Feat/osv reachability

[lohitkolluri]

Phase 2a — OSV import-level reachability

Import-level reachability for OSV vulns (per plan Phase 2a). Distinguishes reachable (package imported in changed code) from manifest_only (declared in manifest, not imported).

Changes

• Finding.reachability: Option<String> — reachable | manifest_only (serde-serialized; not persisted to DB)
• Import hits: OSV severity uplift CRITICAL/HIGH → warning, confidence 5, reachability: reachable
• Manifest-only deps (package.json, requirements.txt, pyproject.toml, Cargo.toml, go.mod): info, confidence 3, reachability: manifest_only, message notes "not imported in this PR"
• [reachability] enabled = true config (TOML section; serde auto-picks), default on
• @security command passes enabled=true
• 3 new tests; docs updated

Gates

• fmt / clippy -D warnings / 238 tests — all green

[codasaurus-e0a6]

Codasaurus

This PR updates 26 files across src, docs. Automated checks look clear.

Changes

Path	What changed
docs/codasaurus-toml.md	updated
src/bot/commands.rs	updated
src/bot/concern.rs	updated
src/bot/markdown.rs	updated
src/bot/policy.rs	updated
src/bot/provenance.rs	updated
src/bot/quality.rs	updated
src/bot/review/findings.rs	updated
…18 more

All files (26)

• docs/codasaurus-toml.md (modified)
• src/bot/commands.rs (modified)
• src/bot/concern.rs (modified)
• src/bot/markdown.rs (modified)
• src/bot/policy.rs (modified)
• src/bot/provenance.rs (modified)
• src/bot/quality.rs (modified)
• src/bot/review/findings.rs (modified)
• src/confidence.rs (modified)
• src/config.rs (modified)
• src/detectors/graph.rs (modified)
• src/detectors/guidelines.rs (modified)
• src/detectors/hallucinated_imports.rs (modified)
• src/detectors/iac.rs (modified)
• src/detectors/license_drift.rs (modified)
• src/detectors/lockfile_drift.rs (modified)
• src/detectors/mod.rs (modified)
• src/detectors/phantom_deps.rs (modified)
• src/detectors/risky_patterns.rs (modified)
• src/detectors/security.rs (modified)
• src/detectors/slop.rs (modified)
• src/detectors/stale_api.rs (modified)
• src/detectors/style.rs (modified)
• src/detectors/vulnerabilities.rs (modified)
• src/gates.rs (modified)
• src/registry/mod.rs (modified)

[codasaurus-e0a6]

Context

Blast radius

Sensitive path: src/detectors/mod.rs (+1)

Blast details

High-sensitivity paths:

• src/detectors/mod.rs
• src/registry/mod.rs

Top imports in this PR:

• super:: (2 importers)

_{Bounded estimate from PR imports only.}

Related pull requests

• feat: confidence score (0-5) + optional LLM judge #24: feat: confidence score (0-5) + optional LLM judge (4 shared files)
• refactor: merge review overview into a single Findings table #22: refactor: merge review overview into a single Findings table (2 shared files)
• Review maturity: advisory gate, grounding, concerns, eval, learning guard #19: Review maturity: advisory gate, grounding, concerns, eval, learning guar (2 shared files)

[codasaurus-e0a6]

Checks

All clear. Automated checks did not find anything to fix before merge.

Commands

Type as plain text (GitHub Apps are not @-mentionable):

review · describe · summarize · improve · security · ask … · ignore <fp> · help

_{Full list: @codasaurus help}