fix(review): framework-aware false-positive guards for injection/constructor claims (#337)

[devops-thiago]

Summary

• Adds a deterministic FrameworkFalsePositiveFilter (review/) that drops "missing no-arg/default constructor" findings when the flagged file's own diff shows a constructor annotated @Inject (CDI/Quarkus/Jakarta, bare or fully qualified) or @Autowired (Spring) — constructor injection needs no no-arg constructor, so the diff refutes the claim outright. Conservative in the same direction as FindingQuoteValidator: deleted lines never count as evidence, other files' hunks can't refute, and when the constructor sits outside the diff window the finding passes through unchanged.
• Wires the filter into both FindingPipeline paths (single-call refine and per-batch processBatch), right after quote validation, with the summary recounted on drop.
• Adds the CDI constructor-injection fact to the reviewer prompt (PrReviewPrompts.SYSTEM confidence-calibration section) and as a rejection rule in FindingVerifierPrompts.SYSTEM, plus a new "Framework facts" section in .github/thrillhousebot.md.

Reproduces the #270 dogfood shape: the bot posted MEDIUM — missing no-arg CDI constructor on PrSummaryGenerator despite a valid @Inject constructor. That exact shape is the primary test fixture and is now suppressed deterministically, with the prompt guardrails preventing the claim upstream.

Issue

Fixes #337

Test plan

• FrameworkFalsePositiveFilterTest (20 tests): drops the fix(review): v0.3.0 final-review — unreadable CI first-class + CiStatusEvaluator cleanup + glob-filter perf #270-class claim on an @Inject constructor-only bean (annotation above, inline, and with interleaved annotations; claim in title or description); keeps the finding when there is no @Inject constructor, when @Inject is on a field, when the annotated constructor was deleted, when the evidence is in another file, on constructor invocations (new X(...)), on non-Java/missing file paths, and on unrelated findings; recounts the summary when dropping.
• FindingPipelineTest/ReviewOrchestratorTest updated for the new pipeline dependency.
• ./mvnw verify passes locally (1608 tests, SpotBugs, JaCoCo gate); new class at 99% instruction coverage with the one previously-missed line now covered.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[thrillhousebot]

🤖 ThrillhouseBot PR Summary

What this PR does

Adds FrameworkFalsePositiveFilter that drops AI findings about missing no-arg constructors when the diff shows an @Inject or @Autowired constructor, and updates prompts to prevent such claims upstream. Wires the filter into both pipeline paths.

Control-Flow Diagram

🔀 Show diagram

flowchart TD
    A["ReviewResponse (raw AI output)"]
    B["quoteValidator.validate()"]
    C["frameworkFilter.filter() (new)"]
    D["deduplicator.dedupe()"]
    E["findingVerificationService.verify()"]
    F["Final findings"]
    A --> B
    B --> C
    C --> D
    D --> E
    E --> F

Loading

Changes Overview

• Files changed: 8
• Lines added: +473
• Lines removed: 0

Changed Files

File	Change	Summary
.github/thrillhousebot.md	Modified	Documents CDI constructor-injection as a framework fact the bot must not contradict.
src/main/java/dev/thiagogonzaga/thrillhousebot/review/FindingPipeline.java	Modified	Injects FrameworkFalsePositiveFilter after quote validation in both refine() and processBatch().
src/main/java/dev/thiagogonzaga/thrillhousebot/review/FrameworkFalsePositiveFilter.java	Added	New filter that drops missing-no-arg-constructor findings when an injection-annotated constructor appears in the diff.
src/main/java/dev/thiagogonzaga/thrillhousebot/review/ai/FindingVerifierPrompts.java	Modified	Adds rejection rule for findings that conflict with the injected constructor pattern.
src/main/java/dev/thiagogonzaga/thrillhousebot/review/ai/PrReviewPrompts.java	Modified	Adds calibration rule to never report missing no-arg constructor on @Inject/@Autowired beans.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/FindingPipelineTest.java	Modified	Adds FrameworkFalsePositiveFilter mock to pipeline constructor tests.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/FrameworkFalsePositiveFilterTest.java	Added	20 tests covering the filter's drop conditions, kept findings, edge cases, and summary recount.
src/test/java/dev/thiagogonzaga/thrillhousebot/review/ReviewOrchestratorTest.java	Modified	Adds real FrameworkFalsePositiveFilter to the orchestrator test setup.

Risk Assessment

Risk	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	0
🔵 Low	0

No new issues found in this PR, but the review cannot be approved until required CI is confirmed green.

⚠️ Required CI Checks Status

Some required checks are still pending or have failed:

Check	Type	Status	Detail
format	missing	⏳ Pending	-
test	missing	⏳ Pending	-
frontend	missing	⏳ Pending	-
trivy	missing	⏳ Pending	-
dependency-review	missing	⏳ Pending	-

---

Automated review by ThrillhouseBot. Reply with /review to re-run.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud