feat(review): pre-existing findings marked from git and re-derived by the gate

This commit is contained in:
Kjell Tore Guttormsen 2026-11-02 16:37:24 +01:00
commit 1464605e35
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
7 changed files with 1015 additions and 5 deletions

View file

@ -625,6 +625,17 @@ run (no JSON block) — stop. Never fill an id by hand. The frontmatter `finding
must use **block-style YAML** (one ID per line, ` - ` prefix). The
parser at `lib/util/frontmatter.mjs` does not support flow-style arrays.
**Then finalize the review** — one deterministic pass after `fill-finding-ids`:
```bash
node ${CLAUDE_PLUGIN_ROOT}/lib/review/review-finalize.mjs --review "{project_dir}/review.md" --repo . --project "{project_dir}" --round 1
```
On exit 1 or 2 the file stays as `fill-finding-ids` wrote it; print the reason in one line and continue.
A finding is pre-existing when it sits on a line the range `scope_sha_start..scope_sha_end` did not add or
change; finalize marks it from git, the verdict gate re-derives the mark, and a BLOCKER or security finding
counts in full whatever the mark.
**The verdict is in the file (K7).** The frontmatter carries
`verdict: ALLOW | WARN | BLOCK`, equal to the trailing JSON block's
`verdict`. It is required at write time; a review without it fails Phase 8.