[efraespada]

Refreshing a fingerprint-matched Bugbot finding could replace its durable ID with the model's new ID, leaving a second, unlinked unknown record in the final projection. This change keeps the original ID and native thread while refreshing the current evidence.

What changed

• Share unique durable-ID matching across analysis, publication and final reconciliation; fold reports of the same retained finding before comment limits, and refuse ambiguous location matches.
• Show exact IDs as inert code text on unknown rows, keep incompatible colliding reports under separate IDs, preserve human dismissals, and replay partial mutation failures without duplicate reviews or orphan records.
• Share source-grounding instructions with the model benchmark and add six reported false-positive scenarios plus two positive controls. Update the SDDs, catalog, recovery documentation, coverage budget and generated packages.

Validation

• 709 suites, 11,761 tests passed; 35 existing tests skipped.
• Coverage: 96.94% statements, 94.29% branches, 97.68% functions, 97.80% lines. Finding identity policy: 100% across all metrics; all module budgets passed.
• Typecheck, lint, Bugbot evaluation, specification/catalog, documentation, agent docs, documentation assets and workflow contracts passed.
• GitHub GFM rendering of malicious link/image/backtick/HTML IDs, build synchronization, npm package validation, and CLI/typed API/local web package smoke test passed. graphify update . completed.

Review notes

The replay demonstrates the implementation defect without asserting a historical consumer API outage cause. Reference predictions validate the scorer; they do not establish real-model accuracy improvement. Unpublished candidates remain transient attempt evidence, and their later disappearance does not prove resolution; recovery documentation states that boundary explicitly. No review gate, permission or confidence threshold is weakened.

Closes #655

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/copilot~658

Documentation is deployed and generated using docs.page

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on c02a600. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 2 potential problems when commit cb0ed01 was analyzed. This snapshot is historical; use the status block above for current state. 2 findings are linked to changed code.

Findings

• medium: Rekeying can give distinct findings the same ID — src/domain/bugbot/finding.ts:125
• low: Unknown finding IDs can inject Markdown links — src/application/policies/bugbot_review_presentation_policy.ts:239

[vypbot]

Bugbot: review complete

Current status: No active findings on c02a600.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: A protected workflow, policy, or trust-boundary file changed.
Completed: 1/1 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: c02a600a80bc; base: 9cec53813d31; reason: protected-path.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.82609% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 94.13%. Comparing base (274db40) to head (c02a600).
⚠️ Report is 1615 commits behind head on develop.

Files with missing lines	Patch %	Lines
.../commit/bugbot/analyze_bugbot_revision_use_case.ts	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #658      +/-   ##
===========================================
+ Coverage    90.94%   94.13%   +3.19%     
===========================================
  Files          135      972     +837     
  Lines         6251    31514   +25263     
  Branches      1338     9247    +7909     
===========================================
+ Hits          5685    29666   +23981     
- Misses         172      715     +543     
- Partials       394     1133     +739     

Files with missing lines	Coverage Δ
...tion/policies/bugbot_review_presentation_policy.ts	100.00% <100.00%> (ø)
.../commit/bugbot/bugbot_previous_findings_context.ts	100.00% <ø> (ø)
...s/steps/commit/bugbot/publish_findings_use_case.ts	100.00% <100.00%> (ø)
...t/bugbot/reconcile_bugbot_review_state_use_case.ts	100.00% <100.00%> (ø)
src/domain/bugbot/finding.ts	100.00% <100.00%> (ø)
src/prompts/bugbot.ts	100.00% <100.00%> (ø)
src/tooling/bugbot_benchmark_runner.ts	77.77% <100.00%> (ø)
.../commit/bugbot/analyze_bugbot_revision_use_case.ts	96.96% <66.66%> (ø)

... and 1031 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.