Review tool-runner — config-driven linters / SAST as grounded review inputs

[JSONbored]

Phase 3 — Analysis depth, analytics & developer experience

Context

The review-enrichment service (review-enrichment/) already runs 18 external/heavy analyzers and returns a grounded brief spliced into the reviewer prompt (src/review/enrichment-wire.ts). It's the natural home for language linters and SAST.

Goal

Extend the enrichment service into a config-driven linter/SAST runner whose findings ground the AI review (and, optionally, the gate).

Requirements

• A per-repo review.tools block enabling analyzers auto-selected by language/paths (e.g. structural SAST, JS/TS + Python linters, GitHub Actions linters, dependency/vulnerability scanning, secret scanning, Docker/shell linters). Each tool: an enable toggle + optional config_file, mirroring our manifest style.
• Run in the enrichment service (self-host), diff-scoped; return normalized findings that (a) feed grounding so the AI cites real static-analysis output and (b) optionally raise deterministic advisory/blocking findings.
• Bounded output; fail-safe (analyzer error ⇒ omit). Default-OFF.

Deliverables

• Enrichment analyzer plug-in framework + an initial tool set + a normalized finding schema + grounding wiring + gate wiring + tests + docs.

Expected outcome

• Substantially higher review precision/depth grounded in deterministic tool output — the single biggest depth upgrade. Self-host-first.

Effort

XL — land incrementally (framework first, then tools).

[linear-code]

JSO-2045

[JSONbored]

2026-07-01 issue audit: Consolidating into the established REES epic #1499 (+ #1477) to avoid two lint/SAST tracks; the config-driven review.tools framing is captured on #1499.