rail_verdict 1.4.0 → 1.8.2

data/lib/rail_verdict/change_intelligence.rb

@@ -0,0 +1,274 @@
+# frozen_string_literal: true
+
+require_relative "change_surfaces"
+
+module RailVerdict
+  # Deterministic change intelligence assembly.
+  #
+  # Read-only projection over an executed verification Outcome plus its
+  # detected surfaces. NEVER influences GateResult: every method here is a
+  # pure function of already-decided verification evidence.
+  #
+  # Confidence vocabulary: surfaces carry their own detection tier
+  # ("detected" / "inferred" / "mixed"); anything that cannot be established
+  # deterministically is reported under missing_evidence as "unknown" — never
+  # as a fact.
+  module ChangeIntelligence
+    RISK_ORDER = { "low" => 0, "medium" => 1, "high" => 2, "critical" => 3 }.freeze
+
+    SIGNAL_CODES = {
+      "security" => "security_config_changed",
+      "authorization" => "authorization_surface_changed",
+      "authentication" => "authentication_surface_changed",
+      "migration" => "migration_added",
+      "database" => "database_surface_changed",
+      "dependencies" => "dependency_changed",
+      "public_api" => "public_api_changed",
+      "routes" => "routes_changed",
+      "shared_infrastructure" => "shared_infrastructure_changed",
+      "configuration" => "configuration_changed"
+    }.freeze
+
+    # Priority order for Review Focus (trust-critical first).
+    FOCUS_ORDER = %w[
+      security authorization authentication migration database dependencies
+      public_api routes shared_infrastructure configuration controllers models
+      background_jobs mailers views storage initializers test_infrastructure
+    ].freeze
+
+    module_function
+
+    def changed_paths(git_context)
+      return nil unless git_context
+
+      git_context.changed_files.flat_map { |file| [file.path, file.old_path, file.new_path] }.compact.uniq.sort
+    end
+
+    # Array of { code, surface?, project_area?, detail, paths, sensitive }.
+    def review_signals(surfaces, project_areas)
+      signals = []
+      SIGNAL_CODES.each do |surface_id, code|
+        entry = surfaces[surface_id]
+        next unless entry && entry["available"] && entry["changed"]
+
+        signals << {
+          "code" => code,
+          "surface" => surface_id,
+          "detail" => "#{ChangeSurfaces::SURFACES[surface_id]['label']} surface changed",
+          "paths" => entry["evidence"],
+          "additional_evidence_count" => entry["additional_evidence_count"],
+          "sensitive" => entry["sensitive"],
+          "detection" => entry["detection"]
+        }
+      end
+      Array(project_areas).each do |area|
+        next unless area["available"] && area["changed"]
+
+        signals << {
+          "code" => "project_sensitive_path_changed:#{area['name']}",
+          "project_area" => area["name"],
+          "detail" => "Project-defined sensitive area '#{area['name']}' changed",
+          "paths" => area["evidence"],
+          "additional_evidence_count" => area["additional_evidence_count"],
+          "sensitive" => true,
+          "detection" => "detected"
+        }
+      end
+      signals
+    end
+
+    # { level, reasons, configured } — max-severity aggregation, explainable.
+    def review_risk(signals, risk_overrides)
+      overrides = risk_overrides.is_a?(Hash) ? risk_overrides : {}
+      reasons = []
+      level = "low"
+      signals.each do |signal|
+        base = if signal["project_area"]
+          "high"
+        else
+          ChangeSurfaces::SURFACES.dig(signal["surface"], "default_risk")
+        end
+        next if base.nil?
+
+        mapped = overrides.fetch(signal["surface"] || signal["code"], base).to_s
+        mapped = base unless RISK_ORDER.key?(mapped)
+        reasons << signal["code"]
+        level = mapped if RISK_ORDER[mapped] > RISK_ORDER[level]
+      end
+      { "level" => level.upcase, "reasons" => reasons.uniq.sort,
+        "configured" => !overrides.empty? }
+    end
+
+    # { available, reason?, frameworks: { rspec|minitest => {...} } }.
+    # Executed analyzer evidence wins; when an analyzer did not execute,
+    # the deterministic TestSelection recompute is reported as the selection
+    # basis with executed: false.
+    def verification_scope(result, repository_root:, git_context:)
+      frameworks = {}
+      %w[rspec minitest].each do |name|
+        frameworks[name] = framework_scope(result, name,
+          repository_root: repository_root, git_context: git_context)
+      end
+      if frameworks.values.all? { |entry| entry["scope"] == "unknown" }
+        { "available" => false, "reason" => "test_scope_unavailable", "frameworks" => frameworks }
+      else
+        { "available" => true, "frameworks" => frameworks }
+      end
+    end
+
+    def framework_scope(result, name, repository_root:, git_context:)
+      analyzer = result.analyzer_results.find { |item| item.analyzer == name }
+      summary = analyzer&.evidence_summary
+      if analyzer && analyzer.execution_status == "succeeded" && summary.is_a?(Hash)
+        entry = {
+          "available" => true, "executed" => true,
+          "execution_status" => analyzer.execution_status,
+          "scope" => summary["test_scope"] || "full"
+        }
+        entry["selected_files"] = Array(summary["target_files"]).compact.sort if summary["target_files"]
+        entry["fallback_reason"] = summary["fallback_reason"] if summary["fallback_reason"]
+        return entry
+      end
+      return { "available" => false, "executed" => false, "scope" => "unknown",
+               "reason" => analyzer ? "analyzer_#{analyzer.execution_status}" : "analyzer_not_configured" } unless git_context
+
+      begin
+        selection = TestSelection.resolve(repository_root: repository_root,
+          git_context: git_context, framework: name.to_sym)
+        entry = { "available" => true, "executed" => false,
+                  "execution_status" => analyzer ? analyzer.execution_status : "not_executed",
+                  "scope" => selection.scope }
+        entry["selected_files"] = selection.selected_files if selection.scope == "targeted"
+        entry["fallback_reason"] = selection.fallback_reason if selection.fallback_reason
+        entry
+      rescue StandardError
+        { "available" => false, "executed" => false, "scope" => "unknown",
+          "reason" => "selection_unresolvable" }
+      end
+    end
+    private_class_method :framework_scope
+
+    # Array of { code, detail, reason }. Facts about gaps, never guesses.
+    def missing_evidence(outcome, surfaces, verification_scope)
+      result = outcome.result
+      gaps = []
+      auth = surfaces["authorization"]
+      if auth && auth["available"] && auth["changed"]
+        gaps << {
+          "code" => "authorization_changed_verification_not_established",
+          "detail" => "Authorization surface changed; no deterministic authorization-to-test mapping exists",
+          "reason" => "no_deterministic_relationship_established",
+          "confidence" => "unknown"
+        }
+      end
+      verification_scope.fetch("frameworks", {}).each do |name, entry|
+        reason = entry["fallback_reason"].to_s
+        next unless reason.start_with?("unmapped_source_change:", "unrecognized_source_file:")
+
+        outcome_text = entry["executed"] ? "full suite ran instead" : "full suite required (#{name} not executed)"
+        gaps << {
+          "code" => "targeted_test_mapping_ambiguous",
+          "detail" => "#{name}: #{reason} — #{outcome_text}",
+          "reason" => reason,
+          "confidence" => "unknown"
+        }
+      end
+      configuration = outcome.respond_to?(:configuration) ? outcome.configuration : nil
+      configuration = nil unless configuration.respond_to?(:analyzer_required?)
+      if configuration
+        required_incomplete = result.analyzer_results.select do |analyzer|
+          begin
+            configuration.analyzer_required?(analyzer.analyzer)
+          rescue StandardError
+            false
+          end && analyzer.execution_status != "succeeded"
+        end
+        required_incomplete.each do |analyzer|
+          gaps << {
+            "code" => "required_analyzer_incomplete",
+            "detail" => "Required analyzer '#{analyzer.analyzer}' did not succeed (#{analyzer.execution_status})",
+            "reason" => analyzer.failure ? analyzer.failure["code"].to_s : analyzer.execution_status,
+            "confidence" => "detected"
+          }
+        end
+      end
+      coverage = result.analyzer_results.find { |item| item.analyzer == "simplecov" }
+      if coverage.nil? || coverage.execution_status != "succeeded"
+        gaps << {
+          "code" => "coverage_evidence_unavailable",
+          "detail" => "Changed-lines coverage could not be established",
+          "reason" => coverage ? "simplecov_#{coverage.execution_status}" : "simplecov_not_configured",
+          "confidence" => "unknown"
+        }
+      end
+      unless result.baseline && result.baseline["loaded"] == true
+        gaps << {
+          "code" => "baseline_unavailable",
+          "detail" => "No quality delta: baseline not loaded, so introduced/resolved cannot be distinguished from existing",
+          "reason" => result.baseline && result.baseline["compatible"] == false ? "baseline_incompatible" : "baseline_not_available",
+          "confidence" => "detected"
+        }
+      end
+      gaps << {
+        "code" => "git_scope_unavailable",
+        "detail" => "Changed scope could not be established; surfaces, signals, and focus are unavailable",
+        "reason" => "git_scope_unavailable",
+        "confidence" => "detected"
+      } if outcome.context&.git_context.nil? && result.git.nil?
+      gaps
+    end
+    # Ordered { rank, surface, title, reason, paths, additional_evidence_count }.
+    # Non-sensitive items whose evidence is fully covered by higher-ranked
+    # items are skipped to reduce the review search space; sensitive items
+    # and project areas are always shown. Deterministic: FOCUS_ORDER decides.
+    def review_focus(surfaces, project_areas, changed_paths = [])
+      items = []
+      covered = {}
+      FOCUS_ORDER.each do |surface_id|
+        entry = surfaces[surface_id]
+        next unless entry && entry["available"] && entry["changed"]
+
+        sensitive = ChangeSurfaces::SURFACES[surface_id]["default_risk"] != nil
+        paths = entry["evidence"].first(10)
+        unless sensitive
+          next if !paths.empty? && paths.all? { |path| covered.key?(path) }
+        end
+        paths.each { |path| covered[path] = true }
+        items << {
+          "surface" => surface_id,
+          "title" => ChangeSurfaces::SURFACES[surface_id]["label"],
+          "reason" => "#{ChangeSurfaces::SURFACES[surface_id]['label']} surface changed",
+          "paths" => paths,
+          "additional_evidence_count" => entry["additional_evidence_count"] + [entry["evidence"].length - 10, 0].max,
+          "detection" => entry["detection"]
+        }
+      end
+      Array(project_areas).each do |area|
+        next unless area["available"] && area["changed"]
+
+        items << {
+          "surface" => "project:#{area['name']}",
+          "title" => "Sensitive area: #{area['name']}",
+          "reason" => "Project-defined sensitive area '#{area['name']}' changed",
+          "paths" => Array(area["evidence"]).first(10),
+          "additional_evidence_count" => area["additional_evidence_count"],
+          "detection" => "detected"
+        }
+        Array(area["evidence"]).each { |path| covered[path] = true }
+      end
+      unmapped = Array(changed_paths).map(&:to_s).uniq.sort.reject { |path| covered.key?(path) }
+      unless unmapped.empty?
+        head = unmapped.first(10)
+        items << {
+          "surface" => "unmapped",
+          "title" => "Unmapped changed files (#{unmapped.length})",
+          "reason" => "Changed files matching no Rails surface or project area; review directly",
+          "paths" => head,
+          "additional_evidence_count" => unmapped.length - head.length,
+          "detection" => "detected"
+        }
+      end
+      items.each_with_index.map { |item, index| item.merge("rank" => index + 1) }
+    end
+  end
+end

data/lib/rail_verdict/change_surfaces.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  # Deterministic Rails-aware change surface detection.
+  #
+  # Every surface is a pure function of changed file paths. Each reported
+  # surface carries its evidence paths; nothing is ever asserted without
+  # evidence. Detection tier is explicit:
+  # - "detected": strong Rails path convention (reliable).
+  # - "inferred": filename heuristic, documented as such (see AUTHENTICATION,
+  #   PUBLIC_API, and the name-pattern tier of SECURITY).
+  module ChangeSurfaces
+    MAX_EVIDENCE = 20
+
+    # id => { label, detection, matchers: [lambdas], default_risk }
+    # default_risk nil means the surface is not sensitive by default.
+    SURFACES = {
+      "security" => {
+        "label" => "Security",
+        "detection" => "mixed",
+        "default_risk" => "critical",
+        "matchers" => [
+          lambda { |path| path.start_with?("config/credentials/") || path == "config/credentials.yml.enc" },
+          lambda { |path| path == "config/master.key" || path == "config/credentials.key" },
+          lambda { |path| path.start_with?("config/initializers/") && path.match?(/secret|credential|csp|secure_headers|ssl|force_ssl/i) }
+        ]
+      },
+      "authorization" => {
+        "label" => "Authorization",
+        "detection" => "detected",
+        "default_risk" => "high",
+        "matchers" => [
+          lambda { |path| path.start_with?("app/policies/") },
+          lambda { |path| path == "app/models/ability.rb" || path.end_with?("/ability.rb") },
+          lambda { |path| path.include?("/abilities/") && path.end_with?(".rb") }
+        ]
+      },
+      "authentication" => {
+        "label" => "Authentication",
+        "detection" => "inferred",
+        "default_risk" => "high",
+        "matchers" => [
+          lambda { |path| path == "config/initializers/devise.rb" },
+          lambda { |path| path.match?(%r{\Aapp/controllers/.*sessions?_controller\.rb\z}) },
+          lambda { |path| path.match?(%r{\Aapp/controllers/.*(passwords|registrations|unlocks|confirmations|omniauth_callbacks)_controller\.rb\z}) },
+          lambda { |path| path.start_with?("app/models/") && File.basename(path).match?(/session|token|password/i) }
+        ]
+      },
+      "migration" => {
+        "label" => "Migration",
+        "detection" => "detected",
+        "default_risk" => "high",
+        "matchers" => [lambda { |path| path.start_with?("db/migrate/") }]
+      },
+      "database" => {
+        "label" => "Database",
+        "detection" => "detected",
+        "default_risk" => "medium",
+        "matchers" => [
+          lambda { |path| path == "db/schema.rb" || path == "db/structure.sql" },
+          lambda { |path| path.start_with?("app/models/") }
+        ]
+      },
+      "dependencies" => {
+        "label" => "Dependencies",
+        "detection" => "detected",
+        "default_risk" => "medium",
+        "matchers" => [
+          lambda { |path| %w[Gemfile Gemfile.lock].include?(path) },
+          lambda { |path| path.end_with?(".gemspec") }
+        ]
+      },
+      "public_api" => {
+        "label" => "Public API",
+        "detection" => "inferred",
+        "default_risk" => "medium",
+        "matchers" => [
+          lambda { |path| path.start_with?("app/controllers/api/") },
+          lambda { |path| path.match?(%r{\Aapp/controllers/v\d+/.+\.rb\z}) },
+          lambda { |path| path.start_with?("app/views/api/") }
+        ]
+      },
+      "routes" => {
+        "label" => "Routes",
+        "detection" => "detected",
+        "default_risk" => "medium",
+        "matchers" => [
+          lambda { |path| path == "config/routes.rb" || path.start_with?("config/routes/") }
+        ]
+      },
+      "background_jobs" => {
+        "label" => "Background jobs",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [
+          lambda { |path| path.start_with?("app/jobs/") || path.start_with?("app/workers/") },
+          lambda { |path| path.match?(%r{\Aconfig/(sidekiq.*|initializers/sidekiq.*)\z}) }
+        ]
+      },
+      "controllers" => {
+        "label" => "Controllers",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [lambda { |path| path.start_with?("app/controllers/") }]
+      },
+      "models" => {
+        "label" => "Models",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [lambda { |path| path.start_with?("app/models/") }]
+      },
+      "views" => {
+        "label" => "Views",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [lambda { |path| path.start_with?("app/views/") }]
+      },
+      "mailers" => {
+        "label" => "Mailers",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [lambda { |path| path.start_with?("app/mailers/") }]
+      },
+      "storage" => {
+        "label" => "Storage",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [
+          lambda { |path| path.start_with?("storage/") },
+          lambda { |path| path.match?(%r{\Aconfig/storage.*\.yml\z}) }
+        ]
+      },
+      "initializers" => {
+        "label" => "Initializers",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [lambda { |path| path.start_with?("config/initializers/") }]
+      },
+      "configuration" => {
+        "label" => "Configuration",
+        "detection" => "detected",
+        "default_risk" => "medium",
+        "matchers" => [lambda { |path| path == "config" || path.start_with?("config/") }]
+      },
+      "test_infrastructure" => {
+        "label" => "Test infrastructure",
+        "detection" => "detected",
+        "default_risk" => nil,
+        "matchers" => [
+          lambda { |path| %w[spec/spec_helper.rb spec/rails_helper.rb test/test_helper.rb].include?(path) },
+          lambda { |path| path.start_with?("spec/support/") || path.start_with?("test/support/") }
+        ]
+      },
+      "shared_infrastructure" => {
+        "label" => "Shared infrastructure",
+        "detection" => "detected",
+        "default_risk" => "medium",
+        "matchers" => [
+          lambda { |path| %w[app/models/application_record.rb app/controllers/application_controller.rb app/jobs/application_job.rb app/mailers/application_mailer.rb app/helpers/application_helper.rb].include?(path) },
+          lambda { |path| %w[config/application.rb config/environment.rb config/boot.rb].include?(path) },
+          lambda { |path| path.start_with?("config/environments/") }
+        ]
+      }
+    }.freeze
+
+    RISK_LEVELS = %w[low medium high critical].freeze
+
+    module_function
+
+    # Returns { id => { available, changed, evidence, additional_evidence_count,
+    # detection, sensitive, reason? } }.
+    def detect(changed_paths, available:)
+      paths = Array(changed_paths).compact.uniq.sort
+      SURFACES.to_h do |id, spec|
+        if !available
+          [id, { "available" => false, "changed" => false, "evidence" => [],
+                  "additional_evidence_count" => 0, "detection" => spec["detection"],
+                  "sensitive" => false, "reason" => "git_scope_unavailable" }]
+        else
+          evidence = paths.select { |path| spec["matchers"].any? { |m| safe_match(m, path) } }
+          head = evidence.first(MAX_EVIDENCE)
+          [id, { "available" => true, "changed" => !evidence.empty?,
+                  "evidence" => head,
+                  "additional_evidence_count" => [evidence.length - head.length, 0].max,
+                  "detection" => spec["detection"],
+                  "sensitive" => !spec["default_risk"].nil? && !evidence.empty? }]
+        end
+      end
+    end
+
+    # Project-defined sensitive areas from configuration review.sensitive_paths:
+    # { name => [glob, ...] }. Returns array of
+    # { name, changed, evidence, additional_evidence_count }.
+    def project_sensitive(changed_paths, sensitive_config, available:)
+      config = sensitive_config.is_a?(Hash) ? sensitive_config : {}
+      paths = Array(changed_paths).compact.uniq.sort
+      config.filter_map do |name, patterns|
+        name = name.to_s
+        next if name.empty? || !patterns.is_a?(Array)
+
+        if !available
+          { "name" => name, "available" => false, "changed" => false,
+            "evidence" => [], "additional_evidence_count" => 0,
+            "reason" => "git_scope_unavailable" }
+        else
+          evidence = paths.select do |path|
+            patterns.any? { |pattern| glob_match(pattern.to_s, path) }
+          end
+          head = evidence.first(MAX_EVIDENCE)
+          { "name" => name, "available" => true, "changed" => !evidence.empty?,
+            "evidence" => head,
+            "additional_evidence_count" => [evidence.length - head.length, 0].max }
+        end
+      end
+    end
+
+    def glob_match(pattern, path)
+      return false if pattern.empty?
+
+      File.fnmatch?(pattern, path, File::FNM_PATHNAME | File::FNM_EXTGLOB)
+    rescue StandardError
+      false
+    end
+
+    def safe_match(matcher, path)
+      matcher.call(path) == true
+    rescue StandardError
+      false
+    end
+    private_class_method :safe_match
+  end
+end

data/lib/rail_verdict/check.rb

@@ -13,7 +13,8 @@ module RailVerdict
       "minitest" => RailVerdict::Analyzers::Minitest,
       "rspec" => RailVerdict::Analyzers::RSpec,
       "simplecov" => RailVerdict::Analyzers::SimpleCov,
-      "bundler_audit" => RailVerdict::Analyzers::BundlerAudit
+      "bundler_audit" => RailVerdict::Analyzers::BundlerAudit,
+      "brakeman" => RailVerdict::Analyzers::Brakeman
     }.freeze
 
     def self.registry
@@ -86,7 +87,7 @@ module RailVerdict
 
     module_function
 
-    def execute(repository_root:, config_path:, runner: ProcessRunner, rubocop_command_resolver: nil, analyzer_timeout_seconds: 30.0, interrupted: nil, baseline_path_override: nil, waiver_path_override: nil, clock: Time.now.utc, changed: false, base: nil)
+    def execute(repository_root:, config_path:, runner: ProcessRunner, rubocop_command_resolver: nil, analyzer_timeout_seconds: 30.0, interrupted: nil, baseline_path_override: nil, waiver_path_override: nil, clock: Time.now.utc, changed: false, base: nil, handoff_document: nil)
       root = File.realpath(repository_root)
       resolved_config = resolve_config_path(root, config_path)
       configuration = Configuration.load(resolved_config)
@@ -141,11 +142,45 @@ module RailVerdict
       )
       return interrupted_outcome(context: context, configuration: configuration) if interrupted&.call
 
+      input_paths = effective_input_paths(
+        root: root,
+        config_path: config_path,
+        baseline_path_override: baseline_path_override,
+        waiver_path_override: waiver_path_override
+      )
+      current_repo_state = capture_guard_state(root, input_paths)
+      current_env = {
+        "ruby_engine" => defined?(RUBY_ENGINE) ? RUBY_ENGINE : "ruby",
+        "ruby_version" => RUBY_VERSION,
+        "railverdict_version" => RailVerdict::VERSION,
+        "analyzer_versions" => analyzer_versions
+      }
+
+      plan = VerificationPlan.build(
+        repository_root: root,
+        configuration: configuration,
+        probes: probes,
+        git_context: git_context,
+        handoff_document: handoff_document,
+        current_repository_state: current_repo_state,
+        current_environment: current_env,
+        changed: changed
+      )
+
       analyzer_results = []
       findings = []
       configuration.analyzers.each do |name, selection|
         next unless selection.fetch("enabled")
 
+        name = name.to_s
+        if plan.analyzers_to_reuse.include?(name)
+          reused_ar = plan.reused_results[name]
+          reused_f = plan.reused_findings[name] || []
+          analyzer_results << reused_ar
+          findings.concat(reused_f)
+          next
+        end
+
         adapter_class = REGISTRY[name]
         unless adapter_class
           analyzer_results << AnalyzerResult.new(
@@ -162,13 +197,37 @@ module RailVerdict
         probe = probes[name]
         timeout_seconds = resolve_timeout_seconds(configuration, name, analyzer_timeout_seconds)
         begin
-          analyzer_result, analyzer_findings = adapter.run(
-            root,
-            runner: runner,
-            probe_result: probe,
-            timeout_seconds: timeout_seconds,
-            configuration: configuration
-          )
+          analyzer_result, analyzer_findings = if name == "rspec"
+                                                 adapter.run(
+                                                   root,
+                                                   runner: runner,
+                                                   probe_result: probe,
+                                                   timeout_seconds: timeout_seconds,
+                                                   configuration: configuration,
+                                                   target_files: plan.target_files["rspec"],
+                                                   test_scope: plan.test_scope,
+                                                   fallback_reason: plan.fallback_reasons["rspec"]
+                                                 )
+                                               elsif name == "minitest"
+                                                 adapter.run(
+                                                   root,
+                                                   runner: runner,
+                                                   probe_result: probe,
+                                                   timeout_seconds: timeout_seconds,
+                                                   configuration: configuration,
+                                                   target_files: plan.target_files["minitest"],
+                                                   test_scope: plan.test_scope,
+                                                   fallback_reason: plan.fallback_reasons["minitest"]
+                                                 )
+                                               else
+                                                 adapter.run(
+                                                   root,
+                                                   runner: runner,
+                                                   probe_result: probe,
+                                                   timeout_seconds: timeout_seconds,
+                                                   configuration: configuration
+                                                 )
+                                               end
         rescue StandardError => error
           # Guarded boundary: analyzer normalization must never bypass GateResult
           message = RailVerdict::Analyzers::Shared.bounded_message("#{error.class}: #{error.message}")
@@ -393,18 +452,28 @@ module RailVerdict
     end
     private_class_method :interrupted_outcome
 
-    def build_adapter(name, rubocop_command_resolver)
+    def build_adapter(name, command_resolver)
+      resolver = if command_resolver.is_a?(Hash)
+                   command_resolver[name] || command_resolver[name.to_sym]
+                 elsif name == "rubocop"
+                   command_resolver
+                 else
+                   nil
+                 end
+
       case name
       when "rubocop"
-        RailVerdict::Analyzers::RuboCop.new(command_resolver: rubocop_command_resolver)
+        RailVerdict::Analyzers::RuboCop.new(command_resolver: resolver)
       when "minitest"
-        RailVerdict::Analyzers::Minitest.new
+        RailVerdict::Analyzers::Minitest.new(command_resolver: resolver)
       when "rspec"
-        RailVerdict::Analyzers::RSpec.new
+        RailVerdict::Analyzers::RSpec.new(command_resolver: resolver)
       when "simplecov"
         RailVerdict::Analyzers::SimpleCov.new
       when "bundler_audit"
-        RailVerdict::Analyzers::BundlerAudit.new
+        RailVerdict::Analyzers::BundlerAudit.new(command_resolver: resolver)
+      when "brakeman"
+        RailVerdict::Analyzers::Brakeman.new(command_resolver: resolver)
       end
     end
     private_class_method :build_adapter