framework: split defect-scan into mechanical + semantic phases; promote split pipeline to default

[TheAmericanMaker]

Summary

Splits the single-phase defect scan into two phases that run at different points in the workflow, and promotes the new split pipeline (pipeline-full-with-deep-audit) to the default.

Why split? Passes 3 (concurrency), 4 (security), and 5 (API contract violations) produce significantly better signal once contracts and protocols are documented — that is what defines "violation" for those passes. Running them blind, before contracts/protocols, yields more false positives and misses semantic bugs. Running everything after protocols, on the other hand, costs the cheap-bugs feedback loop that contracts and porting benefit from.

The split:

• defect-scan-mechanical (after architecture, before contracts) — passes 1, 2, 6: logic and correctness, error handling, configuration hazards. Context-light; the bugs visible from local code reading.
• defect-scan-semantic (after protocols, before porting) — passes 3, 4, 5. Reads the mechanical report so it does not re-flag, honors carry_forward entries routed to it, and pass 5 cites the contract or protocol entry it claims is violated.
• The porting bundle's new "Defect Synthesis" section consolidates both reports into a single porting-oriented view, with branching instructions for single-scan / split-scan / no-scan pipelines.

Why default? The product positioning is curated, citation-rich findings (security review, port planning) — not casual exploration. Depth-first audit is the right baseline for that audience. The legacy pipeline-full-with-audit is preserved as a documented alternative for cheaper runs; no phase IDs were renamed and no pipeline file was removed, so projects already initialised against the old default see no change.

Commits

• 392b212 framework: split defect-scan into mechanical (early) + semantic (late) phases
• d432093 framework: promote pipeline-full-with-deep-audit to default

What changed

New

• .codecarto/findings/defect-scan-mechanical/{SKILL.md,README.md} — thin wrappers reusing findings/defect-scan/passes/*.md for the mechanical subset.
• .codecarto/findings/defect-scan-semantic/{SKILL.md,README.md} — same for the semantic subset; declares contracts/protocols/mechanical-report as required reads.
• .codecarto/templates/mechanical-defects.md — passes 1/2/6 + a "Routed To Semantic Phase" handoff table.
• .codecarto/templates/semantic-defects.md — passes 3/4/5 + a "Carry-Forward Closure" table; pass 5 row includes a Spec Reference column.
• .codecarto/workflow/pipeline-full-with-deep-audit.yaml — 7-phase pipeline. Mechanical depends on architecture; semantic depends on architecture + contracts + protocols + mechanical; porting and reimplementation-spec read both reports.

Modified

• .codecarto/templates/reverse-engineering-bundle.md — adds a "Defect Synthesis" section + bumps the porting validation table to grade it without breaking existing pipelines.
• .codecarto/workflow/status.yaml — pipeline pointer now pipeline-full-with-deep-audit.yaml; phases block updated to the 7-phase order; pipeline-switching comment lists all six current variants.
• .codecarto/README.md, .codecarto/GUIDE.md, top-level README.md — pipeline-choice tables, walkthroughs, init alias list, folder layout, and the model-tier row all promote deep-audit-as-default and document the legacy single-scan as an opt-in.
• extensions/codecarto/index.ts — adds full-with-deep-audit to PIPELINE_ALIASES; hardcoded /codecarto-init fallback updated to the new default. Legacy full-with-audit alias preserved.

Untouched (intentional)

• .codecarto/findings/defect-scan/ (SKILL, README, all six passes/*.md)
• .codecarto/templates/defect-report.md
• All other pipeline files (pipeline-full-with-audit.yaml, pipeline.yaml, pipeline-defect-scan.yaml, pipeline-lite.yaml, pipeline-architecture-only.yaml)

Test plan

Verified during development via two sandbox scripts that exercise Pi's actual parseSimpleYaml/stringifySimpleYaml against the new files:

• New pipeline parses cleanly through Pi's YAML parser
• phase_order matches phases[].id exactly
• Every depends_on references a real phase; the dependency DAG walks cleanly through phase_order
• Every required_read either is GUIDE.md/workflow/status.yaml or is produced by an upstream phase
• mechanical-defects.md and semantic-defects.md are both listed in porting's required_reads
• pipeline_full-with-deep-audit round-trips through stringifySimpleYaml without losing phase_order
• .codecarto/workflow/status.yaml's phases keys exactly match the default pipeline's phase_order
• Every skill_path and output_template referenced by the default pipeline exists on disk
• Pi's hardcoded fallback in /codecarto-init matches the packaged status.yaml's pipeline pointer
• PIPELINE_ALIASES retains both the new full-with-deep-audit and legacy full-with-audit entries
• status.yaml round-trips through Pi's parser without dropping any phase's carry_forward

Reviewer test (manual):

• In a fresh repo, /codecarto-init (no args) and confirm the resulting .codecarto/workflow/status.yaml shows pipeline: workflow/pipeline-full-with-deep-audit.yaml and the 7-phase block.
• In the same repo, /codecarto-init full-with-audit and confirm the legacy 6-phase pipeline is selected with the defect-scan phase block.
• Run /codecarto-next from the fresh-default state and confirm the queued prompt is for architecture (no phase ordering regressions).

---

Generated by Claude Code