maintainability-agent 4.3.1__tar.gz → 4.4.0__tar.gz

{maintainability_agent-4.3.1/src/maintainability_agent.egg-info → maintainability_agent-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.3.1
+Version: 4.4.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.3.1**.
+Version **4.4.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -372,8 +372,11 @@ codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
-SonarQube, Qlty) rather than replacing them — their SARIF folds in via
-`--sarif-input`. Accuracy and limits: [docs/language-support.md](docs/language-support.md).
+SonarQube, Qlty) rather than replacing them. This tool runs a pinned handful of
+the analyzers it catalogs; the rest run where you already run them, and their
+SARIF is read, never run: declare each file in `analyzers.pipeline_results`
+with the concerns it covers (first-run setup asks), and those concerns count as
+examined for the languages it names. One-off files fold in via `--sarif-input`. Accuracy and limits: [docs/language-support.md](docs/language-support.md).
 
 ## Language support
 
@@ -509,7 +512,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.3.1
+- uses: marshallguillory86/maintainability-agent@v4.4.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.3.1**.
+Version **4.4.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -330,8 +330,11 @@ codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
-SonarQube, Qlty) rather than replacing them — their SARIF folds in via
-`--sarif-input`. Accuracy and limits: [docs/language-support.md](docs/language-support.md).
+SonarQube, Qlty) rather than replacing them. This tool runs a pinned handful of
+the analyzers it catalogs; the rest run where you already run them, and their
+SARIF is read, never run: declare each file in `analyzers.pipeline_results`
+with the concerns it covers (first-run setup asks), and those concerns count as
+examined for the languages it names. One-off files fold in via `--sarif-input`. Accuracy and limits: [docs/language-support.md](docs/language-support.md).
 
 ## Language support
 
@@ -467,7 +470,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.3.1
+- uses: marshallguillory86/maintainability-agent@v4.4.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.3.1
+Version: 4.4.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.3.1**.
+Version **4.4.0**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -372,8 +372,11 @@ codebase is read rather than sampled — FFmpeg's 4,687 files, not the first
 The analyzer is intentionally conservative and under-reports rather than
 over-reports: an unrecognized declaration costs one missed finding, never a
 cascade of false ones. Pair it with native tools (ESLint, Ruff, Radon, Semgrep,
-SonarQube, Qlty) rather than replacing them — their SARIF folds in via
-`--sarif-input`. Accuracy and limits: [docs/language-support.md](docs/language-support.md).
+SonarQube, Qlty) rather than replacing them. This tool runs a pinned handful of
+the analyzers it catalogs; the rest run where you already run them, and their
+SARIF is read, never run: declare each file in `analyzers.pipeline_results`
+with the concerns it covers (first-run setup asks), and those concerns count as
+examined for the languages it names. One-off files fold in via `--sarif-input`. Accuracy and limits: [docs/language-support.md](docs/language-support.md).
 
 ## Language support
 
@@ -509,7 +512,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.3.1
+- uses: marshallguillory86/maintainability-agent@v4.4.0
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -69,6 +69,7 @@ src/maintainability_audit/_metrics_types.py
 src/maintainability_audit/_operator_reads.py
 src/maintainability_audit/_oracle.py
 src/maintainability_audit/_pillars.py
+src/maintainability_audit/_pipeline_results.py
 src/maintainability_audit/_practice.py
 src/maintainability_audit/_precommit.py
 src/maintainability_audit/_precommit_install.py
@@ -353,6 +354,7 @@ tests/test_pattern_budget.py
 tests/test_phase6_claims.py
 tests/test_php_declarations.py
 tests/test_pillars_and_practice.py
+tests/test_pipeline_results.py
 tests/test_platform_claim.py
 tests/test_pmd_adapter.py
 tests/test_pmd_audit_closures.py
@@ -381,6 +383,7 @@ tests/test_release_plan.py
 tests/test_release_plan_status.py
 tests/test_rendered_docs.py
 tests/test_report_remedy_copy.py
+tests/test_reported_but_not_scored.py
 tests/test_root_grants.py
 tests/test_rubric_ignores_project_lint_config.py
 tests/test_ruby_declarations.py

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "4.3.1"
+__version__ = "4.4.0"

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_analysis.py

@@ -41,6 +41,10 @@ from ._runner import Outcome, Probe, ToolResult, run
 from ._selection import Selected, select_runnable
 from .config import acquisition_permitted
 
+#: Sources outside this package: an analyzer it ran, or a file the
+#: developer's own pipeline wrote (Decision 17). Built-ins are not here.
+EXTERNAL_TIERS = ("analyzer", "pipeline")
+
 
 @dataclass(frozen=True)
 class ToolCoverage:
@@ -152,7 +156,7 @@ class Analysis:
         """
         covered: dict[str, set[str]] = {name: set() for name in self.languages}
         for item in self.coverage:
-            if not item.contributed or item.tier != "analyzer":
+            if not item.contributed or item.tier not in EXTERNAL_TIERS:
                 continue
             concerns = self._concerns_of(item.concepts)
             for name, slug in self.languages.items():
@@ -217,7 +221,7 @@ class Analysis:
             if name in self.scored_languages
         ]
         if not scored:
-            return self._concerns_from("analyzer")
+            return self._concerns_from("analyzer") | self._concerns_from("pipeline")
         return set.intersection(*scored)
 
     def single_source_concerns(self) -> list[str]:

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_analyzer_sections.py

@@ -12,7 +12,7 @@ from pathlib import Path
 from typing import Any
 
 from ._analysis import analyze
-from ._criteria_scope import built_in_readings
+from ._criteria_scope import built_in_readings, reported_not_scored
 from ._documents import (
     coverage_document,
     findings_document,
@@ -21,6 +21,7 @@ from ._documents import (
 )
 from ._environment import environment_work_order
 from ._metrics_types import FunctionMetric
+from ._pipeline_results import add_pipeline_results
 from ._pressures import (
     ExternalPressures,
     analyzer_pressures,
@@ -46,6 +47,9 @@ def analyzer_sections(
         return {"coverage": None, "findings": [], "measurements": {},
                 "pressures": None, "environment": []}
     analysis = analyze(root, config)
+    # Decision 17: the files the developer's own pipeline wrote, read
+    # beside what this run's analyzers produced.
+    add_pipeline_results(analysis, root, config)
     coverage = coverage_document(analysis)
     # P8: where the analyzer tier could not drive a dimension, say so on
     # the coverage document rather than leaving the built-in fallback to
@@ -58,6 +62,7 @@ def analyzer_sections(
     built_in = built_in_readings(function_metrics, prefix)
     coverage["dimensions_declined"] = list(
         declined_dimensions(analysis.measurements, False, built_in, prefix))
+    coverage["reported_not_scored"] = reported_not_scored(coverage)
     return {
         "coverage": coverage,
         # ADR 006 §2c: what did not run and what it would take, for the

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_catalog.py

@@ -166,9 +166,40 @@ def settings_from(config: dict[str, Any]) -> dict[str, Any]:
     if unknown:
         raise PolicyError(f"unknown concerns {sorted(unknown)}; expected from {list(CONCERNS)}")
     settings["timeout_seconds"] = _bounded_timeout(settings["timeout_seconds"])
+    settings["pipeline_results"] = _pipeline_results(settings.get("pipeline_results"))
     return settings
 
 
+def pipeline_results_from_answer(answer: str) -> list[dict[str, Any]]:
+    """The first-run answer, `path: concern, concern; path: concern`, as declarations."""
+    entries = []
+    for part in (answer or "").split(";"):
+        if not part.strip():
+            continue
+        path, _, covers = part.partition(":")
+        entries.append({"path": path.strip(),
+                        "covers": [c.strip() for c in covers.split(",") if c.strip()]})
+    return _pipeline_results(entries)
+
+
+def _pipeline_results(declared: Any) -> list[dict[str, Any]]:
+    """Each file the developer's pipeline writes, and what it covers (Decision 17).
+
+    Refused rather than skipped: a declaration that silently examined
+    nothing would leave a concern unexamined with the operator believing
+    it covered.
+    """
+    entries = list(declared or [])
+    for entry in entries:
+        if not isinstance(entry, dict) or not isinstance(entry.get("path"), str) or not entry["path"]:
+            raise PolicyError(f"analyzers.pipeline_results entry {entry!r} needs a `path`")
+        covers = entry.get("covers")
+        if not covers or not isinstance(covers, list) or set(covers) - set(CONCERNS):
+            raise PolicyError(
+                f"analyzers.pipeline_results {entry['path']!r} needs `covers` from {list(CONCERNS)}")
+    return entries
+
+
 #: The widest per-analyzer wall clock a configured value may ask for. An
 #: hour is far past any real analyzer on any real tree and still bounds
 #: the host against a repository config that names a number designed

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_coverage_notes.py

@@ -48,6 +48,17 @@ def coverage_notes(coverage: dict[str, Any]) -> list[str]:
             "",
         ])
 
+    for unused in coverage.get("reported_not_scored") or []:
+        # The count sits in the findings beside a grade computed from
+        # something else; without this a reader takes it as ignored.
+        lines.extend([
+            f"**`{unused['tool']}` reported {unused['findings']} `{unused['concept']}` "
+            f"findings; they are listed and their count does not move the grade:** the "
+            f"`{unused['dimension']}` dimension is scored from the built-in "
+            "detectors only.",
+            "",
+        ])
+
     unexamined = coverage["concepts_unexamined"]
     if unexamined:
         # The point of the whole section. Silence about a concern is not
@@ -56,7 +67,8 @@ def coverage_notes(coverage: dict[str, Any]) -> list[str]:
             "**Nothing examined:** " + ", ".join(f"`{c}`" for c in unexamined) + ".",
             "",
             "These concerns are unmeasured, not clean. Install a tool that covers them, "
-            "or widen `analyzers.depth`, to have them reported.",
+            "widen `analyzers.depth`, or declare the SARIF your own build or pipeline "
+            "already writes in `analyzers.pipeline_results` to have them reported.",
             "",
         ])
 

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_criteria_scope.py

@@ -40,6 +40,29 @@ DECLARATION_CRITERIA: tuple[tuple[str, str, str], ...] = (
 # `risk` and `gates` are configured policy with no external equivalent.
 ANALYZER_DIMENSIONS: tuple[str, ...] = ("declarations",)
 
+# Concepts an analyzer can report whose dimension is scored from the
+# built-in detectors only. Their findings are listed, never scored.
+BUILT_IN_SCORED_CONCEPTS: dict[str, str] = {"duplication": "duplication", "file_lines": "file_size"}
+
+
+def reported_not_scored(coverage: dict) -> list[dict]:
+    """Analyzer findings listed in the report that do not move the grade.
+
+    A field report on a C# repository read jscpd's 439 duplicate blocks,
+    listed beside a duplication grade computed from the built-in detector,
+    as the analyzer's output being ignored. The design was right and the
+    page did not say it (P8).
+    """
+    return [
+        {"tool": entry["tool"], "concept": concept,
+         "dimension": BUILT_IN_SCORED_CONCEPTS[concept], "findings": entry["findings"]}
+        for entry in (coverage.get("by_outcome") or {}).get("ran", [])
+        if entry.get("tier") == "analyzer" and entry.get("findings")
+        for concept in entry.get("concepts", [])
+        if concept in BUILT_IN_SCORED_CONCEPTS
+        and BUILT_IN_SCORED_CONCEPTS[concept] not in ANALYZER_DIMENSIONS
+    ]
+
 
 def declaration_concepts_missing(covered: set[str]) -> tuple[str, ...]:
     """Criteria the analyzers did not supply, in rubric order.

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_first_run.py

@@ -111,6 +111,7 @@ def maybe_prompt_first_run(root: Path, explicit_config: str | None) -> None:
             "Add the economic scenario (loaded labor rate per hour) beside "
             "the score? Skip leaves money out of reports. "
             "(include/skip) [skip]: ", ("include", "skip"), "skip"),
+        "pipeline_results": _ask_pipeline_results(),  # Decision 17
     }
     apply_answers(root, answers)
     print(f"Wrote {root / CONFIG_FILENAME}")
@@ -338,3 +339,27 @@ def _record_test_command(root: Path, config: dict, answer: str) -> None:
     if not answer:
         config["test_execution"] = {"requested": False}
     print(f"Wrote {target}")
+
+
+def _ask_pipeline_results() -> str:
+    """Whether the developer's own pipeline writes SARIF; the files are the
+    second stage, `maybe_prompt_pipeline_files` (Decision 17)."""
+    from ._mcp_setup import pipeline_results_question
+
+    return _ask(pipeline_results_question()["prompt"] + " (none/declare) [none]: ",
+                ("none", "declare"), "none")
+
+
+def maybe_prompt_pipeline_files(root: Path, config: dict) -> dict:
+    """The CLI half of the Decision 17 second stage: at a TTY, after `declare`.
+
+    Returns the configuration this run should use, so files declared at the
+    prompt are read by the audit that asked for them.
+    """
+    from ._mcp_setup import pipeline_files_pending, pipeline_files_questions
+    from ._setup_persist import _apply_pipeline_files
+
+    if not _stdin_is_a_tty() or not pipeline_files_pending(root):
+        return config
+    answer = input(pipeline_files_questions()[0]["prompt"] + " ").strip()
+    return _apply_pipeline_files(root, {"pipeline_files": answer})

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_mcp_setup.py

@@ -28,13 +28,14 @@ from __future__ import annotations
 from pathlib import Path
 from typing import Any
 
-from ._catalog import LICENSE_POLICIES, PRESENTATIONS
+from ._catalog import CONCERNS, LICENSE_POLICIES, PRESENTATIONS
 from ._setup_errors import SetupRequired as SetupRequired
 from ._setup_persist import (
     BOUNDS,
     _accepted,
     _apply_bounds,
     _apply_command,
+    _apply_pipeline_files,
     _economics_block,
     _is_bounds_only,
     _is_command_only,
@@ -88,6 +89,7 @@ def setup_questions(config: dict[str, Any]) -> list[dict[str, Any]]:
         },
         *_economics_questions(),
         *run_tests_question(),
+        pipeline_results_question(),
         {
             "name": "default_format",
             "prompt": "Default report presentation for this user.",
@@ -112,6 +114,48 @@ def setup_questions(config: dict[str, Any]) -> list[dict[str, Any]]:
     ]
 
 
+def pipeline_results_question() -> dict[str, Any]:
+    """Whether the developer's own pipeline writes analyzer results (Decision 17).
+
+    A choice, like every first-stage question; the files are the second
+    stage, asked only on `declare`. This tool runs a pinned handful of the
+    catalog, and the rest are run where they already run and read here.
+    """
+    return {
+        "name": "pipeline_results",
+        "prompt": (
+            "Does your own build or pipeline already write analyzer results as "
+            "SARIF (Roslyn analyzers, Semgrep, CodeQL...)? Declare names the files "
+            "next; this reads them and never runs the tools."
+        ),
+        "options": ["none", "declare"],
+        "default": "none",
+    }
+
+
+def pipeline_files_questions() -> list[dict[str, Any]]:
+    """The files, asked only of someone who said `declare`."""
+    return [{
+        "name": "pipeline_files",
+        "prompt": (
+            "Each SARIF file and the concerns it covers, from "
+            + ", ".join(CONCERNS) + " — e.g. `artifacts/roslyn.sarif: style, "
+            "documentation, dead-code`; separate files with `;`. Paths are "
+            "relative to the repository. Blank cancels."
+        ),
+        "options": [],
+        "default": "",
+    }]
+
+
+def pipeline_files_pending(root: Path) -> bool:
+    """`declare` was answered and no file is declared yet."""
+    discovered = discovered_config(Path(root))
+    stored = _read_config(Path(discovered)) if discovered is not None else None
+    analyzers = (stored or {}).get("analyzers") or {}
+    return bool(analyzers.get("pipeline_requested")) and not analyzers.get("pipeline_results")
+
+
 def economics_bound_questions() -> list[dict[str, Any]]:
     """The three rates, asked only of someone who said yes to the gate."""
     return [
@@ -179,6 +223,8 @@ def published_questions(root: Path | None = None) -> dict[str, dict[str, Any]]:
         questions[question["name"]] = question
     for question in test_command_questions(root):
         questions[question["name"]] = question
+    for question in pipeline_files_questions():
+        questions[question["name"]] = question
     return questions
 
 
@@ -248,6 +294,7 @@ def submittable_answer_names() -> frozenset[str]:
     names = {question["name"] for question in setup_questions({})}
     names.update(name for name, _, _ in BOUNDS)
     names.add("test_command")
+    names.add("pipeline_files")
     return frozenset(names)
 
 
@@ -258,6 +305,8 @@ def apply_answers(root: Path, answers: dict[str, Any]) -> dict[str, Any]:
         return _apply_bounds(root, answers)
     if _is_command_only(answers):
         return _apply_command(root, answers)
+    if set(k for k, v in answers.items() if v is not None) == {"pipeline_files"}:
+        return _apply_pipeline_files(root, answers)
     payload: dict[str, Any] = {
         "version": 1,
         "analyzers": {
@@ -272,6 +321,8 @@ def apply_answers(root: Path, answers: dict[str, Any]) -> dict[str, Any]:
         # suite; the command is a staged second ask.
         "test_execution": {"requested": _accepted(answers.get("run_tests", "no"))},
     }
+    if answers.get("pipeline_results") == "declare":
+        payload["analyzers"]["pipeline_requested"] = True
     economics = _economics_block(answers)
     if economics is not None:
         payload["economic_context"] = economics
@@ -406,7 +457,8 @@ def setup_pending(root: Path) -> bool:
         # rates for someone who wanted the scenario, or the test command for
         # someone who opted to run the suite. Both are stage two of an ask
         # already begun, not a new one.
-        return economics_bounds_pending(root) or test_command_pending(root)
+        return (economics_bounds_pending(root) or test_command_pending(root)
+                or pipeline_files_pending(root))
     # No repository file: the person's answers carry to it (first-run.md),
     # and it is asked only what is its own — its test command (Decision 4).
     return user_config_answers() is None or test_command_pending(root)
@@ -465,6 +517,8 @@ def staged_questions(root: Path | None = None) -> list[dict[str, Any]]:
         return economics_bound_questions()
     if root is not None and test_command_pending(root):
         return test_command_questions(root)
+    if root is not None and pipeline_files_pending(root):
+        return pipeline_files_questions()
     return setup_questions(load_config(None))
 
 

maintainability_agent-4.4.0/src/maintainability_audit/_pipeline_results.py

@@ -0,0 +1,112 @@
+"""Analyzer output the developer's own pipeline wrote (Decision 17).
+
+The catalog holds some 760 tools and this one runs a pinned handful. The
+rest run where they already run — a .NET build runs the Roslyn analyzers,
+and executes code from the repository it builds, which nothing here does —
+and this reads the SARIF they wrote. Each file is declared in
+`analyzers.pipeline_results` with the concerns it covers, because one file
+can mix style, documentation and dead-code rules and only its owner knows
+which they asked for.
+
+A file becomes a coverage row of its own tier, `pipeline`: it examines its
+declared concerns for the languages its results name, never the languages
+it does not, and is never counted as a tool this run attempted. Its
+findings are listed and do not score.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path, PurePosixPath
+from typing import Any
+
+from ._analysis import Analysis, ToolCoverage
+from ._catalog import PolicyError, settings_from
+from ._discovery import CATALOG_LANGUAGE
+from ._generic import parse_sarif
+from ._metrics_types import KNOWN_SOURCE_SUFFIXES
+from ._runner import Outcome
+from .config import PathNotAllowed, read_operator_file, repository_path
+from .git_tools import GitCommandFailed, run_git
+
+#: Matches no catalog language, so a row carrying it examines nothing.
+NO_LANGUAGE = ("unstated",)
+
+
+def add_pipeline_results(analysis: Analysis, root: Path, config: dict[str, Any]) -> None:
+    """Append one coverage row, and its findings, per declared file.
+
+    Never raises, like `analyze`: a block it refuses is already recorded
+    there as the analysis error, and must degrade the audit, not end it.
+    """
+    try:
+        declarations = settings_from(config)["pipeline_results"]
+    except PolicyError:
+        return
+    for declared in declarations:
+        row, findings = _read_one(root, declared)
+        analysis.coverage.append(row)
+        analysis.findings.extend(findings)
+
+
+def _read_one(root: Path, declared: dict[str, Any]) -> tuple[ToolCoverage, list]:
+    named = declared["path"]
+    covers = tuple(declared["covers"])
+    try:
+        path = repository_path(root, named, named)
+        text = read_operator_file(path)
+        extraction = parse_sarif(text, "pipeline", ", ".join(covers))
+        payload = json.loads(text)
+    except (PathNotAllowed, OSError, ValueError) as error:
+        return ToolCoverage(
+            slug=named, outcome=Outcome.FAILED.value, tier="pipeline", concepts=covers,
+            languages=NO_LANGUAGE,
+            detail=f"declared in analyzers.pipeline_results as {named}, and not read: {error}",
+        ), []
+    findings = list(extraction.findings)
+    languages = _languages(payload, declared.get("languages") or ())
+    stale = path.stat().st_mtime < _last_commit_time(root)
+    detail = f"read from {named}, which your pipeline wrote"
+    if stale:
+        detail += "; the file is older than the last commit, so it may not describe this code"
+    if languages == NO_LANGUAGE:
+        detail += ("; it names no source file and declares no languages, so it examines "
+                   "nothing — add `languages` to its declaration")
+    tools = sorted({f.tool for f in findings}) or [_driver(payload) or named]
+    return ToolCoverage(
+        slug=", ".join(tools), outcome=Outcome.RAN.value, tier="pipeline", concepts=covers,
+        findings=len(findings), languages=languages, stale=stale, detail=detail,
+    ), findings
+
+
+def _languages(payload: dict[str, Any], declared: Any) -> tuple[str, ...]:
+    """Catalog languages of the source files the results and artifacts name."""
+    names = {KNOWN_SOURCE_SUFFIXES.get(PurePosixPath(uri).suffix.lower())
+             for uri in _uris(payload)} | set(declared)
+    slugs = sorted({CATALOG_LANGUAGE[name] for name in names if name in CATALOG_LANGUAGE})
+    return tuple(slugs) or NO_LANGUAGE
+
+
+def _uris(payload: dict[str, Any]) -> list[str]:
+    """Every file a result points at, and every artifact the run lists."""
+    uris = []
+    for run in payload.get("runs", []):
+        for result in run.get("results", []):
+            for location in result.get("locations") or []:
+                physical = location.get("physicalLocation") or {}
+                uris.append((physical.get("artifactLocation") or {}).get("uri", ""))
+        for artifact in run.get("artifacts", []):
+            uris.append((artifact.get("location") or {}).get("uri", ""))
+    return uris
+
+
+def _driver(payload: dict[str, Any]) -> str:
+    runs = payload.get("runs") or [{}]
+    return ((runs[0].get("tool") or {}).get("driver") or {}).get("name", "")
+
+
+def _last_commit_time(root: Path) -> float:
+    try:
+        return float(run_git(["log", "-1", "--format=%ct"], root) or 0)
+    except (GitCommandFailed, ValueError):
+        return 0.0

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_setup_persist.py

@@ -194,7 +194,12 @@ def _persist_answers(root: Path, payload: dict[str, Any]) -> dict[str, Any]:
         Path(root), config_path,
         json.dumps(merged, indent=2, sort_keys=True) + "\n",
     )
-    write_user_answers(_keeping_consents(payload))
+    # Which SARIF files a build writes is a fact about this repository
+    # (Decision 17), so `declare` stays in its file and never carries to
+    # the person's next repository.
+    person = {**payload, "analyzers": {
+        key: value for key, value in payload["analyzers"].items() if key != "pipeline_requested"}}
+    write_user_answers(_keeping_consents(person))
     return load_config(str(config_path))
 
 
@@ -212,3 +217,24 @@ def _keeping_consents(payload: dict[str, Any]) -> dict[str, Any]:
     kept = dict(payload)
     kept["test_execution"] = {**(payload.get("test_execution") or {}), "commands": recorded}
     return kept
+
+
+def _apply_pipeline_files(root: Path, answers: dict[str, Any]) -> dict[str, Any]:
+    """Merge the declared files into the repository's config; blank cancels."""
+    from ._catalog import PolicyError, pipeline_results_from_answer
+    from ._setup_errors import SetupRequired
+
+    try:
+        declared = pipeline_results_from_answer(str(answers.get("pipeline_files") or ""))
+    except PolicyError as malformed:
+        raise SetupRequired(str(malformed)) from None
+    discovered = discovered_config(Path(root))
+    stored = dict(_read_config(Path(discovered)) or {}) if discovered else {}
+    analyzers = dict(stored.get("analyzers") or {})
+    analyzers["pipeline_requested"] = bool(declared)
+    if declared:
+        analyzers["pipeline_results"] = declared
+    stored["analyzers"] = analyzers
+    config_path = Path(root) / CONFIG_FILENAME
+    write_bounded(Path(root), config_path, json.dumps(stored, indent=2, sort_keys=True) + "\n")
+    return load_config(str(config_path))

{maintainability_agent-4.3.1 → maintainability_agent-4.4.0}/src/maintainability_audit/_skill_data/SKILL.md

@@ -39,7 +39,9 @@ engineering changes, not as permission to refactor unrelated code.
      names and no others, then call again with `setup_answers` — a
      mapping of each question's `name` to the option chosen. Answering
      one stage can open the next (`include` for the economic scenario
-     asks the three rates; `yes` to the suite asks for the command),
+     asks the three rates; `yes` to the suite asks for the command;
+     `declare` for pipeline results asks which SARIF files the
+     developer's own build writes and what each covers),
      and the next reply carries whatever is still outstanding.
      Answering does *not* start an audit.
    - **Configured** — the result carries `choice_needed`: run the
@@ -76,7 +78,13 @@ engineering changes, not as permission to refactor unrelated code.
    secure-code-agent scanner that is not installed, its install
    command, and the concepts installing it restores. It can arrive
    with `choice_needed`, before the run, so the user can install
-   first. The agent never installs tools itself.
+   first. The agent never installs tools itself. Where the coverage
+   section lists concerns as unexamined — C# style, documentation and
+   dead code, for instance — tell the user their own build or pipeline
+   can cover them: the SARIF it already writes is declared in
+   `analyzers.pipeline_results` (or by answering `declare` in setup)
+   and read, never run. This tool runs a pinned handful of analyzers;
+   the rest run where the developer already runs them.
 6. Re-run the audit and any native tests/lints required by the repo,
    then report what ran, whether the gate passed, and any remaining
    false positives or follow-ups.