Internal analyzer contract: replace hardcoded runner registry with typed analyzers

[serge-ivo]

Summary

Formalize the current CLI runner shape into an internal Analyzer contract and registry. This is Phase 1 from app/docs/analyzer-platform-vision.md: keep current VibeReport output compatible, but stop adding framework checks as ad hoc entries in core.ts.

Implementation spec: cli/docs/internal-analyzer-contract.md.

Why

cli/src/core.ts currently owns a long hardcoded runner array. That makes every new stack/framework touch the same file and encourages mixed generic/framework behavior. The analyzer platform roadmap calls for one app + CLI engine + internal analyzers before any public plugin SDK.

Terminology

This issue creates internal analyzers, not public plugins.

• Analyzer: built-in/internal capability scheduled by the CLI engine.
• Framework analyzer: analyzer whose result depends on framework semantics.
• Out-of-process analyzer: analyzer launched by the CLI over JSON/stdio; tracked separately in Internal out-of-process analyzer protocol over stdio JSON #32.
• Plugin SDK: future third-party surface; explicitly out of scope here.

Proposed contract sketch

See cli/docs/internal-analyzer-contract.md for the fuller contract. The Phase 1 shape is intentionally compatible with existing CheckResult / VibeReport output.

interface AnalyzerManifest {
  id: string;
  name: string;
  kind: "generic" | "framework" | "ecosystem" | "integration" | "pro";
  resultSchemaVersion: number;
  appliesTo?: AppliesTo;
  settingsSchema?: AnalyzerSettingsSchema;
  metricDefinitions?: AnalyzerMetricDefinition[];
}

interface Analyzer {
  manifest: AnalyzerManifest;
  detect?(ctx: AnalyzerContext): AnalyzerDetection | Promise<AnalyzerDetection>;
  run(ctx: AnalyzerContext): CheckResult | Promise<CheckResult>;
}

interface AnalyzerContext {
  cwd: string;
  workspace: WorkspaceInfo;
  stack: StackInfo;
  config: VcqaConfig;
  settings: Record<string, unknown>;
  effectiveSettings: Record<string, unknown>;
  skipTests: boolean;
  srcRoots?: string[];
  ignoreNames: string[];
}

Phase 1 can wrap existing runners with analyzer objects. It does not need to solve out-of-process execution; that is #32.

Tasks

• Add internal analyzer types under cli/src/analyzers/ or equivalent.
• Create an analyzer registry module that exports ordered analyzers.
• Convert the core.ts hardcoded runner list to consume the registry.
• Preserve existing check order, --checks filtering, appliesTo gating, tool provenance, ignore filtering, and score behavior.
• Keep CheckResult/VibeReport output unchanged for consumers.
• Add tests proving the registry covers existing check metadata and respects --checks filtering.
• Document that the contract is internal/experimental until several built-in analyzers prove it.

Acceptance criteria

• core.ts no longer contains the full hardcoded runner registry.
• Adding a built-in analyzer requires registering one analyzer object, not editing scan orchestration logic.
• Existing CLI tests and fixture scans pass with unchanged report shape.
• No public plugin SDK is exposed from this issue.

Related

• Umbrella: Tracking: analyzer-platform groundwork (schema, stack-gating, fixtures, engine decision) #24
• Spec: cli/docs/internal-analyzer-contract.md
• Settings: Analyzer settings schema: pass per-analyzer config through scans and record effective settings #30
• Metrics: Analyzer metrics contract: normalize trendable metrics and summary snapshots #31
• Out-of-process protocol: Internal out-of-process analyzer protocol over stdio JSON #32
• Vision doc: app/docs/analyzer-platform-vision.md

[serge-ivo]

Implementation spec drafted: cli/docs/internal-analyzer-contract.md.

The doc tightens this ticket into concrete rules for analyzer manifests, registry ownership, scan lifecycle, settings, normalized metrics/snapshots, findings mapping, tool provenance, framework analyzer boundaries, and migration steps. It keeps the first migration backward-compatible with existing CheckResult/VibeReport consumers.

[serge-ivo]

Blocked on a decision: #90 — settle the `AnalyzerContext` member list before this is implemented.

The `AnalyzerContext` sketch in this issue's body (and the fuller one in `docs/internal-analyzer-contract.md:82-94`) predates two things that shipped in 0.55.0 and are not reflected in either copy:

• `FileInventory` — `9764ca3` (Introduce FileInventory: classify scan files once and require runners to consume it #70)
• `EffectiveScanPolicy` — `85278f7` (Define effective scan policy: ignore precedence, generated classification, and security overrides #71)

Neither type is named anywhere in `docs/internal-analyzer-contract.md`; its only ignore-related member is `ignoreNames: string[]`, the pre-#71 flat list. #70's own closing comment records the gap: the `ctx.files` surface was scoped out "because there is no `AnalyzerContext` object to hang it off yet".

Per `app/CLAUDE.md:100` — "If these docs disagree, fix the docs before implementing the feature" — the doc amendment is a precondition for this issue, not a follow-up. #90 lays out the options and a recommendation; the sketch in this body needs the same amendment as the doc so an implementer reading either lands in the same place.