Phase A + B (MVP) — local review harness
Implements the MVP cutline from the planning artifact: - Phase A: skeleton + CLI dispatch + provider interface + stub model doctor - Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline - Phase B fixtures: clean-repo, insecure-repo, degraded-repo 12 static analyzers per PROMPT.md "Suggested Static Checks For MVP": hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors, secret_patterns, large_files, todo_comments, missing_tests, env_file_committed, unsafe_file_io, exposed_mutation_endpoint, hardcoded_local_ip. Acceptance gates passing: - B1 (intake produces accurate counts) ✓ - B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓ - B3 (clean fixture produces 0 confirmed findings — no false positives) ✓ - B4 (scrum mode produces all 6 required markdown + JSON reports) ✓ - B5 (receipts.json marks degraded phases honestly) ✓ - F (self-review on this repo runs without crashing) ✓ — exit 66 (degraded because Phase C LLM review is hardcoded skipped) Phases C (LLM review), D (validation cross-check), E (memory + diff + rules subcommands) deferred per the cutline. The MVP delivers the evidence-first path; LLM is purely additive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude (review-harness setup)
co-authored by
Claude Opus 4.7
Claude Opus 4.7
commit
f3ee4722a8
@@ -0,0 +1,182 @@
|
||||
// Package pipeline orchestrates the per-phase execution. Each phase
|
||||
// produces JSON / markdown artifacts and a per-phase Receipt entry.
|
||||
// Degraded mode propagates: if Phase C (LLM review) can't run, the
|
||||
// pipeline still ships the static-scan deliverables and marks the
|
||||
// LLM phase degraded — never silently skipped.
|
||||
package pipeline
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
||||
"local-review-harness/internal/analyzers"
|
||||
"local-review-harness/internal/config"
|
||||
"local-review-harness/internal/git"
|
||||
"local-review-harness/internal/reporters"
|
||||
"local-review-harness/internal/scanner"
|
||||
)
|
||||
|
||||
// Inputs is the bag the CLI passes to the pipeline.
|
||||
type Inputs struct {
|
||||
RepoPath string
|
||||
ReviewProfile config.ReviewProfile
|
||||
ModelProfile config.ModelProfile
|
||||
OutputDir string
|
||||
EmitScrum bool // true → also emit scrum-test/risk-register/sprint-backlog/acceptance-gates markdown
|
||||
}
|
||||
|
||||
// Result is what the CLI shows the operator.
|
||||
type Result struct {
|
||||
OutputFiles []string
|
||||
ExitCode int // 0=ok, 66=degraded, 65=runtime
|
||||
}
|
||||
|
||||
// RunRepo executes Phase 0 (intake), Phase 1 (static), Phase 4 (report).
|
||||
// Phases 2 (LLM) + 3 (validate) + 5 (memory) ship later — every phase
|
||||
// not run lands in receipts as "skipped" or "degraded".
|
||||
func RunRepo(ctx context.Context, in Inputs) (*Result, error) {
|
||||
startedAt := time.Now().UTC()
|
||||
runID := newRunID(startedAt)
|
||||
res := &Result{ExitCode: 0}
|
||||
receipt := reporters.Receipt{
|
||||
RunID: runID,
|
||||
RepoPath: in.RepoPath,
|
||||
StartedAt: startedAt.Format(time.RFC3339Nano),
|
||||
}
|
||||
|
||||
// --- Phase 0: repo intake ---
|
||||
scan, err := scanner.Walk(in.RepoPath, true)
|
||||
scanPhase := reporters.PhaseReceipt{Name: "repo_intake", Status: "ok"}
|
||||
if err != nil {
|
||||
scanPhase.Status = "failed"
|
||||
scanPhase.Errors = append(scanPhase.Errors, err.Error())
|
||||
receipt.Phases = append(receipt.Phases, scanPhase)
|
||||
res.ExitCode = 65
|
||||
// Even on scan failure, write the receipt so operators can
|
||||
// see what blew up.
|
||||
_ = writeReceipt(in.OutputDir, &receipt, startedAt, nil)
|
||||
return res, err
|
||||
}
|
||||
gi := git.Inspect(ctx, in.RepoPath)
|
||||
intake := reporters.BuildIntake(scan, gi)
|
||||
intakePath := filepath.Join(in.OutputDir, "repo-intake.json")
|
||||
if sha, err := reporters.WriteJSON(intakePath, intake); err != nil {
|
||||
scanPhase.Status = "failed"
|
||||
scanPhase.Errors = append(scanPhase.Errors, err.Error())
|
||||
} else {
|
||||
scanPhase.OutputFiles = []string{"repo-intake.json"}
|
||||
scanPhase.OutputHash = sha
|
||||
}
|
||||
if !gi.HasGit {
|
||||
scanPhase.Status = "degraded"
|
||||
scanPhase.Errors = append(scanPhase.Errors, "no git metadata (not a git repo or git unavailable)")
|
||||
if res.ExitCode == 0 {
|
||||
res.ExitCode = 66
|
||||
}
|
||||
}
|
||||
receipt.Phases = append(receipt.Phases, scanPhase)
|
||||
res.OutputFiles = append(res.OutputFiles, "repo-intake.json")
|
||||
|
||||
// --- Phase 1: static scan ---
|
||||
findings := analyzers.Run(scan, in.ReviewProfile)
|
||||
staticOut := reporters.StaticFindings{
|
||||
GeneratedAt: time.Now().UTC().Format(time.RFC3339Nano),
|
||||
Findings: findings,
|
||||
Summary: reporters.SummarizeFindings(findings),
|
||||
}
|
||||
staticPath := filepath.Join(in.OutputDir, "static-findings.json")
|
||||
staticPhase := reporters.PhaseReceipt{Name: "static_scan", Status: "ok"}
|
||||
if sha, err := reporters.WriteJSON(staticPath, staticOut); err != nil {
|
||||
staticPhase.Status = "failed"
|
||||
staticPhase.Errors = append(staticPhase.Errors, err.Error())
|
||||
res.ExitCode = 65
|
||||
} else {
|
||||
staticPhase.OutputFiles = []string{"static-findings.json"}
|
||||
staticPhase.OutputHash = sha
|
||||
}
|
||||
receipt.Phases = append(receipt.Phases, staticPhase)
|
||||
res.OutputFiles = append(res.OutputFiles, "static-findings.json")
|
||||
|
||||
// --- Phase 2: LLM review (Phase C — not implemented in MVP) ---
|
||||
receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
|
||||
Name: "llm_review", Status: "degraded",
|
||||
Errors: []string{"Phase C not implemented in MVP — see PROMPT.md / docs/REVIEW_PIPELINE.md Phase 2"},
|
||||
})
|
||||
if res.ExitCode == 0 {
|
||||
res.ExitCode = 66
|
||||
}
|
||||
llmDegraded := true
|
||||
|
||||
// --- Phase 3: validation (Phase D — also deferred) ---
|
||||
receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
|
||||
Name: "validation", Status: "skipped",
|
||||
Errors: []string{"Phase D not implemented in MVP — depends on Phase C"},
|
||||
})
|
||||
|
||||
// --- Phase 4: report generation (markdown) ---
|
||||
if in.EmitScrum {
|
||||
reportPhase := reporters.PhaseReceipt{Name: "report_generation", Status: "ok"}
|
||||
writers := []struct {
|
||||
name string
|
||||
fn func() error
|
||||
}{
|
||||
{"scrum-test.md", func() error {
|
||||
return reporters.WriteScrumTest(filepath.Join(in.OutputDir, "scrum-test.md"), intake, findings, llmDegraded)
|
||||
}},
|
||||
{"risk-register.md", func() error {
|
||||
return reporters.WriteRiskRegister(filepath.Join(in.OutputDir, "risk-register.md"), findings)
|
||||
}},
|
||||
{"claim-coverage-table.md", func() error {
|
||||
return reporters.WriteClaimCoverage(filepath.Join(in.OutputDir, "claim-coverage-table.md"), findings)
|
||||
}},
|
||||
{"sprint-backlog.md", func() error {
|
||||
return reporters.WriteSprintBacklog(filepath.Join(in.OutputDir, "sprint-backlog.md"), staticOut.Summary)
|
||||
}},
|
||||
{"acceptance-gates.md", func() error {
|
||||
return reporters.WriteAcceptanceGates(filepath.Join(in.OutputDir, "acceptance-gates.md"), staticOut.Summary)
|
||||
}},
|
||||
}
|
||||
for _, w := range writers {
|
||||
if err := w.fn(); err != nil {
|
||||
reportPhase.Status = "failed"
|
||||
reportPhase.Errors = append(reportPhase.Errors, w.name+": "+err.Error())
|
||||
res.ExitCode = 65
|
||||
continue
|
||||
}
|
||||
reportPhase.OutputFiles = append(reportPhase.OutputFiles, w.name)
|
||||
res.OutputFiles = append(res.OutputFiles, w.name)
|
||||
}
|
||||
receipt.Phases = append(receipt.Phases, reportPhase)
|
||||
}
|
||||
|
||||
// --- Phase 5: memory (Phase E — deferred) ---
|
||||
receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
|
||||
Name: "memory_update", Status: "skipped",
|
||||
Errors: []string{"Phase E not implemented in MVP"},
|
||||
})
|
||||
|
||||
// --- Receipt ---
|
||||
receipt.Summary = staticOut.Summary
|
||||
if err := writeReceipt(in.OutputDir, &receipt, startedAt, nil); err != nil {
|
||||
return res, err
|
||||
}
|
||||
res.OutputFiles = append(res.OutputFiles, "receipts.json")
|
||||
|
||||
return res, nil
|
||||
}
|
||||
|
||||
func writeReceipt(outputDir string, r *reporters.Receipt, startedAt time.Time, _ error) error {
|
||||
r.FinishedAt = time.Now().UTC().Format(time.RFC3339Nano)
|
||||
_ = startedAt // present for future timing fields
|
||||
_, err := reporters.WriteJSON(filepath.Join(outputDir, "receipts.json"), r)
|
||||
return err
|
||||
}
|
||||
|
||||
func newRunID(t time.Time) string {
|
||||
var rb [4]byte
|
||||
_, _ = rand.Read(rb[:])
|
||||
return t.UTC().Format("20060102T150405") + "-" + hex.EncodeToString(rb[:])
|
||||
}
|
||||
Reference in New Issue
Block a user