Phase A + B (MVP) — local review harness

Implements the MVP cutline from the planning artifact:
- Phase A: skeleton + CLI dispatch + provider interface + stub model doctor
- Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline
- Phase B fixtures: clean-repo, insecure-repo, degraded-repo

12 static analyzers per PROMPT.md "Suggested Static Checks For MVP":
hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors,
secret_patterns, large_files, todo_comments, missing_tests,
env_file_committed, unsafe_file_io, exposed_mutation_endpoint,
hardcoded_local_ip.

Acceptance gates passing:
- B1 (intake produces accurate counts) ✓
- B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓
- B3 (clean fixture produces 0 confirmed findings — no false positives) ✓
- B4 (scrum mode produces all 6 required markdown + JSON reports) ✓
- B5 (receipts.json marks degraded phases honestly) ✓
- F  (self-review on this repo runs without crashing) ✓ — exit 66 (degraded
  because Phase C LLM review is hardcoded skipped)

Phases C (LLM review), D (validation cross-check), E (memory + diff +
rules subcommands) deferred per the cutline. The MVP delivers the
evidence-first path; LLM is purely additive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/review-harness/main.go

@@ -0,0 +1,90 @@
+// Local review harness — entry point.
+//
+// Subcommands per PROMPT.md:
+//   repo /path        — full-repo review (Phase B MVP)
+//   diff /path        — diff/PR-style review (Phase E)
+//   scrum /path       — scrum-test report bundle (Phase B MVP)
+//   rules /path       — rules audit (Phase E)
+//   model doctor      — Ollama probe + JSON shape (Phase A stub, Phase C real)
+//
+// PROMPT.md hard rules apply: no cloud deps, no auto-commit, no
+// destructive changes to the target repo, no fake success.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	"local-review-harness/internal/cli"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+
+	// Per-subcommand flag sets. Common flags (--review-profile,
+	// --model-profile, --output-dir) live on each FlagSet rather than
+	// a global pre-parser; the CLI library would be overkill for 5
+	// subcommands.
+	sub := os.Args[1]
+	args := os.Args[2:]
+
+	switch sub {
+	case "repo":
+		os.Exit(cli.Repo(args))
+	case "diff":
+		fmt.Fprintln(os.Stderr, "diff: not implemented in MVP (Phase E)")
+		os.Exit(64)
+	case "scrum":
+		os.Exit(cli.Scrum(args))
+	case "rules":
+		fmt.Fprintln(os.Stderr, "rules: not implemented in MVP (Phase E)")
+		os.Exit(64)
+	case "model":
+		// Two-token verb: "model doctor"
+		if len(args) < 1 {
+			fmt.Fprintln(os.Stderr, "model: missing verb (try: model doctor)")
+			os.Exit(2)
+		}
+		switch args[0] {
+		case "doctor":
+			os.Exit(cli.ModelDoctor(args[1:]))
+		default:
+			fmt.Fprintf(os.Stderr, "model: unknown verb %q\n", args[0])
+			os.Exit(2)
+		}
+	case "-h", "--help", "help":
+		usage()
+		os.Exit(0)
+	case "version":
+		fmt.Println("review-harness 0.1.0 (Phase A skeleton)")
+		os.Exit(0)
+	default:
+		fmt.Fprintf(os.Stderr, "unknown subcommand: %q\n", sub)
+		usage()
+		os.Exit(2)
+	}
+	_ = flag.CommandLine // keep import stable across phases
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, `review-harness — local-first code review
+
+Usage:
+  review-harness repo <path>             full-repo review (MVP)
+  review-harness scrum <path>            scrum-test report bundle (MVP)
+  review-harness model doctor            probe Ollama / configured models
+  review-harness diff <path>             diff review (Phase E, not yet)
+  review-harness rules <path>            rules audit (Phase E, not yet)
+  review-harness version                 print version
+  review-harness help                    this message
+
+Common flags (per subcommand):
+  --review-profile <path>                YAML; defaults applied if omitted
+  --model-profile <path>                 YAML; defaults applied if omitted
+  --output-dir <path>                    override review-profile output dir
+`)
+}