Feat/symbol graph

Cargo.toml

@@ -72,6 +72,12 @@ petgraph = "0.7"
 
 # Base64 (for PaaS-safe env var encoding of PEM keys)
 base64 = "0.22"
+tree-sitter = "0.26.11"
+tree-sitter-rust = "0.24.2"
+tree-sitter-go = "0.25.0"
+tree-sitter-python = "0.25.0"
+tree-sitter-javascript = "0.25.0"
+tree-sitter-typescript = "0.23.2"
 
 [dev-dependencies]
 tempfile = "3"

docs/codasaurus-toml.md

@@ -64,6 +64,10 @@ threshold = 0.0
 metric = "new_medium_issues"
 op = "gt"
 threshold = 5.0
+
+[confidence]
+judge_tier1 = false
+drop_ungrounded = false
 ```
 
 ## Sections
@@ -76,6 +80,7 @@ threshold = 5.0
 | `[guidelines]` | Contribution guideline path override                      |
 | `[pre_merge]`  | Soft caps used as defaults before DB policy overlay       |
 | `[quality_gate]` | Sonar-style gate on new findings; failed gate blocks the check run when `block_on_fail` |
+| `[confidence]` | Per-finding confidence 0-5: optional LLM judge + grounding filter |
 
 ## `review_strictness`
 
@@ -103,6 +108,17 @@ Sonar-style gate evaluated against findings on new code lines. Any failed condit
 
 Operators: `gt`, `gte`, `lt`, `lte`, `eq`, `ne`.
 
+## `confidence`
+
+Every finding carries a confidence score 0-5. Tier-1 detectors (registry, manifest, secrets, IaC) get a base 5; heuristic detectors (style, stale APIs, guidelines, graph) get a base 3; LLM-authored prose findings default to 4.
+
+| Key              | Default | Effect |
+| ---------------- | ------- | ------ |
+| `judge_tier1`    | `false` | Also run the LLM judge on deterministic tier-1 findings |
+| `drop_ungrounded` | `false` | Drop findings with confidence <= 1 (after judge) |
+
+When a BYOK LLM is configured and enabled for the repo, the judge scores heuristic findings and stores `confidence` + `judge_rationale`. The judge is best-effort: LLM failure keeps base confidence and never fails the review.
+
 ## Repo `config_json` (dashboard)
 
 ```json

src/bot/commands.rs

@@ -1037,6 +1037,8 @@ async fn spawn_review(ctx: WebhookContext, pr_number: i64, timeout_secs: u64) {
             sender: None,
             repositories: None,
             repositories_added: None,
+            after: None,
+            commits: None,
         };
         review_pr_with_options(
             &token,
@@ -1259,6 +1261,14 @@ async fn spawn_impact(ctx: WebhookContext, pr_number: i64, timeout_secs: u64) {
         } else {
             text.push_str(&card);
         }
+        if let Some(pool) = crate::bot::bot_db_pool() {
+            let index_md =
+                crate::index::callers_markdown(pool, &ctx.repo_full_name, &changed_paths).await;
+            if !index_md.is_empty() {
+                text.push('\n');
+                text.push_str(&index_md);
+            }
+        }
         text.push_str("\n---\n");
         text.push_str(&crate::bot::markdown::commands_details());
         post_issue_comment_kind(

src/bot/concern.rs

@@ -107,6 +107,8 @@ mod tests {
             suggestion: None,
             evidence: None,
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         }
     }
 

src/bot/markdown.rs

@@ -329,6 +329,8 @@ pub fn guide_label_parts(detector: &str, message: &str, file: &str, line: Option
         suggestion: None,
         evidence: None,
         codemod: None,
+        confidence: None,
+        judge_rationale: None,
     };
     guide_label(&stub)
 }
@@ -1166,6 +1168,8 @@ mod tests {
             suggestion: None,
             evidence: None,
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         };
         assert_eq!(short_fp(&f).len(), 12);
     }
@@ -1182,6 +1186,8 @@ mod tests {
             suggestion: None,
             evidence: Some("AKIA".into()),
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         };
         let body = inline_finding_comment(&f);
         assert!(body.contains("<details>"));
@@ -1209,6 +1215,8 @@ mod tests {
                 suggestion: None,
                 evidence: None,
                 codemod: None,
+                confidence: None,
+                judge_rationale: None,
             }],
         };
         let files = vec![
@@ -1396,6 +1404,8 @@ mod tests {
             suggestion: Some("Rotate abcdefghijklmnopqrstuvwxyz0123456789 and use env".into()),
             evidence: None,
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         }];
         let prompt = agent_fix_prompt(&findings, "Add webhook retries").expect("prompt");
         assert!(prompt.contains("## Findings (priority order)"));
@@ -1420,6 +1430,8 @@ mod tests {
                 suggestion: None,
                 evidence: None,
                 codemod: None,
+                confidence: None,
+                judge_rationale: None,
             },
             Finding {
                 detector: "policy".into(),
@@ -1431,6 +1443,8 @@ mod tests {
                 suggestion: Some("raise max_blocking".into()),
                 evidence: None,
                 codemod: None,
+                confidence: None,
+                judge_rationale: None,
             },
             Finding {
                 detector: "todo-leaks".into(),
@@ -1442,6 +1456,8 @@ mod tests {
                 suggestion: None,
                 evidence: None,
                 codemod: None,
+                confidence: None,
+                judge_rationale: None,
             },
         ];
         let prompt = agent_fix_prompt(&findings, "Fix todos").expect("prompt");
@@ -1462,6 +1478,8 @@ mod tests {
             suggestion: None,
             evidence: None,
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         };
         let b = Finding {
             detector: "todo-leaks".into(),
@@ -1473,6 +1491,8 @@ mod tests {
             suggestion: None,
             evidence: None,
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         };
         let prior = vec![
             (
@@ -1506,6 +1526,8 @@ mod tests {
             suggestion: None,
             evidence: Some("AKIA".into()),
             codemod: None,
+            confidence: None,
+            judge_rationale: None,
         };
         let body = inline_finding_comment(&f);
         assert!(body.contains("**Do this:**"));