Cora

Appearance

Roadmap ​

Demand-gated — we build what people actually need. Track progress on GitHub Issues.

v0.1.5 — Initial Release ​

  • #90 Basic diff review with OpenAI — ✓ Done
  • #89 JSON response repair & unicode handling — ✓ Done
  • #90 CLI interface with review command — ✓ Done

v0.1.6 — Custom Prompts & Path Injection ​

  • #95 Enhanced default system prompts — ✓ Done
  • #94 Custom system prompt via .cora.yaml config — ✓ Done
  • #93 Inject valid file paths into system prompt — ✓ Done
  • #92 JSON object response format (opt-in) — ✓ Done

v0.1.7 — Deterministic & Reliable ​

  • #98 Deterministic reviews — temperature=0 — ✓ Done
  • #97 Non-deterministic output bug fix — ✓ Done
  • #99 HTTP timeout + connection pooling — ✓ Done
  • #100 Diff-hash caching for repeat reviews — ✓ Done
  • #101 Configurable max_tokens — ✓ Done

v0.2.0 — Multi-Provider & SARIF ​

  • #106 BYOK — Anthropic, Groq, Ollama support — ✓ Done
  • #106 SARIF output format — ✓ Done
  • #106 Branch review mode — ✓ Done
  • #106 Output footer watermark — ✓ Done

v0.3 — Progress & CI Hardening ​

  • #140 Static analysis context injection (reduce false positives) — ✓ Done
  • #108 --progress flag for machine-readable output — ✓ Done
  • #102 Composite action crash fix (KeyError) — ✓ Done
  • #88 Config validate command — ✓ Done

v0.4 — Deterministic Engine Pipeline ​

  • #116 Deterministic rule engine — 12 built-in rules — ✓ Done
  • #115 File bundling — parallel per-bundle review — ✓ Done
  • #114 AST-based cross-file dependency extraction — ✓ Done
  • #159 Hunk header regex panic fix + 5MB diff support — ✓ Done

v0.4.5 — Config Architecture ​

  • #209 Config redesign — auth.toml for secrets, config.yaml for settings — ✓ Done
  • #203 Auth login auto-detect provider env vars — ✓ Done
  • #189 cora config show effective resolved config — ✓ Done
  • #182 Env var override visibility — ✓ Done
  • #185 Deterministic rules exclude rules/ — ✓ Done
  • #186 Truncated JSON repair tests — ✓ Done

v0.4.6 — Polish & Docs ​

  • #162 README overhaul — market-facing copy — ✓ Done
  • #204 Deterministic secrets pre-scan — ✓ Done
  • #195 Diff parser hardening Phase 1 — ✓ Done

v0.5 — Agent & Quality ​

  • #205 Quality gate — CI pass/fail thresholds — ✓ Done
  • #234 Static security scanner — 11 patterns — ✓ Done
  • #233 Language-specific analyzers (Dart, Svelte, TS, Go, Rust, Python) — ✓ Done
  • #207 MCP server — expose rules to AI agents — ✓ Done
  • #238 Quality profiles bug fix — path resolution, fail-fast, dedup — ✓ Done
  • #188 Auto-chunking for large diffs — ✓ Done
  • #206 Tech debt metrics — review history — ✓ Done
  • #232 Uteke memory integration — recall + learn — ✓ Done
  • #262 cora commit — review + auto commit message + quality gate — ✓ Done

v0.6 — Code Intelligence ​

The foundation layer for structural code understanding — persistent symbol index, semantic search, and deep Uteke integration.

  • #264 cora index — Symbol index & SQLite persistence — ✓ Done
  • #265 cora explore — Structural + semantic code search — ✓ Done
  • #235 Cora + Uteke cross-product integration bundle — ✓ Done
  • #284 MCP Phase 1 — Code Intelligence tools (5 tools) — ✓ Done
  • #285 MCP Phase 2 — Review + Debt tools (2 tools) — ✓ Done
  • #286 MCP Phase 3 — Context enrichment tools (2 tools) — ✓ Done

Also in v0.6 ​

  • #47 GitHub Marketplace action — ✓ Done
  • #196 VitePress docs site — ✓ Done
  • #161 cora gain — local stats + viral sharing — ✓ Done
  • #160 Landing page redesign — ✓ Done

v0.7 — Multi-Language & Code Graph ​

Query layer built on top of the v0.6 index — call graph traversal, test impact analysis, broader language support, and real-time sync.

  • #266 cora callers / cora impact — Call graph query commands — ✓ Done
  • #267 cora affected — Find tests affected by changes — ✓ Done
  • #268 Language expansion — 6 → 15+ language support — ✓ Done
  • #269 Auto-sync file watcher daemon — ✓ Done

v0.8 — Brain Mode & Tree-sitter Expansion ​

Hybrid semantic search and deep language support via AST parsing.

  • Phase 1 — Static token embedding engine (256d) — ✓ Done
  • Phase 2 — Tree-sitter AST + schema v3 edges table — ✓ Done
  • Phase 2C — cora trace + cora arch — ✓ Done
  • Phase 3 — Brain Mode hybrid search (usearch + RRF) — ✓ Done
  • #374 Dart symbol indexing — ✓ Done
  • #375 Svelte symbol indexing (regex) → #384 upgraded to AST — ✓ Done
  • #376 Tree-sitter expansion: 4 → 12 languages (Java, C, C++, C#, Ruby, PHP, Scala, JS) — ✓ Done
  • #338 Renamed cora-cli → cora-code — ✓ Done
  • #369 Security scanner false positive suppression — ✓ Done
  • #355 Global index database (~/.codecora/cora-code/graph.db) — ✓ Done

v0.9 — Findings SoT & Performance ​

Unified data layer and massive performance improvements.

  • #396 DB migration v5 — reviews, findings, finding_events tables — ✓ Done
  • #397 Persist review findings to cora.db — ✓ Done
  • #398 Persist scan findings to cora.db — ✓ Done
  • #399 Auto-resolve stale findings — ✓ Done
  • #400 cora findings CLI command — ✓ Done
  • #395 Rename graph.db → cora.db — ✓ Done
  • #404 Batch transaction for index_project — ✓ Done
  • #405 Batch INSERT multi-row VALUES — ✓ Done
  • #406 SQLite PRAGMA tuning — ✓ Done
  • #407 Cache vector index in memory — ✓ Done
  • #408 Incremental index via mtime:size — ✓ Done
  • #409 Rayon parallel file processing — ✓ Done
  • #410 Batch symbol lookup in RRF — ✓ Done
  • #422 Rayon parallel embedding — ✓ Done

v0.10 — Governance & Hardening ​

Open-source governance and project-level hardening.

  • CONTRIBUTING.md Contribution guide — ✓ Done
  • CODE_OF_CONDUCT.md Code of Conduct — ✓ Done
  • SECURITY.md Security policy — ✓ Done
  • PR template, issue templates (bug report + feature request) — ✓ Done
  • Branch naming + conventional commits CI checks — ✓ Done

v0.11 — Review Intelligence ​

Index-powered review pipeline — deterministic findings wired into every review.

  • Unused import detection via symbol graph — ✓ Done
  • Dead code detection in changed files during review — ✓ Done
  • Breaking change detection (removed public symbols) — ✓ Done
  • HTTP route extraction (Axum, Actix, Express, Go net/http) as EdgeKind::Route — ✓ Done
  • Brain enrichment Tier 1 — caller resolution, impact analysis, affected tests in review prompt — ✓ Done
  • index_skip_files config for bundler/entry-point false positive suppression — ✓ Done

v0.12 — Search Quality & Accuracy ​

Fixes for FTS5 search and dead-code false positives.

  • #451 FTS5 camelCase search fix — file column + split_camel_case() — ✓ Done
  • #452 Dead-code false positives on framework entry points — FRAMEWORK_ENTRY_PREFIXES + // cora: keep suppression — ✓ Done
  • #453 Sticky skip files fix — index_config_hash invalidation — ✓ Done
  • Schema v6 — FTS5 rebuild with file column, config hash tracking — ✓ Done

v0.13 — Runtime Brain Mode ​

Runtime embedding backend selection — no recompilation needed to switch.

  • brain.embedding config (auto | hashing | pretrained) in .cora.yaml — ✓ Done
  • Backend enum + resolve_backend() with OnceLock caching — ✓ Done
  • Incremental per-symbol embedding via embed_fingerprint — ✓ Done
  • BrainConfig + BrainEmbeddingMode in config schema — ✓ Done
  • Schema v7 — embed_fingerprint TEXT column on symbols — ✓ Done

Future — What's Next ​

Other ​

  • #117 Lightweight agent follow-up — 1 capped tool-call — → Planned
  • #132 GitHub App backend MVP in Rust (Axum) — → Planned