- errors.go: Log JSON encode failures in WriteError and WriteJSON
  instead of silently discarding. Headers are already sent so status
  can't change, but the error is now visible in logs. (PR #144)

- handlers_delta.go: Validate Content-Type on delta ingest and validate
  endpoints. Rejects non-JSON content types with 415 before reading
  body. (PR #145)

- handlers_cicd.go: Cap coupling check to 20 files. Each Analyze call
  scans git log independently — N files = N git-log calls. Same cap
  pattern as blast-radius (30) and bug-patterns (20). (PR #143)

fix: Address 3 issues from windup PR analysis

Language detection now searches subdirectories (up to depth 3) for
manifest files like go.mod, package.json, Cargo.toml, etc. This
fixes repos where source code lives in subdirs (e.g., src/cli/go.mod).

- findManifest: walks subdirs to find exact manifest filenames
- FindManifestForLanguage: finds manifest for a specific --lang flag
- Skips example/test/doc/vendor dirs to avoid false detections
- Index command runs indexer from the manifest's directory, not root
- Multiple languages properly detected and reported

Before: ckb index → "Could not detect project language" on ShellAI
After:  ckb index → "Multiple languages detected: Go, TypeScript"
        ckb index --lang go → runs scip-go from src/cli/

- TestDetectLanguage_SubdirectoryManifest: go.mod in src/cli/,
  Cargo.toml in packages/core/, package.json in src/web/, root priority
- TestDetectAllLanguages_MultiLanguageMonorepo: Go+TS, Go+Python,
  single language in subdir
- TestDetectLanguage_SkipsExampleAndTestDirs: manifests in examples/,
  testdata/, docs/ not detected
- TestFindManifestForLanguage: per-language manifest lookup for --lang
- TestFindManifest_DepthAndSkipDirs: depth 2/3/4, root priority,
  vendor/examples/node_modules skipped

Language detection now searches subdirectories (up to depth 3) for
manifest files like go.mod, package.json, Cargo.toml, etc. This
fixes repos where source code lives in subdirs (e.g., src/cli/go.mod).

- findManifest: walks subdirs to find exact manifest filenames
- FindManifestForLanguage: finds manifest for a specific --lang flag
- Skips example/test/doc/vendor dirs to avoid false detections
- Index command runs indexer from the manifest's directory, not root
- Multiple languages properly detected and reported

Before: ckb index → "Could not detect project language" on ShellAI
After:  ckb index → "Multiple languages detected: Go, TypeScript"
        ckb index --lang go → runs scip-go from src/cli/

- TestDetectLanguage_SubdirectoryManifest: go.mod in src/cli/,
  Cargo.toml in packages/core/, package.json in src/web/, root priority
- TestDetectAllLanguages_MultiLanguageMonorepo: Go+TS, Go+Python,
  single language in subdir
- TestDetectLanguage_SkipsExampleAndTestDirs: manifests in examples/,
  testdata/, docs/ not detected
- TestFindManifestForLanguage: per-language manifest lookup for --lang
- TestFindManifest_DepthAndSkipDirs: depth 2/3/4, root priority,
  vendor/examples/node_modules skipped

feat: Monorepo language detection + subdir indexing

1. Coupling age filter: skip co-change gaps where the coupled file
   hasn't been modified in 180+ days. Prevents FPs from test files
   written once and never changed. Uses git log for last-mod date.

2. Cognitive complexity weighting: swap cyclomatic (0.25→0.15) and
   cognitive (0.15→0.25) weights in health score. Cognitive is less
   misleading than cyclomatic for switch statements and similar.

3. Symbol rename detection: filter rename pairs in breaking changes.
   When a removed + added symbol share the same file and kind, it's
   likely a rename, not a breaking API change.

4. Split clustering caps: skip coupling analysis for PRs > 200 files
   (use module clustering only). Merge clusters beyond 20 into one
   bucket. Prevents O(n²) explosion on large PRs.

5. Generated file markers: add protobuf headers, swagger/openapi,
   codegen markers (eslint-disable, @generated, protoc-gen,
   graphql-codegen), minified assets (*.min.js/css).

feat: Address 5 items from external technical review

* fix: reduce false positives in secrets scanner and test gap heuristic

Secrets: add varRefRe pattern to isLikelyFalsePositive() that detects
when the captured "secret" is a variable/attribute reference (e.g.,
self._settings.openai_api_key, config.apiKey, os.environ, process.env,
viper.GetString) rather than a hardcoded literal. Adds 7 test cases.

Test gaps: extend findTestFiles() to check the Python/pytest prefix
convention (test_{name}.ext) in addition to suffix patterns. Also
checks sibling tests/ directory and top-level tests/ directory, which
is the standard Python project layout.

* fix: resolve CI failures — undici vulnerability, review JSON parsing, test coverage

- Override undici to ^6.24.0 in pr-analysis action to fix Trivy security scan
- Suppress logger warnings for all output formats (not just human) so stderr
  doesn't corrupt JSON output when CI redirects 2>&1
- Add tests for filterRenamePairs, varRefRe regex, and doc file entropy threshold

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address 8 code review findings from CKB analysis

- filterRenamePairs: deterministic output via sorted keys, filter both
  sides of rename pairs (not just the "removed" half)
- varRefRe: clarify why partial-capture branches exist alongside the
  anchored dotted-chain branch
- review_coupling: batch fileLastModified into single shell invocation
  instead of O(n) git-log subprocesses
- detect.go: document findManifest lexical ordering behavior
- handlers_delta: clarify Content-Type validation allows missing header
- review_health: fix stale weight comment (15%/25% not 25%/15%), add
  weight-sum and ordering assertion test
- Remove eslint-disable from generated markers (too aggressive — flags
  hand-written files with lint suppressions)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ching (#181)

Three CKB review infrastructure fixes:

1. Generated file marker detection was defined but never called —
   detectGeneratedFile now reads the first 10 lines of files and checks
   for GeneratedMarkers (DO NOT EDIT, @generated, etc.)

2. Add dist/*.js and dist/*.css to default generated patterns so bundled
   output (webpack, ncc, etc.) is automatically excluded from review.

3. Fix matchGlob ** suffix matching — was only checking filepath.Base(),
   now tries all path tail segments so patterns like **/dist/*.js work.

4. After HoldTheLine and dismissal filtering, reconcile check summaries
   with surviving findings. A check that reported "5 new bug patterns"
   but had all findings dropped (on unchanged lines) is now downgraded
   to pass with a note.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…O 27701, IEC 61508)

Introduces `ckb audit compliance --framework=<name>` with 41 checks across
5 regulatory frameworks, each mapping findings to specific regulation
articles/clauses. Fills a gap no existing SAST tool covers — direct code-to-
regulation mapping beyond CWE IDs.

Frameworks and checks:
- GDPR/DSGVO (11): PII detection, PII in logs/errors, weak crypto, plaintext
  storage, consent, retention, deletion, data minimization, transport encryption
- EU AI Act (8): model I/O logging, audit trail, human override, kill switch,
  bias testing, data provenance, version tracking, confidence scores
- ISO 27001:2022 (10): secrets, PII leakage, weak crypto, insecure random,
  SQL injection, path traversal, unsafe deserialization, TLS, CORS, config mgmt
- ISO 27701 (5): consent mechanism, deletion/access/portability endpoints,
  purpose logging
- IEC 61508/SIL (7): goto, recursion, nesting, function size, global state,
  unchecked errors, SIL-gated complexity thresholds

Key design decisions:
- Findings reuse query.ReviewFinding — JSON, SARIF, markdown formatters work
- PII scanner with 80+ patterns incl. German terms, configurable via config
- Confidence scoring (0.0-1.0) on every finding, filterable via --min-confidence
- Parallel check execution via sync.WaitGroup
- Non-PII exclusion list prevents false positives on code identifiers

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Rewrites the /ckb-review and /review slash commands for minimal LLM
token usage (~3-8k tokens vs ~15-30k previously):

- Early exit: score>=80 + verdict=pass → one-line approval, no source read
- CLI-first: ckb review --compact instead of MCP tool discovery
- Targeted reads: only files with warn/fail findings, not all hotspots
- No drill-down phase: CLI compact output has enough signal
- Terse output: flat issue list instead of multi-section prose
- Anti-patterns list: explicit "don't do this" for token waste

Updated in: embedded constant (setup.go), .claude/commands/review.md,
ADR-001, and review advantages doc.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…apping

Adds 15 new regulatory frameworks (126 total checks across 20 frameworks)
and a cross-framework mapping engine that enriches findings with references
to every regulation they violate simultaneously.

New frameworks:
- PCI DSS 4.0 (6 checks): PAN detection, secure coding, auth
- HIPAA (5 checks): PHI detection/logging, audit trail, encryption
- SOC 2 (6 checks): access control, monitoring, change management
- NIST 800-53 Rev 5 (6 checks): access, audit, crypto, input validation
- EU Cyber Resilience Act (6 checks): secure defaults, SBOM, vulnerabilities
- DORA (6 checks): circuit breakers, timeouts, health endpoints, rollback
- NIS2 (5 checks): supply chain, vulnerability handling, crypto
- OWASP ASVS 4.0 (8 checks): auth, session, validation, crypto, TLS
- CCPA/CPRA (5 checks): do-not-sell, sensitive PI, data subject rights
- SBOM/SLSA (5 checks): SBOM generation, lock files, provenance, signing
- MISRA C/C++ (6 checks): goto, dead code, switch, memory, type safety
- ISO 26262 (5 checks): ASIL-gated complexity, recursion, null checks
- DO-178C (5 checks): DAL-gated dead code, complexity, traceability
- FDA 21 CFR Part 11 (5 checks): audit trail, authority, e-signatures
- IEC 62443 (6 checks): default creds, input validation, message auth

Cross-framework mapping (CKB differentiator):
A single "weak crypto" finding now shows: "Also violates: NIST SC-13,
PCI DSS 4.2.1, ASVS V6.2.1, NIS2 Art.21, GDPR Art.32, HIPAA §164.312,
FDA §11.10" — no competing tool provides this structural context.

Thread-safety: Added ScanScope.AnalyzeFileComplexity() mutex wrapper to
prevent tree-sitter parser crashes under parallel check execution.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- docs/features/compliance-audit/overview.md: Executive summary with
  market positioning and framework coverage
- docs/features/compliance-audit/checks.md: Complete reference of all
  126 checks across 20 frameworks
- examples/github-actions/compliance-audit.yml: Production-ready GitHub
  Actions workflow with SARIF upload, PR comments, and quality gates

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Three improvements to the bug-patterns review check:

1. checkDiscardedError: Skip calls nested inside argument_list nodes.
   Previously flagged Register(NewFramework()) as "discarded return from
   NewFramework" — the return IS consumed as an argument, not discarded.

2. checkDiscardedError: Suppress standalone .Close() calls. Discarding
   Close() errors on read-only file handles is standard Go convention
   (os.Open for reading). Write-path Close errors are caught by the
   missing-defer-close rule instead.

3. checkMissingDeferClose: Recognize inline varName.Close() as valid
   resource cleanup (not just defer). Also removed NewScanner from
   openFuncs — bufio.Scanner doesn't implement io.Closer.

Also adds compliance.ScanFileLines helper for proper open/defer-close
lifecycle in file scanning checks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dogfooded on PR #183 (compliance audit). Changes:

- Remove --compact flag reference (doesn't exist on CLI)
- Add new file strategy: "read entry point + types first, then follow
  refs" for large new packages (90 new files was untractable otherwise)
- Add "resource leaks" to blind spots list (found the main bug class)
- Update check count 15 → 20
- Add anti-pattern: reading every file in a large new package
- Add parse instructions for JSON output (pipe through python/jq)
- All 3 copies synced: local, repo, embedded constant

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…hints

expandToolset description now lists each preset's key tools and
use cases so the LLM can pick the right one:
- review: PR review, compliance, secrets, test gaps
- refactor: coupling, cycles, dead code, suggestions
- federation: multi-repo, contracts
- docs: documentation, ADRs
- ops: diagnostics, daemon, webhooks

getStatus hints now include preset-awareness: when on core preset,
explicitly suggests expanding to review/refactor/docs with arrows
pointing to the workflows each unlocks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server_test.go (15 tests): HTTP handler tests via httptest for health,
schedule list, jobs list/route, repos list/route, federations list/route.
Covers nil-scheduler fallback, missing ID validation, method-not-allowed.

symbols_enrich_test.go (6 tests): Post-enrichment filter validation for
excludePatterns (#), minLines, minComplexity, combined filters, no-op.

compound_batch_test.go (3 tests): BatchGetOptions.IncludeCounts field
existence, symbol ID limit, default count behavior.

Total new tests this session: 46 (22 + 24)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>