME, missing tests, committed `.env`, unsafe file I/O, exposed mutation endpoints, hardcoded private-network IPs
+
+**Phases C–E pending**: real LLM review, validation cross-check, append-only memory, diff/rules subcommands.
+
+## Build
+
+Single static binary, no cgo:
+
+```bash
+go build -o review-harness ./cmd/review-harness
+```
+
+Requires Go 1.22+.
+
+## Run
+
+```bash
+# Full repo review (Phase 0 + Phase 1 + Phase 4)
+./review-harness repo /path/to/target/repo
+
+# Same + Scrum bundle (scrum-test.md, risk-register.md, sprint-backlog.md, acceptance-gates.md)
+./review-harness scrum /path/to/target/repo
+
+# Model doctor stub
+./review-harness model doctor
+```
+
+Reports land in `<target>/reports/latest/` by default; override with `--output-dir`.
+
+Optional config files:
+
+```bash
+./review-harness scrum /path --review-profile configs/review-profile.example.yaml \
+                              --model-profile  configs/model-profile.example.yaml
+```
+
+## Self-review
+
+The harness reviews itself as a sanity gate (PROMPT.md "Final Deliverable"):
+
+```bash
+./review-harness scrum .
+cat reports/latest/scrum-test.md
+```
+
+The fixture-planted secrets in `tests/fixtures/insecure-repo/` are intentional — they prove the secret-pattern analyzer fires. Operators reviewing the self-report should expect those critical-severity hits and dismiss them as fixture content.
+
+## Test fixtures
+
+Three synthetic repos under `tests/fixtures/`:
+
+| Fixture | Purpose | Expected outcome |
+|---|---|---|
+| `clean-repo/` | sterile reference | 0 confirmed findings |
+| `insecure-repo/` | every static check fires | ≥8 distinct check IDs |
+| `degraded-repo/` | no git, no manifests | `repo_intake` phase marked degraded |
+
+Run them all to validate after a regex change:
+
+```bash
+for f in clean-repo insecure-repo degraded-repo; do
+  ./review-harness scrum "tests/fixtures/$f" > /dev/null
+  echo "$f: $(jq '.summary.total' tests/fixtures/$f/reports/latest/static-findings.json) findings"
+done
+```
+
+## Exit codes
+
+- `0` — clean run, no degraded phases
+- `64` — usage error
+- `65` — runtime error (config parse fail, target path missing, etc.)
+- `66` — degraded mode (one or more phases skipped or stubbed; reports still produced)
+
+`66` is the expected exit code in MVP because the LLM phase is hardcoded degraded until Phase C lands.