fix(report-back): every finding names a file so repo-level rules grade as standing

bots/finishingbot/src/analyzers/claims.rs

@@ -100,6 +100,7 @@ impl ClaimsAnalyzer {
                         Severity::Error,
                         "No README file found in repository root",
                     )
+                    .with_file(path.join("README.adoc"))
                     .with_suggestion("Create a README.md or README.adoc describing the project"),
                 );
             }
@@ -186,6 +187,7 @@ impl ClaimsAnalyzer {
                     Severity::Warning,
                     "No CHANGELOG file found for release tracking",
                 )
+                .with_file(path.join("CHANGELOG.adoc"))
                 .with_suggestion("Create a CHANGELOG.md following Keep a Changelog format"),
             );
         }
@@ -404,6 +406,7 @@ impl ClaimsAnalyzer {
                     Severity::Warning,
                     "No test files or test directories found in repository",
                 )
+                .with_file(path.join("tests"))
                 .with_suggestion("Add tests to verify code functionality"),
             );
         } else {
@@ -434,6 +437,7 @@ impl ClaimsAnalyzer {
                     Severity::Info,
                     "No continuous integration configuration found",
                 )
+                .with_file(path.join(".github/workflows"))
                 .with_suggestion("Add CI/CD configuration to automatically run tests"),
             );
         }

bots/finishingbot/src/analyzers/license.rs

@@ -113,6 +113,7 @@ impl LicenseAnalyzer {
                         Severity::Error,
                         "No LICENSE file found in repository root",
                     )
+                    .with_file(path.join("LICENSE"))
                     .with_suggestion("Add a LICENSE file with your chosen license"),
                 );
             }

bots/finishingbot/src/analyzers/mod.rs

@@ -264,3 +264,82 @@ impl AuditResult {
         all
     }
 }
+
+#[cfg(test)]
+mod scope_tests {
+    //! Every finding must carry a path. The fork-governance verdict grid grades
+    //! a finding with no path as part of the change (SPEC §3.0), so a
+    //! repository-level rule with no `file` would show on every pull request
+    //! whatever it touches. A repo-level rule names the file that would fix it.
+    use super::*;
+    use tempfile::TempDir;
+
+    /// Findings that genuinely have no file to name. Anything else lacking a
+    /// path is a regression.
+    const NO_MEANINGFUL_FILE: &[&str] = &["TEST-001"];
+
+    fn all_findings(dir: &Path) -> Vec<Finding> {
+        let cfg = Config::default();
+        let mut out = Vec::new();
+        let analyzers: Vec<Box<dyn Analyzer>> = vec![
+            Box::new(license::LicenseAnalyzer::default()),
+            Box::new(placeholder::PlaceholderAnalyzer::default()),
+            Box::new(claims::ClaimsAnalyzer::default()),
+            Box::new(release::ReleaseAnalyzer::default()),
+            Box::new(scm_files::ScmFilesAnalyzer::default()),
+            Box::new(testing::TestingAnalyzer::default()),
+            Box::new(tooling::ToolingAnalyzer::default()),
+            Box::new(v1_readiness::V1ReadinessAnalyzer::default()),
+        ];
+        for a in &analyzers {
+            out.extend(a.analyze(dir, &cfg).unwrap().findings);
+        }
+        out
+    }
+
+    fn assert_all_pathed(dir: &Path) -> usize {
+        let findings = all_findings(dir);
+        let unpathed: Vec<&str> = findings
+            .iter()
+            .filter(|f| f.file.is_none() && !NO_MEANINGFUL_FILE.contains(&f.id.as_str()))
+            .map(|f| f.id.as_str())
+            .collect();
+        assert!(unpathed.is_empty(), "findings without a path: {:?}", unpathed);
+        findings.len()
+    }
+
+    #[test]
+    fn empty_repo_findings_all_carry_a_path() {
+        let dir = TempDir::new().unwrap();
+        // Negative control: the empty repo really does produce repo-level findings.
+        assert!(assert_all_pathed(dir.path()) > 5);
+    }
+
+    #[test]
+    fn rust_repo_findings_all_carry_a_path() {
+        let dir = TempDir::new().unwrap();
+        std::fs::write(
+            dir.path().join("Cargo.toml"),
+            "[package]\nname = \"x\"\nversion = \"0.1.0\"\n",
+        )
+        .unwrap();
+        assert!(assert_all_pathed(dir.path()) > 5);
+    }
+
+    #[test]
+    fn deno_repo_findings_all_carry_a_path() {
+        let dir = TempDir::new().unwrap();
+        std::fs::write(dir.path().join("deno.json"), "{}").unwrap();
+        assert!(assert_all_pathed(dir.path()) > 5);
+    }
+
+    #[test]
+    fn missing_file_rule_names_the_expected_path() {
+        let dir = TempDir::new().unwrap();
+        let f = all_findings(dir.path())
+            .into_iter()
+            .find(|f| f.id == "LIC-001")
+            .expect("LIC-001 on an empty repo");
+        assert_eq!(f.file.as_deref(), Some(dir.path().join("LICENSE").as_path()));
+    }
+}

bots/finishingbot/src/analyzers/placeholder.rs

@@ -94,6 +94,7 @@ impl Analyzer for PlaceholderAnalyzer {
                         config.placeholders.max_allowed
                     ),
                 )
+                .with_file(Path::new(".finishing-bot/config.yml").to_path_buf())
                 .with_suggestion(&format!("Remove at least {} placeholders before release", excess)),
             );
         }

bots/finishingbot/src/analyzers/release.rs

@@ -123,6 +123,7 @@ impl ReleaseAnalyzer {
                         Severity::Error,
                         &format!("Version numbers are inconsistent:\n  {}", version_list.join("\n  ")),
                     )
+                    .with_file(path.join(&inconsistent[0].0))
                     .with_suggestion("Ensure all version files have the same version number"),
                 );
             }
@@ -186,6 +187,7 @@ impl ReleaseAnalyzer {
                         Severity::Warning,
                         &format!("Debug file found: {}", pattern),
                     )
+                    .with_file(path.join(pattern))
                     .with_suggestion("Remove debug files before release"),
                 );
             }
@@ -261,6 +263,7 @@ impl ReleaseAnalyzer {
                     Severity::Warning,
                     "No SECURITY.md file found",
                 )
+                .with_file(path.join("SECURITY.md"))
                 .with_suggestion("Add a SECURITY.md describing how to report vulnerabilities"),
             );
         }
@@ -312,6 +315,7 @@ impl ReleaseAnalyzer {
                         Severity::Warning,
                         &format!("No hash files found in {}", dir),
                     )
+                    .with_file(release_path.clone())
                     .with_suggestion("Generate SHA256/SHA512 hashes for release artifacts"),
                 );
             }
@@ -489,6 +493,7 @@ impl ReleaseAnalyzer {
                     Severity::Info,
                     "No GitHub release workflow found",
                 )
+                .with_file(release_workflow.clone())
                 .with_suggestion("Consider adding .github/workflows/release.yml for automated releases"),
             );
         }

bots/finishingbot/src/analyzers/scm_files.rs

@@ -76,6 +76,7 @@ impl Analyzer for ScmFilesAnalyzer {
                         Severity::Error,
                         &format!("Required SCM file {} not found ({}).", filename, description),
                     )
+                    .with_file(correct_path.clone())
                     .with_suggestion(&format!(
                         "Create .machine_readable/{} with proper metadata and content. See hyperpolymath SCM file specs.",
                         filename

bots/finishingbot/src/analyzers/testing.rs

@@ -117,7 +117,7 @@ impl TestingAnalyzer {
             result.add(Finding::new(
                 "TEST-AG-001", "Missing Agda source", Severity::Error,
                 "The proof layout contains no nonempty .agda source files.",
-            ).with_suggestion("Provide actual proof sources; an empty directory is not verification infrastructure"));
+            ).with_file(path.join("verification/proofs")).with_suggestion("Provide actual proof sources; an empty directory is not verification infrastructure"));
         }
         let has_entrypoint = [
             ".github/workflows/agda.yml",
@@ -142,7 +142,7 @@ impl TestingAnalyzer {
             result.add(Finding::new(
                 "TEST-AG-002", "Agda runner not statically identified", Severity::Warning,
                 "No direct single-line Agda source check was identified in the known workflow or recipe locations. Dynamic runners need separate review; no proof was executed.",
-            ).with_suggestion("Provide or document the real Agda check entrypoint instead of adding Rust or Deno scaffolding"));
+            ).with_file(path.join(".github/workflows/agda.yml")).with_suggestion("Provide or document the real Agda check entrypoint instead of adding Rust or Deno scaffolding"));
         }
     }
 
@@ -158,6 +158,7 @@ impl TestingAnalyzer {
                     Severity::Error,
                     "Rust project missing benches/ directory for criterion benchmarks.",
                 )
+                .with_file(benches_dir.clone())
                 .with_suggestion("Create benches/ directory with criterion benchmark files"),
             );
         } else {
@@ -177,6 +178,7 @@ impl TestingAnalyzer {
                             Severity::Warning,
                             "benches/ directory exists but contains no .rs files.",
                         )
+                        .with_file(benches_dir.clone())
                         .with_suggestion("Add benchmark files to benches/ directory"),
                     );
                 }
@@ -195,6 +197,7 @@ impl TestingAnalyzer {
                     Severity::Error,
                     "Rust project missing fuzz/ or .clusterfuzzlite/ for fuzzing.",
                 )
+                .with_file(fuzz_dir.clone())
                 .with_suggestion("Add ClusterFuzzLite configuration for automated fuzzing"),
             );
         } else {
@@ -229,6 +232,7 @@ impl TestingAnalyzer {
                     Severity::Error,
                     "No .github/workflows/stress-test.yml found.",
                 )
+                .with_file(stress_workflow.clone())
                 .with_suggestion("Add stress test workflow to test under high load"),
             );
         } else {
@@ -266,6 +270,7 @@ impl TestingAnalyzer {
                     Severity::Error,
                     "Deno project missing bench/ directory or bench.ts file.",
                 )
+                .with_file(bench_dir.clone())
                 .with_suggestion("Create bench/ directory with Deno.bench() benchmarks"),
             );
         } else {
@@ -282,6 +287,7 @@ impl TestingAnalyzer {
                     Severity::Error,
                     "No .github/workflows/stress-test.yml found.",
                 )
+                .with_file(stress_workflow.clone())
                 .with_suggestion("Add stress test workflow for load testing"),
             );
         } else {
@@ -310,6 +316,7 @@ impl TestingAnalyzer {
                     Severity::Warning,
                     "No tests/ directory or *_test.ts files found.",
                 )
+                .with_file(tests_dir.clone())
                 .with_suggestion("Add test files following Deno conventions (*_test.ts)"),
             );
         }

bots/finishingbot/src/analyzers/tooling.rs

@@ -36,6 +36,7 @@ impl Analyzer for ToolingAnalyzer {
                     Severity::Error,
                     ".tool-versions file not found for asdf/mise version management.",
                 )
+                .with_file(tool_versions.clone())
                 .with_suggestion("Create .tool-versions file with required tool versions (rust, just, etc.)"),
             );
         } else {
@@ -57,6 +58,7 @@ impl Analyzer for ToolingAnalyzer {
                     Severity::Warning,
                     ".editorconfig not found for consistent code formatting.",
                 )
+                .with_file(editorconfig.clone())
                 .with_suggestion("Add .editorconfig for consistent editor settings"),
             );
         } else {
@@ -73,6 +75,7 @@ impl Analyzer for ToolingAnalyzer {
                     Severity::Error,
                     ".github/workflows/ directory not found.",
                 )
+                .with_file(workflows_dir.clone())
                 .with_suggestion("Add CI/CD workflows for automated testing and quality checks"),
             );
         } else {

bots/finishingbot/src/analyzers/v1_readiness.rs

@@ -69,6 +69,7 @@ impl V1ReadinessAnalyzer {
                         Severity::Error,
                         &format!("Required file {} not found ({}).", filename, description),
                     )
+                    .with_file(file_path.clone())
                     .with_suggestion(&format!("Create {} file", filename)),
                 );
             } else {
@@ -88,6 +89,7 @@ impl V1ReadinessAnalyzer {
                     Severity::Warning,
                     "SECURITY.md not found for responsible disclosure.",
                 )
+                .with_file(security_file.clone())
                 .with_suggestion("Add SECURITY.md with security policy and contact information"),
             );
         } else {
@@ -173,6 +175,7 @@ impl V1ReadinessAnalyzer {
                         Severity::Warning,
                         &format!("{} file not found ({}).", filename, description),
                     )
+                    .with_file(file_path.clone())
                     .with_suggestion(&format!("Add {} for community health", filename)),
                 );
             } else {

bots/finishingbot/src/main.rs

@@ -262,7 +262,10 @@ fn handle_fleet_mode(
 fn init_logging(level: &str) {
     let filter = EnvFilter::try_new(level).unwrap_or_else(|_| EnvFilter::new("info"));
 
+    // Logs go to stderr: stdout carries the JSON report that the fleet driver
+    // parses, and a log line there makes the report unreadable.
     let layer = fmt::layer()
+        .with_writer(std::io::stderr)
         .with_target(true)
         .with_span_events(FmtSpan::CLOSE)
         .with_ansi(true);

bots/glambot/README.adoc

@@ -115,7 +115,7 @@ Shells out to the `git-seo` CLI tool for comprehensive forge-based SEO scoring (
 |===
 | Finding ID | Description | Severity
 
-| GS-001 | git-seo not installed | Info
+| GS-001 | _Retired as a finding_: git-seo not being installed is a property of the machine running glambot, not of the repository, so it is logged (`warn`) and the analyzer reports nothing | n/a
 | GS-002 | git-seo analysis failed | Warning
 | GS-003 | No git remote found | Info
 | GS-100 | Overall SEO score | Varies