Project-scoped analyzer execution and aggregation

[serge-ivo]

Problem

Even when VCQA detects a monorepo, many analyzers still behave like root-scoped runners. Lint, types, tests, deps, and framework checks need to run in the package cwd where config actually lives, then aggregate results into the repo report.

Goal

Add a scan orchestration layer that can run project-scoped analyzers once per ProjectContext and aggregate compatible CheckResult output.

Tasks

• Add analyzer scope metadata: repo, project, file-graph, derived.
• Run project-scoped analyzers once per project context.
• Tag findings with project id/path while preserving repo-root-relative file paths.
• Aggregate scores, issues, metrics, and details predictably.
• Avoid rerunning derived checks when source analyzer already ran.
• Add fixtures for lint/types/tests across multiple packages.

Acceptance Criteria

• Lint/types/tests produce tool runs from package cwd when package config lives there.
• The root report has one logical check row per analyzer with package breakdown in details/metrics.
• App pages can drill into package-specific findings without parsing file paths.

Related

• Monorepo scanning: descend into packages so lint/types/tests/etc. actually run (not 'skipped' everywhere) #27
• Analyzer metrics contract: normalize trendable metrics and summary snapshots #31
• ProjectContext contract for deterministic repo discovery #56
• Convention-only monorepo discovery fixtures and detector #57
• docs/repo-discovery.md
• docs/internal-analyzer-contract.md

[serge-ivo]

Downstream validation from PAGS with the local updated scanner exposed a concrete project-scoped typecheck bug. Command: node /Users/serge-ivo/dev/vcqa/cli/dist/cli.js --skip-tests . from ProAgentStore/platform after building local VCQA. VCQA reported types F 0/100 with 502 JSX errors from the root npx tsc --noEmit run, but every project-scoped tsc run in the report was clean and the repo's real pnpm typecheck passed across all 11 workspace projects. Root cause appears to be that the updated types runner still runs a root fallback in a monorepo and counts its TSX/--jsx diagnostics even when package/project contexts provide the authoritative typecheck commands. This should be part of #58 acceptance: do not let a root fallback poison aggregate types when project-scoped typechecks pass.

[serge-ivo]

#27 is closed and this issue now owns its remainder. Verified on main (d1c5314) against a convention-only monorepo with no root manifest: discovery, per-package tool dispatch from the package cwd, and projectId/projectPath tagging on toolRuns all work; what is not done is the aggregation half — one logical check row per analyzer with a package breakdown in details/metrics — which is exactly this issue's task list and acceptance criteria.

One thing worth knowing before you measure aggregation: in that run every per-package tool reported zero findings because the tools were not actually available (npx tsc resolved an unrelated npm package and the run was still recorded status: success, ok: true). Tracked as #92. Aggregate scores will look healthier than reality until that lands, so do not use a clean per-package rollup as evidence that the rollup is right.