Phase A + B (MVP) — local review harness

Implements the MVP cutline from the planning artifact: - Phase A: skeleton + CLI dispatch + provider interface + stub model doctor - Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline - Phase B fixtures: clean-repo, insecure-repo, degraded-repo 12 static analyzers per PROMPT.md "Suggested Static Checks For MVP": hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors, secret_patterns, large_files, todo_comments, missing_tests, env_file_committed, unsafe_file_io, exposed_mutation_endpoint, hardcoded_local_ip. Acceptance gates passing: - B1 (intake produces accurate counts) ✓ - B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓ - B3 (clean fixture produces 0 confirmed findings — no false positives) ✓ - B4 (scrum mode produces all 6 required markdown + JSON reports) ✓ - B5 (receipts.json marks degraded phases honestly) ✓ - F (self-review on this repo runs without crashing) ✓ — exit 66 (degraded because Phase C LLM review is hardcoded skipped) Phases C (LLM review), D (validation cross-check), E (memory + diff + rules subcommands) deferred per the cutline. The MVP delivers the evidence-first path; LLM is purely additive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-30 00:56:02 -05:00
commit f3ee4722a8
36 changed files with 4318 additions and 0 deletions
@@ -0,0 +1,2 @@
+DB_PASSWORD=hunter2
+SECRET=longLongLongSecretKey1234567890
@@ -0,0 +1,23 @@
+package main
+
+import (
+	"database/sql"
+	"fmt"
+	"os/exec"
+)
+
+// TODO: rotate this and move to env
+const HARDCODED_PATH = "/home/profit/secrets/key.pem"
+const SERVER_IP = "192.168.1.176"
+
+func badSQL(db *sql.DB, name string) {
+	q := fmt.Sprintf("SELECT * FROM users WHERE name = '%s'", name)
+	db.Query(q)
+}
+
+func runShell(cmd string) {
+	exec.Command("bash", "-c", cmd).Run()
+}
+
+// FIXME: hardcoded creds
+const API_KEY = "sk-1234567890abcdefABCDEFGHIJKLMNOPQRSTUV"
@@ -0,0 +1,901 @@
+package main
+// generated line 1
+// generated line 2
+// generated line 3
+// generated line 4
+// generated line 5
+// generated line 6
+// generated line 7
+// generated line 8
+// generated line 9
+// generated line 10
+// generated line 11
+// generated line 12
+// generated line 13
+// generated line 14
+// generated line 15
+// generated line 16
+// generated line 17
+// generated line 18
+// generated line 19
+// generated line 20
+// generated line 21
+// generated line 22
+// generated line 23
+// generated line 24
+// generated line 25
+// generated line 26
+// generated line 27
+// generated line 28
+// generated line 29
+// generated line 30
+// generated line 31
+// generated line 32
+// generated line 33
+// generated line 34
+// generated line 35
+// generated line 36
+// generated line 37
+// generated line 38
+// generated line 39
+// generated line 40
+// generated line 41
+// generated line 42
+// generated line 43
+// generated line 44
+// generated line 45
+// generated line 46
+// generated line 47
+// generated line 48
+// generated line 49
+// generated line 50
+// generated line 51
+// generated line 52
+// generated line 53
+// generated line 54
+// generated line 55
+// generated line 56
+// generated line 57
+// generated line 58
+// generated line 59
+// generated line 60
+// generated line 61
+// generated line 62
+// generated line 63
+// generated line 64
+// generated line 65
+// generated line 66
+// generated line 67
+// generated line 68
+// generated line 69
+// generated line 70
+// generated line 71
+// generated line 72
+// generated line 73
+// generated line 74
+// generated line 75
+// generated line 76
+// generated line 77
+// generated line 78
+// generated line 79
+// generated line 80
+// generated line 81
+// generated line 82
+// generated line 83
+// generated line 84
+// generated line 85
+// generated line 86
+// generated line 87
+// generated line 88
+// generated line 89
+// generated line 90
+// generated line 91
+// generated line 92
+// generated line 93
+// generated line 94
+// generated line 95
+// generated line 96
+// generated line 97
+// generated line 98
+// generated line 99
+// generated line 100
+// generated line 101
+// generated line 102
+// generated line 103
+// generated line 104
+// generated line 105
+// generated line 106
+// generated line 107
+// generated line 108
+// generated line 109
+// generated line 110
+// generated line 111
+// generated line 112
+// generated line 113
+// generated line 114
+// generated line 115
+// generated line 116
+// generated line 117
+// generated line 118
+// generated line 119
+// generated line 120
+// generated line 121
+// generated line 122
+// generated line 123
+// generated line 124
+// generated line 125
+// generated line 126
+// generated line 127
+// generated line 128
+// generated line 129
+// generated line 130
+// generated line 131
+// generated line 132
+// generated line 133
+// generated line 134
+// generated line 135
+// generated line 136
+// generated line 137
+// generated line 138
+// generated line 139
+// generated line 140
+// generated line 141
+// generated line 142
+// generated line 143
+// generated line 144
+// generated line 145
+// generated line 146
+// generated line 147
+// generated line 148
+// generated line 149
+// generated line 150
+// generated line 151
+// generated line 152
+// generated line 153
+// generated line 154
+// generated line 155
+// generated line 156
+// generated line 157
+// generated line 158
+// generated line 159
+// generated line 160
+// generated line 161
+// generated line 162
+// generated line 163
+// generated line 164
+// generated line 165
+// generated line 166
+// generated line 167
+// generated line 168
+// generated line 169
+// generated line 170
+// generated line 171
+// generated line 172
+// generated line 173
+// generated line 174
+// generated line 175
+// generated line 176
+// generated line 177
+// generated line 178
+// generated line 179
+// generated line 180
+// generated line 181
+// generated line 182
+// generated line 183
+// generated line 184
+// generated line 185
+// generated line 186
+// generated line 187
+// generated line 188
+// generated line 189
+// generated line 190
+// generated line 191
+// generated line 192
+// generated line 193
+// generated line 194
+// generated line 195
+// generated line 196
+// generated line 197
+// generated line 198
+// generated line 199
+// generated line 200
+// generated line 201
+// generated line 202
+// generated line 203
+// generated line 204
+// generated line 205
+// generated line 206
+// generated line 207
+// generated line 208
+// generated line 209
+// generated line 210
+// generated line 211
+// generated line 212
+// generated line 213
+// generated line 214
+// generated line 215
+// generated line 216
+// generated line 217
+// generated line 218
+// generated line 219
+// generated line 220
+// generated line 221
+// generated line 222
+// generated line 223
+// generated line 224
+// generated line 225
+// generated line 226
+// generated line 227
+// generated line 228
+// generated line 229
+// generated line 230
+// generated line 231
+// generated line 232
+// generated line 233
+// generated line 234
+// generated line 235
+// generated line 236
+// generated line 237
+// generated line 238
+// generated line 239
+// generated line 240
+// generated line 241
+// generated line 242
+// generated line 243
+// generated line 244
+// generated line 245
+// generated line 246
+// generated line 247
+// generated line 248
+// generated line 249
+// generated line 250
+// generated line 251
+// generated line 252
+// generated line 253
+// generated line 254
+// generated line 255
+// generated line 256
+// generated line 257
+// generated line 258
+// generated line 259
+// generated line 260
+// generated line 261
+// generated line 262
+// generated line 263
+// generated line 264
+// generated line 265
+// generated line 266
+// generated line 267
+// generated line 268
+// generated line 269
+// generated line 270
+// generated line 271
+// generated line 272
+// generated line 273
+// generated line 274
+// generated line 275
+// generated line 276
+// generated line 277
+// generated line 278
+// generated line 279
+// generated line 280
+// generated line 281
+// generated line 282
+// generated line 283
+// generated line 284
+// generated line 285
+// generated line 286
+// generated line 287
+// generated line 288
+// generated line 289
+// generated line 290
+// generated line 291
+// generated line 292
+// generated line 293
+// generated line 294
+// generated line 295
+// generated line 296
+// generated line 297
+// generated line 298
+// generated line 299
+// generated line 300
+// generated line 301
+// generated line 302
+// generated line 303
+// generated line 304
+// generated line 305
+// generated line 306
+// generated line 307
+// generated line 308
+// generated line 309
+// generated line 310
+// generated line 311
+// generated line 312
+// generated line 313
+// generated line 314
+// generated line 315
+// generated line 316
+// generated line 317
+// generated line 318
+// generated line 319
+// generated line 320
+// generated line 321
+// generated line 322
+// generated line 323
+// generated line 324
+// generated line 325
+// generated line 326
+// generated line 327
+// generated line 328
+// generated line 329
+// generated line 330
+// generated line 331
+// generated line 332
+// generated line 333
+// generated line 334
+// generated line 335
+// generated line 336
+// generated line 337
+// generated line 338
+// generated line 339
+// generated line 340
+// generated line 341
+// generated line 342
+// generated line 343
+// generated line 344
+// generated line 345
+// generated line 346
+// generated line 347
+// generated line 348
+// generated line 349
+// generated line 350
+// generated line 351
+// generated line 352
+// generated line 353
+// generated line 354
+// generated line 355
+// generated line 356
+// generated line 357
+// generated line 358
+// generated line 359
+// generated line 360
+// generated line 361
+// generated line 362
+// generated line 363
+// generated line 364
+// generated line 365
+// generated line 366
+// generated line 367
+// generated line 368
+// generated line 369
+// generated line 370
+// generated line 371
+// generated line 372
+// generated line 373
+// generated line 374
+// generated line 375
+// generated line 376
+// generated line 377
+// generated line 378
+// generated line 379
+// generated line 380
+// generated line 381
+// generated line 382
+// generated line 383
+// generated line 384
+// generated line 385
+// generated line 386
+// generated line 387
+// generated line 388
+// generated line 389
+// generated line 390
+// generated line 391
+// generated line 392
+// generated line 393
+// generated line 394
+// generated line 395
+// generated line 396
+// generated line 397
+// generated line 398
+// generated line 399
+// generated line 400
+// generated line 401
+// generated line 402
+// generated line 403
+// generated line 404
+// generated line 405
+// generated line 406
+// generated line 407
+// generated line 408
+// generated line 409
+// generated line 410
+// generated line 411
+// generated line 412
+// generated line 413
+// generated line 414
+// generated line 415
+// generated line 416
+// generated line 417
+// generated line 418
+// generated line 419
+// generated line 420
+// generated line 421
+// generated line 422
+// generated line 423
+// generated line 424
+// generated line 425
+// generated line 426
+// generated line 427
+// generated line 428
+// generated line 429
+// generated line 430
+// generated line 431
+// generated line 432
+// generated line 433
+// generated line 434
+// generated line 435
+// generated line 436
+// generated line 437
+// generated line 438
+// generated line 439
+// generated line 440
+// generated line 441
+// generated line 442
+// generated line 443
+// generated line 444
+// generated line 445
+// generated line 446
+// generated line 447
+// generated line 448
+// generated line 449
+// generated line 450
+// generated line 451
+// generated line 452
+// generated line 453
+// generated line 454
+// generated line 455
+// generated line 456
+// generated line 457
+// generated line 458
+// generated line 459
+// generated line 460
+// generated line 461
+// generated line 462
+// generated line 463
+// generated line 464
+// generated line 465
+// generated line 466
+// generated line 467
+// generated line 468
+// generated line 469
+// generated line 470
+// generated line 471
+// generated line 472
+// generated line 473
+// generated line 474
+// generated line 475
+// generated line 476
+// generated line 477
+// generated line 478
+// generated line 479
+// generated line 480
+// generated line 481
+// generated line 482
+// generated line 483
+// generated line 484
+// generated line 485
+// generated line 486
+// generated line 487
+// generated line 488
+// generated line 489
+// generated line 490
+// generated line 491
+// generated line 492
+// generated line 493
+// generated line 494
+// generated line 495
+// generated line 496
+// generated line 497
+// generated line 498
+// generated line 499
+// generated line 500
+// generated line 501
+// generated line 502
+// generated line 503
+// generated line 504
+// generated line 505
+// generated line 506
+// generated line 507
+// generated line 508
+// generated line 509
+// generated line 510
+// generated line 511
+// generated line 512
+// generated line 513
+// generated line 514
+// generated line 515
+// generated line 516
+// generated line 517
+// generated line 518
+// generated line 519
+// generated line 520
+// generated line 521
+// generated line 522
+// generated line 523
+// generated line 524
+// generated line 525
+// generated line 526
+// generated line 527
+// generated line 528
+// generated line 529
+// generated line 530
+// generated line 531
+// generated line 532
+// generated line 533
+// generated line 534
+// generated line 535
+// generated line 536
+// generated line 537
+// generated line 538
+// generated line 539
+// generated line 540
+// generated line 541
+// generated line 542
+// generated line 543
+// generated line 544
+// generated line 545
+// generated line 546
+// generated line 547
+// generated line 548
+// generated line 549
+// generated line 550
+// generated line 551
+// generated line 552
+// generated line 553
+// generated line 554
+// generated line 555
+// generated line 556
+// generated line 557
+// generated line 558
+// generated line 559
+// generated line 560
+// generated line 561
+// generated line 562
+// generated line 563
+// generated line 564
+// generated line 565
+// generated line 566
+// generated line 567
+// generated line 568
+// generated line 569
+// generated line 570
+// generated line 571
+// generated line 572
+// generated line 573
+// generated line 574
+// generated line 575
+// generated line 576
+// generated line 577
+// generated line 578
+// generated line 579
+// generated line 580
+// generated line 581
+// generated line 582
+// generated line 583
+// generated line 584
+// generated line 585
+// generated line 586
+// generated line 587
+// generated line 588
+// generated line 589
+// generated line 590
+// generated line 591
+// generated line 592
+// generated line 593
+// generated line 594
+// generated line 595
+// generated line 596
+// generated line 597
+// generated line 598
+// generated line 599
+// generated line 600
+// generated line 601
+// generated line 602
+// generated line 603
+// generated line 604
+// generated line 605
+// generated line 606
+// generated line 607
+// generated line 608
+// generated line 609
+// generated line 610
+// generated line 611
+// generated line 612
+// generated line 613
+// generated line 614
+// generated line 615
+// generated line 616
+// generated line 617
+// generated line 618
+// generated line 619
+// generated line 620
+// generated line 621
+// generated line 622
+// generated line 623
+// generated line 624
+// generated line 625
+// generated line 626
+// generated line 627
+// generated line 628
+// generated line 629
+// generated line 630
+// generated line 631
+// generated line 632
+// generated line 633
+// generated line 634
+// generated line 635
+// generated line 636
+// generated line 637
+// generated line 638
+// generated line 639
+// generated line 640
+// generated line 641
+// generated line 642
+// generated line 643
+// generated line 644
+// generated line 645
+// generated line 646
+// generated line 647
+// generated line 648
+// generated line 649
+// generated line 650
+// generated line 651
+// generated line 652
+// generated line 653
+// generated line 654
+// generated line 655
+// generated line 656
+// generated line 657
+// generated line 658
+// generated line 659
+// generated line 660
+// generated line 661
+// generated line 662
+// generated line 663
+// generated line 664
+// generated line 665
+// generated line 666
+// generated line 667
+// generated line 668
+// generated line 669
+// generated line 670
+// generated line 671
+// generated line 672
+// generated line 673
+// generated line 674
+// generated line 675
+// generated line 676
+// generated line 677
+// generated line 678
+// generated line 679
+// generated line 680
+// generated line 681
+// generated line 682
+// generated line 683
+// generated line 684
+// generated line 685
+// generated line 686
+// generated line 687
+// generated line 688
+// generated line 689
+// generated line 690
+// generated line 691
+// generated line 692
+// generated line 693
+// generated line 694
+// generated line 695
+// generated line 696
+// generated line 697
+// generated line 698
+// generated line 699
+// generated line 700
+// generated line 701
+// generated line 702
+// generated line 703
+// generated line 704
+// generated line 705
+// generated line 706
+// generated line 707
+// generated line 708
+// generated line 709
+// generated line 710
+// generated line 711
+// generated line 712
+// generated line 713
+// generated line 714
+// generated line 715
+// generated line 716
+// generated line 717
+// generated line 718
+// generated line 719
+// generated line 720
+// generated line 721
+// generated line 722
+// generated line 723
+// generated line 724
+// generated line 725
+// generated line 726
+// generated line 727
+// generated line 728
+// generated line 729
+// generated line 730
+// generated line 731
+// generated line 732
+// generated line 733
+// generated line 734
+// generated line 735
+// generated line 736
+// generated line 737
+// generated line 738
+// generated line 739
+// generated line 740
+// generated line 741
+// generated line 742
+// generated line 743
+// generated line 744
+// generated line 745
+// generated line 746
+// generated line 747
+// generated line 748
+// generated line 749
+// generated line 750
+// generated line 751
+// generated line 752
+// generated line 753
+// generated line 754
+// generated line 755
+// generated line 756
+// generated line 757
+// generated line 758
+// generated line 759
+// generated line 760
+// generated line 761
+// generated line 762
+// generated line 763
+// generated line 764
+// generated line 765
+// generated line 766
+// generated line 767
+// generated line 768
+// generated line 769
+// generated line 770
+// generated line 771
+// generated line 772
+// generated line 773
+// generated line 774
+// generated line 775
+// generated line 776
+// generated line 777
+// generated line 778
+// generated line 779
+// generated line 780
+// generated line 781
+// generated line 782
+// generated line 783
+// generated line 784
+// generated line 785
+// generated line 786
+// generated line 787
+// generated line 788
+// generated line 789
+// generated line 790
+// generated line 791
+// generated line 792
+// generated line 793
+// generated line 794
+// generated line 795
+// generated line 796
+// generated line 797
+// generated line 798
+// generated line 799
+// generated line 800
+// generated line 801
+// generated line 802
+// generated line 803
+// generated line 804
+// generated line 805
+// generated line 806
+// generated line 807
+// generated line 808
+// generated line 809
+// generated line 810
+// generated line 811
+// generated line 812
+// generated line 813
+// generated line 814
+// generated line 815
+// generated line 816
+// generated line 817
+// generated line 818
+// generated line 819
+// generated line 820
+// generated line 821
+// generated line 822
+// generated line 823
+// generated line 824
+// generated line 825
+// generated line 826
+// generated line 827
+// generated line 828
+// generated line 829
+// generated line 830
+// generated line 831
+// generated line 832
+// generated line 833
+// generated line 834
+// generated line 835
+// generated line 836
+// generated line 837
+// generated line 838
+// generated line 839
+// generated line 840
+// generated line 841
+// generated line 842
+// generated line 843
+// generated line 844
+// generated line 845
+// generated line 846
+// generated line 847
+// generated line 848
+// generated line 849
+// generated line 850
+// generated line 851
+// generated line 852
+// generated line 853
+// generated line 854
+// generated line 855
+// generated line 856
+// generated line 857
+// generated line 858
+// generated line 859
+// generated line 860
+// generated line 861
+// generated line 862
+// generated line 863
+// generated line 864
+// generated line 865
+// generated line 866
+// generated line 867
+// generated line 868
+// generated line 869
+// generated line 870
+// generated line 871
+// generated line 872
+// generated line 873
+// generated line 874
+// generated line 875
+// generated line 876
+// generated line 877
+// generated line 878
+// generated line 879
+// generated line 880
+// generated line 881
+// generated line 882
+// generated line 883
+// generated line 884
+// generated line 885
+// generated line 886
+// generated line 887
+// generated line 888
+// generated line 889
+// generated line 890
+// generated line 891
+// generated line 892
+// generated line 893
+// generated line 894
+// generated line 895
+// generated line 896
+// generated line 897
+// generated line 898
+// generated line 899
+// generated line 900
@@ -0,0 +1,8 @@
+// HACK: open CORS for now
+res.setHeader("Access-Control-Allow-Origin", "*");
+
+// AWS access key — should never ship
+const AWS_KEY = "AKIAIOSFODNN7EXAMPLE";
+
+app.post("/api/users", function(req, res) { /* no auth */ });
+app.delete("/api/admin", function(req, res) { /* no auth */ });