merge: incorporate upstream parallelization, Zig parser, and report overhaul

[joshbouncesecurity]

Summary

Merges upstream commits #22 (CI gitleaks fix) and #23 (parallelization, HTML report overhaul, Zig parser, dynamic test hardening) into the fork. Resolves 21 merge conflicts across Go CLI, Python core, and utilities.

Fork features rendered redundant by upstream

These fork features were removed or replaced because upstream PR #23 implemented equivalent functionality:

Fork feature	Upstream equivalent	Action taken
--concurrency/-j flag (default 4)	--workers (default 8) + --backoff (default 30s)	Removed fork flags, accepted upstream's
--fresh flag on enhance/analyze/verify	Checkpoint directory system (StepCheckpoint)	Removed — upstream manages resume via checkpoint dirs
--skip-errors flag	StepCheckpoint.load_ids(skip_errors=True)	Removed — upstream always retries errors on resume
utilities/parallel_executor.py (run_parallel)	Inline ThreadPoolExecutor in each file	Deleted — dead code, zero imports in production
Fork's single-file checkpoint (core/utils.py checkpoint helpers)	core/checkpoint.py with StepCheckpoint class	Accepted upstream's directory-based checkpoints
_save_analyze_checkpoint / _save_verify_checkpoint	StepCheckpoint.save() per-unit files	Removed fork functions

Fork features preserved (not in upstream)

Feature	Files
Agent SDK backend (claude-agent-sdk)	utilities/llm_client.py — kept fork's SDK architecture, added upstream's thread-safety and rate limiter import
generate-context CLI command	openant/cli.py, apps/openant-cli/cmd/generatecontext.go
Override merge mode for generate-context	openant/cli.py, context/application_context.py
Centralized model IDs	utilities/model_config.py
UTF-8 file I/O helpers	utilities/file_io.py — still used across ~37 production files
Atomic JSON writes	core/utils.py (atomic_write_json) — still used in analyzer, enhancer, verifier
--fresh flag for parse only	openant/cli.py, apps/openant-cli/cmd/parse.go

Fork features modified to match upstream

File	What changed
utilities/llm_client.py	Kept Agent SDK architecture but added threading.Lock to TokenTracker and from .rate_limiter import get_rate_limiter from upstream
utilities/agentic_enhancer/__init__.py	Removed apply_enhance_patch export (function deleted in upstream's agent.py)
utilities/finding_verifier.py	Replaced entirely with upstream version (uses anthropic client directly with tool-use loop instead of fork's Agent SDK path)
utilities/context_enhancer.py	Replaced entirely with upstream version (uses ThreadPoolExecutor + StepCheckpoint instead of fork's run_parallel)
utilities/agentic_enhancer/agent.py	Replaced entirely with upstream version (uses anthropic directly, rate limiter, in-place mutation)
core/analyzer.py	Accepted upstream's _run_detection parallelization; kept fork's model_config and file_io imports
core/schemas.py	Removed insufficient_context from AnalysisMetrics, removed resumed_steps from ScanResult, accepted upstream's ReportResult.to_dict()
core/enhancer.py, core/verifier.py, core/scanner.py, core/progress.py	Accepted upstream's --workers/--backoff/StepCheckpoint API
All Go CLI cmd files	Accepted upstream versions (new --workers/--backoff flags, report overhaul, checkpoint support)

Tests updated

Test file	Change
test_resume_stage1.py	Rewrote enhance checkpoint tests for StepCheckpoint API, workers=1 instead of concurrency=1, removed --fresh tests
test_resume_stage2.py	Rewrote for StepCheckpoint directory-based checkpoints, added TestStepCheckpointUnit tests
test_resume_stage3.py	Removed TestScanResumeIntegration (depended on resumed_steps and --fresh), kept unit tests for resume helpers
test_skip_errors.py → test_checkpoint_retry.py	Renamed and rewrote for StepCheckpoint.load_ids error filtering and _run_detection retry behavior
test_local_claude.py	Rewrote TestVerifyWithNativeClaude to mock anthropic.Anthropic client directly instead of Agent SDK's _run_query_sync
test_parser_adapter.py	Fixed test_empty_dir_raises — upstream's detect_language no longer raises on empty dirs
test_parallel_executor.py	Deleted with the module

Test plan

• pytest tests/ — 193 passed, 0 failed
• ruff check . --select F821,F811 — all checks passed
• Verify Go CLI builds (go build ./...)
• Spot-check openant generate-context --help still works

🤖 Generated with Claude Code