@polymorphism-tech/morph-spec 4.22.0 → 5.0.1

package/framework/skills/level-0-meta/morph-code-review/SKILL.md

@@ -1,250 +0,0 @@
----
-name: morph-code-review
-description: .NET/C# code review checklist covering naming conventions, architecture layer integrity, async patterns, logging, error handling, DI lifetimes, and DTO contracts. Use after implementing .NET code, before creating PRs, or when reviewing C# code for compliance with MORPH-SPEC standards.
-user-invocable: true
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - dotnet
----
-
-# Code Review Checklist
-
-> Comprehensive checklist for .NET code review: naming, architecture, clean code, duplication, and runtime patterns.
-> **Example:** `references/review-example.md` — filled-in review showing expected finding format and severity levels.
-> **Script:** `scripts/scan-csharp.mjs` — automated scan for CRITICAL/HIGH violations before manual review.
-> **Ref:** `references/review-guidelines.md` — false-positive rubric, confidence scoring, evidence format.
-
----
-
-## Step 0 — Eligibility Check
-
-```bash
-git diff --name-only main...HEAD -- "*.cs" | wc -l
-```
-
-**Skip review if:**
-- 0 `.cs` files changed → no backend code to review
-- Only changes in `*.json`, `*.csproj`, `*.md`, migration files → infrastructure scope
-- `.morph/features/$ARGUMENTS/5-implement/code-review.md` already exists from today → already reviewed
-
-If skipping: output `"Skipping code-review: [reason]"` and stop.
-
----
-
-## Naming & Style (ref: coding.md)
-
-- [ ] `[CRITICAL]` Constants use PascalCase (`MaxRetryCount`, NOT `MAX_RETRY_COUNT`)
-- [ ] `[CRITICAL]` No Hungarian notation (`strName`, `iCount`, `btnSubmit`)
-- [ ] `[HIGH]` Private fields use `_camelCase` prefix
-- [ ] `[HIGH]` Async methods have `Async` suffix
-- [ ] `[HIGH]` Interfaces prefixed with `I`
-- [ ] `[MEDIUM]` No abbreviations in public APIs (`repository` not `repo`)
-- [ ] `[MEDIUM]` All classes `sealed` unless designed for inheritance
-- [ ] `[MEDIUM]` File-scoped namespaces used
-
----
-
-## Architecture Review (ref: architecture.md)
-
-### Layer Integrity
-- [ ] `[CRITICAL]` Domain has zero references to Infrastructure or Web
-- [ ] `[CRITICAL]` No circular dependencies between projects
-- [ ] `[HIGH]` Application does NOT reference Web project
-- [ ] `[HIGH]` Infrastructure details don't leak into Application DTOs
-
-### Responsibility & Organization
-- [ ] `[HIGH]` No class > 300 lines (SRP violation)
-- [ ] `[HIGH]` Controllers/pages are thin (< 50 lines logic)
-- [ ] `[MEDIUM]` One class per file, file name = class name
-- [ ] `[MEDIUM]` Files in correct project/folder per architecture.md
-- [ ] `[LOW]` No "God classes" (10+ constructor dependencies)
-
-### Dependencies
-- [ ] `[HIGH]` External services accessed through interfaces
-- [ ] `[HIGH]` No hardcoded connection strings, URLs, or secrets
-- [ ] `[MEDIUM]` Configuration via Options pattern (`IOptions<T>`)
-- [ ] `[LOW]` No over-abstraction (interface with 1 impl never mocked)
-
----
-
-## Clean Code Review
-
-### Method Quality
-- [ ] `[HIGH]` No methods > 30 lines (extract sub-methods)
-- [ ] `[HIGH]` No methods with > 4 parameters (use request object)
-- [ ] `[MEDIUM]` No nested conditionals > 3 levels (use early return)
-- [ ] `[MEDIUM]` No complex conditionals (> 3 conditions — extract to named method)
-
-### Magic Values
-- [ ] `[HIGH]` No magic strings in comparisons (use enum or constant)
-- [ ] `[HIGH]` No magic numbers (extract to PascalCase constant)
-- [ ] `[MEDIUM]` No hardcoded URLs, file paths, or config values
-
-### Dead Code
-- [ ] `[MEDIUM]` No unused private methods
-- [ ] `[MEDIUM]` No unused parameters
-- [ ] `[LOW]` No commented-out code blocks (> 3 lines)
-- [ ] `[LOW]` No empty or near-empty files
-
----
-
-## Duplication Review
-
-- [ ] `[HIGH]` No exact/near-exact duplicate methods across classes
-- [ ] `[HIGH]` No duplicate model definitions (same properties in different classes)
-- [ ] `[MEDIUM]` No thin wrappers that only delegate without adding value
-- [ ] `[MEDIUM]` No mirrored interface methods (extract base interface)
-- [ ] `[MEDIUM]` No duplicate enums across projects (centralize in Domain)
-- [ ] `[LOW]` No passthrough service methods (controller -> service with zero logic)
-
----
-
-## Async & Cancellation
-
-- [ ] `[CRITICAL]` CancellationToken propagated through entire call chain
-- [ ] `[CRITICAL]` No `.Result` or `.Wait()` (deadlock risk in ASP.NET)
-- [ ] `[HIGH]` No `async void` (except event handlers)
-- [ ] `[HIGH]` Timeout configured for external operations
-- [ ] `[MEDIUM]` `ConfigureAwait(false)` only in library code
-
----
-
-## Logging
-
-- [ ] `[HIGH]` Logs at critical points (entry, exit, errors)
-- [ ] `[HIGH]` No `$""` string interpolation in log methods (use message templates)
-- [ ] `[HIGH]` No sensitive data logged (passwords, tokens, PII)
-- [ ] `[MEDIUM]` Logs include correlation IDs (OrderId, UserId)
-- [ ] `[MEDIUM]` Appropriate log level (Information, Warning, Error)
-
----
-
-## Error Handling
-
-- [ ] `[CRITICAL]` No empty catch blocks
-- [ ] `[HIGH]` Specific exceptions (not generic `catch (Exception)` without re-throw)
-- [ ] `[HIGH]` Inner exception preserved on re-throw
-- [ ] `[HIGH]` Result pattern for expected business errors, exceptions for infrastructure
-- [ ] `[MEDIUM]` Consistent error handling pattern across all services
-
----
-
-## DI
-
-- [ ] `[HIGH]` Constructor injection with interfaces (not concrete types)
-- [ ] `[HIGH]` Correct lifetime (Scoped for DbContext, Singleton for factories)
-- [ ] `[MEDIUM]` No service locator pattern (`IServiceProvider.GetService<T>()` in business code)
-
----
-
-## Services
-
-### State Validation
-- [ ] `[HIGH]` Validates INVALID states (not valid ones) for future extensibility
-- [ ] `[HIGH]` Error states handled explicitly
-
-```csharp
-// Correct: validate INVALID states
-if (order.Status >= OrderStatus.Completed || order.Status == OrderStatus.Failed)
-    throw new InvalidOperationException("Cannot process completed or failed order");
-```
-
-### Transactions
-- [ ] `[HIGH]` Multiple operations wrapped in transaction
-- [ ] `[HIGH]` Rollback on error
-
-```csharp
-await using var transaction = await _context.Database.BeginTransactionAsync(ct);
-try
-{
-    await _repository.AddAsync(order, ct);
-    await _paymentService.ChargeAsync(order.Id, ct);
-    await transaction.CommitAsync(ct);
-}
-catch { await transaction.RollbackAsync(ct); throw; }
-```
-
----
-
-## Background Operations
-
-### DbContext Safety
-- [ ] `[CRITICAL]` Uses `IDbContextFactory` (not scoped DbContext)
-- [ ] `[CRITICAL]` Repository created via Factory with `await using`
-- [ ] `[HIGH]` No `Task.Delay` as race condition workaround
-
-```csharp
-// Correct pattern
-_ = Task.Run(async () =>
-{
-    try
-    {
-        await using var repo = _repoFactory.CreateScoped();
-        var order = await repo.GetByIdAsync(orderId);
-        // ...
-    }
-    catch (Exception ex) { _logger.LogError(ex, "Failed {OrderId}", orderId); }
-});
-```
-
-### Hangfire Jobs
-- [ ] `[HIGH]` `[AutomaticRetry]` configured
-- [ ] `[HIGH]` Job is idempotent (safe to run multiple times)
-- [ ] `[MEDIUM]` CancellationToken used
-- [ ] `[MEDIUM]` No HTTP request state dependency
-
-### Resilience
-- [ ] `[MEDIUM]` Retry policy for transient operations
-- [ ] `[MEDIUM]` State persisted before long operation
-- [ ] `[MEDIUM]` Idempotency guaranteed for retries
-
----
-
-## DTOs / Contracts
-
-### Naming
-- [ ] `[HIGH]` Descriptive property names (not "Data", "Value", "Info")
-- [ ] `[HIGH]` Correct suffix: `Request` (input), `Response` (output), `Dto` (generic), `Command`/`Query` (CQRS)
-
-### Types
-- [ ] `[MEDIUM]` `Stream` for large files, `byte[]` for small in-memory data
-- [ ] `[MEDIUM]` `DateTimeOffset` for timestamps, `DateTime` for local dates
-- [ ] `[MEDIUM]` Nullable `?` only where truly optional
-
-### Structure
-- [ ] `[MEDIUM]` Records for immutable DTOs, classes with `init` for mutable entities
-- [ ] `[MEDIUM]` Response DTOs have all properties needed by UI
-- [ ] `[MEDIUM]` Enums have explicit values with logical ordering (errors at 100+)
-
-```csharp
-public enum OrderStatus
-{
-    Created = 0, PendingPayment = 1, Processing = 2, Completed = 3,  // Normal flow
-    Failed = 100, Cancelled = 101, Refunded = 102                    // Error states
-}
-```
-
-### Service Interfaces
-- [ ] `[HIGH]` Async methods with `Async` suffix
-- [ ] `[HIGH]` CancellationToken as last parameter
-- [ ] `[MEDIUM]` `Task<Result<T>>` for expected business errors
-
----
-
-## Quick Pre-Merge Checklist
-
-```
-[ ] Naming follows coding.md (PascalCase constants, _camelCase fields, sealed classes)
-[ ] CancellationToken propagated on all async methods
-[ ] Structured logging at critical points (message templates, not $"")
-[ ] No empty catch blocks, Result pattern for business errors
-[ ] Background ops use IDbContextFactory + await using
-[ ] No duplicate code, no magic values, no methods > 30 lines
-[ ] Architecture layers respected (Domain has zero external refs)
-[ ] DTOs have descriptive names + correct types
-```
-
----
-
-*Consolidated from: code-review-services.md + code-review-background.md + code-review-contracts.md + architecture/clean-code/duplication analysis.*
-*MORPH-SPEC by Polymorphism Tech*

package/framework/skills/level-0-meta/morph-code-review/references/review-example.md

@@ -1,164 +0,0 @@
-# Code Review Report — Photo Processing Pipeline
-
-> Example of a well-structured code review output. Filled-in reference — not a template.
-
-**Scope:** `src/Application/PhotoProcessing/` + `src/Web/Endpoints/PhotoProcessingEndpoints.cs`
-**Date:** 2025-01-22
-**Reviewer:** code-review skill
-
----
-
-## Findings by Severity
-
-| Severity | Count |
-|----------|-------|
-| CRITICAL | 1 |
-| HIGH | 2 |
-| MEDIUM | 2 |
-| LOW | 1 |
-
----
-
-### [CRITICAL] Naming: UPPER_SNAKE_CASE constant
-
-**File:** `src/Application/PhotoProcessing/PhotoProcessingService.cs:14`
-
-**Current code:**
-```csharp
-private const int MAX_RETRY_COUNT = 3;
-private const int DEFAULT_TIMEOUT_SECONDS = 30;
-```
-
-**Suggested fix:**
-```csharp
-private const int MaxRetryCount = 3;
-private const int DefaultTimeoutSeconds = 30;
-```
-
-**Why:** `ALL_CAPS` constants violate C# conventions (§ coding.md). Pascal case is the .NET standard.
-
----
-
-### [HIGH] Async: Missing CancellationToken propagation
-
-**File:** `src/Infrastructure/Storage/AzureBlobStorageService.cs:28`
-
-**Current code:**
-```csharp
-public async Task<string> UploadAsync(Stream content, string blobName)
-{
-    var blobClient = _containerClient.GetBlobClient(blobName);
-    await blobClient.UploadAsync(content);  // no CT
-    return blobClient.Uri.ToString();
-}
-```
-
-**Suggested fix:**
-```csharp
-public async Task<string> UploadAsync(Stream content, string blobName, CancellationToken ct = default)
-{
-    var blobClient = _containerClient.GetBlobClient(blobName);
-    await blobClient.UploadAsync(content, cancellationToken: ct);
-    return blobClient.Uri.ToString();
-}
-```
-
-**Why:** Cancellation cannot propagate into the Blob SDK call, meaning a cancelled HTTP request still holds the upload open.
-
----
-
-### [HIGH] Logging: String interpolation in ILogger call
-
-**File:** `src/Application/PhotoProcessing/PhotoProcessingJob.cs:52`
-
-**Current code:**
-```csharp
-_logger.LogError($"Job {jobId} failed after {retryCount} retries: {ex.Message}");
-```
-
-**Suggested fix:**
-```csharp
-_logger.LogError("Job {JobId} failed after {RetryCount} retries: {ErrorMessage}",
-    jobId, retryCount, ex.Message);
-```
-
-**Why:** String interpolation allocates eagerly even if the log level is filtered. Message templates are structured and queryable in Application Insights / Seq.
-
----
-
-### [MEDIUM] Architecture: Controller logic exceeds 50 lines
-
-**File:** `src/Web/Endpoints/PhotoProcessingEndpoints.cs`
-
-**Issue:** The upload endpoint inline lambda is 60+ lines — includes validation, service call, response mapping, and error handling all inline.
-
-**Suggested fix:** Extract a `UploadPhotoRequestHandler` or move validation to a FluentValidation `IValidator<UploadPhotoCommand>`. The endpoint lambda should be < 10 lines.
-
-**Why:** Fat endpoints are hard to test and violate the "thin API layer" rule (§ architecture.md).
-
----
-
-### [MEDIUM] Error Handling: Generic catch without context
-
-**File:** `src/Application/PhotoProcessing/PhotoProcessingService.cs:89`
-
-**Current code:**
-```csharp
-catch (Exception ex)
-{
-    _logger.LogError(ex, "Upload failed");
-    throw;
-}
-```
-
-**Suggested fix:**
-```csharp
-catch (Exception ex)
-{
-    _logger.LogError(ex, "Upload failed for user {UserId}", userId);
-    throw;
-}
-```
-
-**Why:** Log entries without correlation IDs (UserId, JobId) are unqueryable in production. Always include the relevant entity ID.
-
----
-
-### [LOW] Dead Code: Unused private method
-
-**File:** `src/Application/PhotoProcessing/PhotoProcessingService.cs:110`
-
-**Current code:**
-```csharp
-private string BuildBlobPath(Guid jobId, string suffix)
-    => $"uploads/{jobId}/{suffix}";
-// Called 0 times — path built inline everywhere
-```
-
-**Suggested fix:** Either use `BuildBlobPath` consistently or delete it.
-
-**Why:** Dead code misleads future readers and increases maintenance surface.
-
----
-
-## Top Priorities
-
-1. `PhotoProcessingService.cs:14` — CRITICAL naming violation (5 min fix)
-2. `AzureBlobStorageService.cs:28` — HIGH missing CancellationToken (10 min fix)
-3. `PhotoProcessingJob.cs:52` — HIGH structured logging (5 min fix)
-4. `PhotoProcessingEndpoints.cs` — MEDIUM endpoint refactor (30 min)
-
----
-
-## Passed Checks ✅
-
-- Layer integrity: Domain has no Infrastructure references
-- All async methods have `Async` suffix
-- Private fields use `_camelCase`
-- No hardcoded connection strings or secrets
-- External services accessed through interfaces (`IBlobStorageService`, `IPhotoProcessingJob`)
-- `ProcessingJob` entity uses private setters + domain methods
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/skills/level-0-meta/morph-code-review/references/review-guidelines.md

@@ -1,100 +0,0 @@
-# Review Guidelines — False-Positive Rubric
-
-> Documento de referência compartilhado por todos os review skills.
-> Claude deve ler este documento antes de executar qualquer revisão de código.
-
----
-
-## Confidence Scoring
-
-Antes de reportar um finding, atribua um confidence score de 0–100:
-
-| Score | Interpretação | Ação |
-|-------|--------------|------|
-| 90–100 | Definitivamente real — reproduzível mecanicamente | Reportar |
-| 75–89 | Provavelmente real — padrão forte de problema | Reportar com justificativa |
-| 50–74 | Incerto — depende de contexto não visível | Só reportar se CRITICAL/HIGH |
-| 25–49 | Provavelmente false positive | Ignorar |
-| 0–24 | Definitivamente false positive | Nunca reportar |
-
-**Threshold: reportar apenas findings com confidence ≥ 75.**
-
-O confidence score não aparece no output — aplique o filtro internamente. Output limpo = só findings que passaram ≥ 75.
-
----
-
-## Categorias de False Positives (sempre ignorar)
-
-1. **Violações pré-existentes** — código não alterado neste PR/branch. Se está no `git diff`, é relevante. Se não está, é dívida técnica para uma task de refactor separada.
-
-2. **Linter/formatter-catchable** — naming trivial, whitespace, import order. Ferramentas automáticas cobrem isso; não gaste tempo de review manual neles.
-
-3. **Preocupações arquiteturais especulativas** — "pode ser problema se escalar para 1M users", "esta abordagem pode causar N+1 se o dataset crescer". Só reporte se o problema for atual e concreto.
-
-4. **Nitpicks abaixo de LOW** — preferências cosméticas sem impacto em corretude, performance ou manutenibilidade. Se não tem severidade, não reportar.
-
-5. **Build errors** — se o código compila, não é build error. Não reporte problemas que o compilador já rejeitaria.
-
----
-
-## Formato de Evidência Obrigatório
-
-Todo finding DEVE incluir:
-
-```
-src/Application/Orders/OrderService.cs:42
-```csharp
-catch { }  // ← snippet do código ofensivo (≤ 5 linhas)
-```
-Motivo: viola [EMPTY_CATCH] — exceções silenciadas impossibilitam diagnóstico.
-Fix: adicionar logging mínimo + re-throw, ou tratar o caso explicitamente.
-```
-
-Campos obrigatórios por finding:
-- **File:line** — caminho relativo ao projeto + número da linha
-- **Snippet** — trecho do código ofensivo, ≤ 5 linhas
-- **Motivo** — por que viola o padrão (referência de regra ou checklist item)
-- **Fix** — sugestão concreta e acionável
-
-Findings sem file:line são invalidos e não devem ser reportados.
-
----
-
-## Escopo: Apenas Código Alterado
-
-Focar exclusivamente em arquivos de:
-
-```bash
-git diff --name-only main...HEAD
-```
-
-Issues pré-existentes = dívida técnica para tasks de refactor dedicadas, **não** para revisões de feature PR.
-
-Se usando `scan-csharp.mjs` ou `scan-nextjs.mjs`, prefira `--diff` para limitar o escopo automaticamente.
-
----
-
-## Saída Esperada
-
-Após filtrar por confidence ≥ 75 e ignorar false positives, a saída deve ser uma das duas formas:
-
-**Se há findings:**
-```
-## Code Review — [stack]
-
-### CRITICAL
-- `src/Foo/Bar.cs:15` — [EMPTY_CATCH] Empty catch block swallows exceptions.
-  ```csharp
-  catch { }
-  ```
-  Fix: log + re-throw, ou tratar o caso.
-
-### HIGH
-- `src/Foo/OrderService.cs:88` — [MISSING_CANCELLATION_TOKEN] Async method `ProcessOrderAsync` sem CancellationToken.
-  Fix: adicionar `CancellationToken ct = default` como último parâmetro.
-```
-
-**Se sem findings CRITICAL/HIGH:**
-```
-✅ Sem CRITICAL/HIGH em [stack] alterado. [N arquivos revisados]
-```

package/framework/skills/level-0-meta/morph-code-review/scripts/scan-csharp.mjs

@@ -1,151 +0,0 @@
-#!/usr/bin/env node
-/**
- * scan-csharp.mjs
- *
- * Scans .cs files for MORPH-SPEC coding standard violations.
- * Executed locally by Claude via Bash — output returned to Claude.
- *
- * Usage:
- *   node scan-csharp.mjs [path]                  # scan directory or file
- *   node scan-csharp.mjs src/                    # scan src/ recursively
- *   node scan-csharp.mjs --summary               # counts only, no details
- *   node scan-csharp.mjs --diff                  # scan only changed files (git diff main...HEAD)
- *   node scan-csharp.mjs --diff --base=develop   # use different base branch
- *
- * Checks:
- *   - UPPER_SNAKE_CASE constants       → should be PascalCase
- *   - Hungarian notation               → strName, iCount, btnSubmit
- *   - Missing CancellationToken        → async methods without CT param
- *   - String interpolation in logging  → $"" in ILogger calls
- *   - Empty catch blocks               → catch { } or catch (E) { }
- */
-
-import { readdirSync, readFileSync, statSync, existsSync } from 'fs';
-import { join, extname, relative } from 'path';
-import { execSync } from 'child_process';
-
-const args = process.argv.slice(2);
-const diffMode = args.includes('--diff');
-const summaryOnly = args.includes('--summary');
-const baseBranch = args.find(a => a.startsWith('--base='))?.split('=')[1] ?? 'main';
-const targetPath = args.find(a => !a.startsWith('--')) ?? '.';
-
-const CHECKS = [
-  {
-    id: 'UPPER_SNAKE_CASE',
-    severity: 'CRITICAL',
-    pattern: /\bconst\s+\w+\s+([A-Z][A-Z_]{2,})\s*=/g,
-    message: (m) => `Constant '${m[1]}' uses UPPER_SNAKE_CASE (anti-pattern in C#) → use PascalCase`,
-  },
-  {
-    id: 'HUNGARIAN_NOTATION',
-    severity: 'CRITICAL',
-    pattern: /\b(str|int|bool|btn|lbl|txt|dbl|flt|obj|arr|lst)([A-Z]\w*)\b/g,
-    message: (m) => `'${m[0]}' looks like Hungarian notation → rename to '${m[2].charAt(0).toLowerCase() + m[2].slice(1)}'`,
-  },
-  {
-    id: 'MISSING_CANCELLATION_TOKEN',
-    severity: 'HIGH',
-    pattern: /public\s+async\s+Task(?:<[^>]+>)?\s+(\w+Async)\s*\(([^)]*)\)/g,
-    message: (m) => {
-      const params = m[2];
-      if (params.includes('CancellationToken') || params.includes('ct ') || params.includes('ct,') || params.includes('ct)')) return null;
-      return `Async method '${m[1]}' missing CancellationToken parameter`;
-    },
-  },
-  {
-    id: 'LOG_STRING_INTERPOLATION',
-    severity: 'HIGH',
-    pattern: /\.(LogInformation|LogWarning|LogError|LogDebug|LogCritical)\s*\(\s*\$"/g,
-    message: () => 'String interpolation ($"") in log call → use message template with structured parameters',
-  },
-  {
-    id: 'EMPTY_CATCH',
-    severity: 'CRITICAL',
-    pattern: /catch\s*(\([^)]*\))?\s*\{\s*\}/g,
-    message: () => 'Empty catch block — exceptions are silently swallowed',
-  },
-];
-
-function collectCsFiles(dir) {
-  if (!existsSync(dir)) return [];
-  const stat = statSync(dir);
-  if (stat.isFile()) return dir.endsWith('.cs') ? [dir] : [];
-  const results = [];
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    if (entry.isDirectory() && entry.name !== 'bin' && entry.name !== 'obj' && entry.name !== '.git') {
-      results.push(...collectCsFiles(join(dir, entry.name)));
-    } else if (entry.isFile() && extname(entry.name) === '.cs') {
-      results.push(join(dir, entry.name));
-    }
-  }
-  return results;
-}
-
-function getChangedFiles(base) {
-  try {
-    const raw = execSync(`git diff --name-only ${base}...HEAD`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-    return raw.split('\n').map(f => f.trim()).filter(f => f.endsWith('.cs') && existsSync(f));
-  } catch {
-    return null;
-  }
-}
-
-let mode = 'full';
-let files;
-if (diffMode) {
-  const changed = getChangedFiles(baseBranch);
-  if (changed !== null) {
-    files = changed;
-    mode = 'diff';
-  } else {
-    files = collectCsFiles(targetPath);
-  }
-} else {
-  files = collectCsFiles(targetPath);
-}
-
-const findings = [];
-
-for (const file of files) {
-  const content = readFileSync(file, 'utf-8');
-  const lines = content.split('\n');
-
-  for (const check of CHECKS) {
-    const regex = new RegExp(check.pattern.source, check.pattern.flags);
-    let match;
-    while ((match = regex.exec(content)) !== null) {
-      const msg = check.message(match);
-      if (!msg) continue;
-      const lineNum = content.slice(0, match.index).split('\n').length;
-      findings.push({
-        severity: check.severity,
-        id: check.id,
-        file: relative(process.cwd(), file).replace(/\\/g, '/'),
-        line: lineNum,
-        message: msg,
-        snippet: lines[lineNum - 1]?.trim().slice(0, 100),
-      });
-    }
-  }
-}
-
-const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
-for (const f of findings) bySeverity[f.severity] = (bySeverity[f.severity] ?? 0) + 1;
-
-const summary = {
-  scanned: files.length,
-  findings: findings.length,
-  bySeverity,
-  clean: findings.length === 0,
-  mode,
-  ...(mode === 'diff' && { baseBranch, changedFilesCount: files.length }),
-};
-
-if (summaryOnly) {
-  console.log(JSON.stringify(summary, null, 2));
-} else {
-  console.log(JSON.stringify({ summary, findings }, null, 2));
-}
-
-process.exit(findings.some(f => f.severity === 'CRITICAL') ? 1 : 0);