feat: agent co-author detection + derived decision scope (#803)

* feat(git): detect agent co-author trailers and vendor-domain identities

* feat(decisions): derive a scope level for each decision record

* fix(git): exact-match vendor email allowlist for agent detection

A vendor domain plus a substring alias scan over the local part classified
any address containing an agent token (jean-claude@, claudette@) as a tier-1
agent, and let one vendor's agent name match at another vendor's domain.
Replace with a per-domain anchored allowlist of exact agent identities; the
co-author e-mail fallback inherits the same exact matching.

* fix(decisions): module links outrank evidence file; drop unreachable function scope

- explicit module linkage now takes precedence over the evidence-file
  fallback, which applies only when nothing else is linked
- records with no linkage at all derive null instead of cross-module
- multi-file records without module links infer modules from the files'
  top-level directories
- remove the function level: nothing can produce it yet (no symbol linkage)
- hide the UI scope filter when no row carries a scope, and expose scope on
  the api-client response type

Author: swati510

packages/api-client/src/types/decisions.ts

@@ -25,6 +25,11 @@ export interface DecisionRecordResponse {
   last_code_change: string | null;
   /** Trust tier of the decision's primary supporting evidence. */
   verification?: DecisionVerification;
+  /**
+   * Derived granularity of the decision's blast area. Absent on older
+   * backends; null when the record has no code linkage at all.
+   */
+  scope?: "file" | "module" | "cross-module" | null;
   created_at: string;
   updated_at: string;
   /** Evidence rows backing the record. Populated by the list endpoint only. */

packages/core/src/repowise/core/analysis/decisions/scope.py

@@ -0,0 +1,51 @@
+"""Derived decision granularity — how much of the codebase a decision spans.
+
+Pure derivation from a record's existing linkage fields (no LLM, no I/O), so
+it can run at serialization time for any record, old or new. Levels, narrowest
+first: ``file`` < ``module`` < ``cross-module``. ``None`` means the record has
+no code linkage at all — better no claim than defaulting the least-grounded
+records to the widest level.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+__all__ = ["derive_decision_scope"]
+
+
+def derive_decision_scope(
+    affected_files: Sequence[str] | None,
+    affected_modules: Sequence[str] | None,
+    *,
+    evidence_file: str | None = None,
+) -> str | None:
+    """Return the scope level for one decision record, or ``None``.
+
+    Rules, in order:
+
+    - nothing linked at all: ``file`` when an *evidence_file* pins the record
+      to one file, else ``None`` — explicit file/module linkage always
+      outranks the evidence-file fallback
+    - exactly one affected file → ``file``
+    - otherwise count distinct modules — the explicitly linked ones, or when
+      none are linked, the top-level directories of the affected files: one →
+      ``module``, several → ``cross-module``; multiple root-level files with
+      no directory stay ``file``.
+
+    An evidence line narrows nothing on its own — a line without a resolved
+    symbol still only proves file-level scope — so it is deliberately not a
+    parameter.
+    """
+    files = {f for f in (affected_files or []) if f}
+    modules = {m for m in (affected_modules or []) if m}
+
+    if not files and not modules:
+        return "file" if evidence_file else None
+    if len(files) == 1:
+        return "file"
+    if not modules:
+        modules = {f.split("/", 1)[0] for f in files if "/" in f}
+        if not modules:
+            return "file"
+    return "module" if len(modules) == 1 else "cross-module"

packages/core/src/repowise/core/ingestion/git_indexer/agent_provenance.py

@@ -118,6 +118,23 @@
 _SERVICE_EMAILS: dict[str, tuple[str, int]] = {
     "cursoragent@cursor.com": ("cursor", 1),
     "devin-ai-integration[bot]@users.noreply.github.com": ("devin", 1),
+    # Primarily Claude's co-author identity; as AUTHOR it is tier 1 like every
+    # other service e-mail here.
+    "noreply@anthropic.com": ("claude", 1),
+}
+
+# Agent-vendor e-mail domains → the exact agent identities each vendor emits.
+# A domain alone is never enough — real humans work at these companies — so an
+# identity here counts only when the LOCAL PART fully matches the vendor's
+# allowlisted agent identity (anchored fullmatch, never a substring scan, and
+# per vendor, never a flat token set): ``claude@anthropic.com`` and the
+# ``claude-<model>`` slugs match; ``jane@anthropic.com``,
+# ``jean-claude@anthropic.com`` and ``codex@anthropic.com`` never do.
+_VENDOR_DOMAIN_LOCALS: dict[str, tuple[re.Pattern[str], str]] = {
+    "anthropic.com": (re.compile(r"claude(?:-(?:opus|sonnet|haiku)(?:-[\w.]+)?)?"), "claude"),
+    "openai.com": (re.compile(r"codex"), "codex"),
+    "cursor.com": (re.compile(r"cursor(?:agent)?"), "cursor"),
+    "devin.ai": (re.compile(r"devin"), "devin"),
 }
 
 # Commit-message footers → agent (exact service phrases only).
@@ -158,6 +175,13 @@
 
 _AIDER_NAME_RE = re.compile(r"\(aider\)\s*$")
 
+# Any ``Co-authored-by:`` trailer's e-mail, for registry-based identity
+# matching: agent service identities the explicit patterns above don't name
+# (bot noreply logins, exact service e-mails, vendor-domain identities) are
+# resolved through the same :meth:`AgentProvenanceClassifier._identity_match`
+# registry — one list, no parallel patterns.
+_COAUTHOR_EMAIL_RE = re.compile(r"^co-authored-by:[^<\n]*<([^>\s]+)>", re.IGNORECASE | re.MULTILINE)
+
 
 def _normalize_agent_token(value: str, *, allow_slug: bool) -> str | None:
     """Resolve a free-text tool/agent name to a canonical label.
@@ -274,6 +298,10 @@ def _identity_match(self, email: str) -> tuple[str, int] | None:
         m = self._bot_email_re.match(e)
         if m:
             return (_BOT_LOGINS[m.group(1).lower()], 1)
+        local, _, domain = e.partition("@")
+        vendor = _VENDOR_DOMAIN_LOCALS.get(domain)
+        if vendor and vendor[0].fullmatch(local):
+            return (vendor[1], 1)
         return None
 
     def classify(
@@ -328,6 +356,10 @@ def classify(
         for pat, agent in self._coauthors:
             if pat.search(message):
                 return AgentProvenance(agent, 3, "coauthor_trailer", "high")
+        for m in _COAUTHOR_EMAIL_RE.finditer(message):
+            hit = self._identity_match(m.group(1))
+            if hit:
+                return AgentProvenance(hit[0], 3, "coauthor_trailer", "high")
         return _HUMAN
 
 

packages/server/src/repowise/server/schemas/decisions.py

@@ -7,6 +7,8 @@
 
 from pydantic import BaseModel
 
+from repowise.core.analysis.decisions.scope import derive_decision_scope
+
 
 class EvidencePreview(BaseModel):
     """The top-ranked evidence row, slimmed for list rows."""
@@ -38,6 +40,10 @@ class DecisionRecordResponse(BaseModel):
     confidence: float
     staleness_score: float
     verification: str = "unverified"
+    # Derived granularity: file | module | cross-module, or None when the
+    # record has no code linkage at all. Computed at serialization time from
+    # the linkage fields, so old records get it too.
+    scope: str | None = None
     superseded_by: str | None
     last_code_change: datetime | None
     created_at: datetime
@@ -51,6 +57,8 @@ class DecisionRecordResponse(BaseModel):
 
     @classmethod
     def from_orm(cls, obj: object) -> DecisionRecordResponse:
+        affected_files = json.loads(obj.affected_files_json)  # type: ignore[attr-defined]
+        affected_modules = json.loads(obj.affected_modules_json)  # type: ignore[attr-defined]
         return cls(
             id=obj.id,  # type: ignore[attr-defined]
             repository_id=obj.repository_id,  # type: ignore[attr-defined]
@@ -67,8 +75,8 @@ def from_orm(cls, obj: object) -> DecisionRecordResponse:
             rationale=obj.rationale,  # type: ignore[attr-defined]
             alternatives=json.loads(obj.alternatives_json),  # type: ignore[attr-defined]
             consequences=json.loads(obj.consequences_json),  # type: ignore[attr-defined]
-            affected_files=json.loads(obj.affected_files_json),  # type: ignore[attr-defined]
-            affected_modules=json.loads(obj.affected_modules_json),  # type: ignore[attr-defined]
+            affected_files=affected_files,
+            affected_modules=affected_modules,
             tags=json.loads(obj.tags_json),  # type: ignore[attr-defined]
             source=obj.source,  # type: ignore[attr-defined]
             evidence_commits=json.loads(obj.evidence_commits_json),  # type: ignore[attr-defined]
@@ -77,6 +85,11 @@ def from_orm(cls, obj: object) -> DecisionRecordResponse:
             confidence=obj.confidence,  # type: ignore[attr-defined]
             staleness_score=obj.staleness_score,  # type: ignore[attr-defined]
             verification=obj.verification,  # type: ignore[attr-defined]
+            scope=derive_decision_scope(
+                affected_files,
+                affected_modules,
+                evidence_file=obj.evidence_file,  # type: ignore[attr-defined]
+            ),
             superseded_by=obj.superseded_by,  # type: ignore[attr-defined]
             last_code_change=obj.last_code_change,  # type: ignore[attr-defined]
             created_at=obj.created_at,  # type: ignore[attr-defined]

packages/types/src/decisions.ts

@@ -19,6 +19,9 @@ export type DecisionSource =
   | "readme_mining"
   | "cli";
 
+/** Derived granularity of a decision's blast area, narrowest first. */
+export type DecisionScope = "file" | "module" | "cross-module";
+
 export interface DecisionRecord {
   id: string;
   repository_id: string;
@@ -42,6 +45,11 @@ export interface DecisionRecord {
   last_code_change: string | null;
   /** Trust tier of the decision's primary supporting evidence. Optional for back-compat. */
   verification?: DecisionVerification;
+  /**
+   * Derived granularity level. Optional for back-compat with older backends;
+   * null when the record has no code linkage at all.
+   */
+  scope?: DecisionScope | null;
   created_at: string;
   updated_at: string;
   /** Number of evidence rows backing the record. List endpoint only. */

packages/ui/__tests__/decisions/decisions-table.test.tsx

@@ -66,6 +66,74 @@ describe("DecisionsTable", () => {
     });
   });
 
+  it("renders a scope badge when the record carries one", () => {
+    render(
+      <DecisionsTable
+        {...baseProps}
+        decisions={[
+          makeDecision({ id: "1", scope: "file" }),
+          makeDecision({ id: "2", title: "Adopt SWR", scope: "cross-module" }),
+        ]}
+      />,
+    );
+    // The scope <select> options share these labels, so exclude them.
+    expect(screen.getAllByText("File").some((el) => el.tagName !== "OPTION")).toBe(true);
+    expect(
+      screen.getAllByText("Cross-module").some((el) => el.tagName !== "OPTION"),
+    ).toBe(true);
+  });
+
+  it("invokes onFiltersChange when the scope filter changes", () => {
+    const onFiltersChange = vi.fn();
+    render(
+      <DecisionsTable
+        {...baseProps}
+        onFiltersChange={onFiltersChange}
+        decisions={[makeDecision({ id: "1", scope: "file" })]}
+      />,
+    );
+    fireEvent.change(screen.getByLabelText("Filter by scope"), {
+      target: { value: "module" },
+    });
+    expect(onFiltersChange).toHaveBeenCalledWith({
+      status: "all",
+      source: "all",
+      scope: "module",
+    });
+  });
+
+  it("hides the scope filter and ignores a scope value when no record carries scope", () => {
+    render(
+      <DecisionsTable
+        {...baseProps}
+        filters={{ status: "all", source: "all", scope: "file" }}
+        decisions={[
+          makeDecision({ id: "1", title: "Pick Postgres" }),
+          makeDecision({ id: "2", title: "Adopt SWR" }),
+        ]}
+      />,
+    );
+    expect(screen.queryByLabelText("Filter by scope")).not.toBeInTheDocument();
+    // Rows are NOT filtered out by the stale scope value.
+    expect(screen.getByText("Pick Postgres")).toBeInTheDocument();
+    expect(screen.getByText("Adopt SWR")).toBeInTheDocument();
+  });
+
+  it("filters rows client-side by scope", () => {
+    render(
+      <DecisionsTable
+        {...baseProps}
+        filters={{ status: "all", source: "all", scope: "file" }}
+        decisions={[
+          makeDecision({ id: "1", title: "Pick Postgres", scope: "file" }),
+          makeDecision({ id: "2", title: "Adopt SWR", scope: "cross-module" }),
+        ]}
+      />,
+    );
+    expect(screen.getByText("Pick Postgres")).toBeInTheDocument();
+    expect(screen.queryByText("Adopt SWR")).not.toBeInTheDocument();
+  });
+
   it("renders a retry button when an error is supplied with no decisions", () => {
     const onRetry = vi.fn();
     render(

packages/ui/src/decisions/decisions-table.tsx

@@ -14,6 +14,7 @@ import type {
   DecisionRecord,
   DecisionStatus,
   DecisionSource,
+  DecisionScope,
 } from "@repowise-dev/types/decisions";
 
 const STATUS_VARIANT: Record<string, "default" | "fresh" | "stale" | "outdated" | "outline" | "accent"> = {
@@ -30,12 +31,25 @@ const SOURCE_LABEL: Record<string, string> = {
   cli: "Manual",
 };
 
+const SCOPE_LABEL: Record<string, string> = {
+  file: "File",
+  module: "Module",
+  "cross-module": "Cross-module",
+};
+
 export type DecisionStatusFilter = DecisionStatus | "all";
 export type DecisionSourceFilter = DecisionSource | "all";
+export type DecisionScopeFilter = DecisionScope | "all";
 
 export interface DecisionsTableFilters {
   status: DecisionStatusFilter;
   source: DecisionSourceFilter;
+  /**
+   * Optional for back-compat with callers that predate scope. Unlike
+   * status/source (server query params), scope is derived at serialization
+   * time, so the table filters rows client-side.
+   */
+  scope?: DecisionScopeFilter;
 }
 
 export interface DecisionsTableProps {
@@ -71,6 +85,16 @@ export function DecisionsTable({
   const prefix = linkPrefix ?? `/repos/${repoId}`;
   const Link = LinkComponent;
 
+  // Scope is derived at serialization time (no server-side query param), so
+  // this filter applies client-side to the fetched rows. Backends that don't
+  // serve scope yet leave every row null: hide the filter (it could only
+  // empty the table) and ignore any lingering scope value.
+  const scopeFilter = filters.scope ?? "all";
+  const hasScope = (decisions ?? []).some((d) => d.scope != null);
+  const visibleDecisions = (decisions ?? []).filter(
+    (d) => !hasScope || scopeFilter === "all" || d.scope === scopeFilter,
+  );
+
   const columns: ResponsiveColumn<DecisionRecord>[] = [
     {
       key: "title",
@@ -123,6 +147,17 @@ export function DecisionsTable({
       cellClassName: "text-[var(--color-text-secondary)]",
       render: (d) => SOURCE_LABEL[d.source] ?? d.source,
     },
+    {
+      key: "scope",
+      header: "Scope",
+      priority: 3,
+      render: (d) =>
+        d.scope ? (
+          <Badge variant="outline">{SCOPE_LABEL[d.scope] ?? d.scope}</Badge>
+        ) : (
+          <span className="text-[var(--color-text-tertiary)]">—</span>
+        ),
+    },
     {
       key: "trust",
       header: "Trust",
@@ -234,11 +269,26 @@ export function DecisionsTable({
           <option value="readme_mining">Docs mining</option>
           <option value="cli">Manual</option>
         </select>
+        {hasScope && (
+          <select
+            value={filters.scope ?? "all"}
+            onChange={(e) =>
+              onFiltersChange({ ...filters, scope: e.target.value as DecisionScopeFilter })
+            }
+            aria-label="Filter by scope"
+            className="w-full sm:w-auto rounded-md border border-[var(--color-border-default)] bg-[var(--color-bg-surface)] px-3 py-1.5 text-sm text-[var(--color-text-primary)]"
+          >
+            <option value="all">All scopes</option>
+            <option value="file">File</option>
+            <option value="module">Module</option>
+            <option value="cross-module">Cross-module</option>
+          </select>
+        )}
       </div>
 
       <ResponsiveTable
         columns={columns}
-        rows={decisions ?? []}
+        rows={visibleDecisions}
         rowKey={(d) => d.id}
         empty={empty}
       />