Benchmark data and generated comparison artifacts.

Touch when: Use this when storing benchmark fixtures or outputs that explain scanner quality.

Repository maintenance, benchmark, parity, and regression scripts.

Touch when: Use this for repeatable evidence and local automation that should not live in runtime package code.

Root entrypoints and shared scan orchestration.

Touch when: Start here when CLI behavior, scan flow, or global configuration changes.

Provider adapters that let Skylos talk to model runtimes without coupling core logic to one vendor.

Touch when: Change this when adding or hardening an LLM provider boundary.

Agent-facing payloads, service helpers, and review triage learning.

Touch when: Use this area for agent review workflows and normalized agent result handling.

Reusable static-analysis primitives: architecture, reachability, control-flow, penalties, and implicit references.

Touch when: Change this when multiple scanners need the same code-understanding primitive.

Public API facade and private helpers for payloads, snippets, findings, URLs, and AI-detection metadata.

Touch when: Keep compatibility in mind here; external users may import from skylos.api.

Deep-audit candidate selection, processing, redaction, export, and revalidation.

Touch when: Use this for audit packets, changed-file audits, and post-scan review artifacts.

Benchmark fixtures and scoring code for security, quality, dead-code, and agent-review comparisons.

Touch when: Change this when proving scanner quality changed, not just when code still passes tests.

CI workflow generation, annotations, review comments, evidence, and risk passport output.

Touch when: Use this when changing GitHub/GitLab integration behavior or CI gate messaging.

Smaller CLI parser and dispatch pieces peeled away from the main CLI module.

Touch when: Prefer this for new command wiring when it fits the newer CLI split.

Skylos Cloud login, credentials, policy sync, project context, and upload manifest support.

Touch when: Treat this as security-sensitive because local repo state and cloud policy meet here.

Command modules used by the CLI for focused command behavior.

Touch when: Put command-specific behavior here instead of growing skylos/cli.py.

Generated facts are available; this folder still needs a curated summary.

Touch when: Use the module list and tests to decide whether this is the right ownership area.

Small shared core types and helpers used across scan paths.

Touch when: Use this only for concepts that are truly shared across the product.

Dead-code specific analysis, framework liveness, and evidence support.

Touch when: Change this for dead-code false positives, framework awareness, and reachability fixes.

Technical-debt detection and reporting helpers.

Touch when: Use this for code-health signals that are not direct security findings.

Defensive scanning plugins and checks for suspicious package or code patterns.

Touch when: Use this for supply-chain or malicious-code detection extensions.

Source discovery and language/workspace detection.

Touch when: Change this when Skylos misses files or scans too much.

Generated facts are available; this folder still needs a curated summary.

Touch when: Use the module list and tests to decide whether this is the right ownership area.

Language-specific engines and parsers beyond the Python AST path.

Touch when: Use this when adding or fixing non-Python language analysis.

External-service integration helpers.

Touch when: Keep external contracts small and well-tested here.

LLM security analysis, evidence grounding, provider runtime resolution, and prompt templates.

Touch when: Treat this as high-risk: changes can reduce hallucinations or create scanner false negatives.

Generated facts are available; this folder still needs a curated summary.

Touch when: Use the module list and tests to decide whether this is the right ownership area.

Plugin interfaces and loading support.

Touch when: Use this when adding extension points without coupling them to core scan flow.

Generated facts are available; this folder still needs a curated summary.

Touch when: Use the module list and tests to decide whether this is the right ownership area.

Autofix and cleanup support for selected findings.

Touch when: Use this only when a finding has a safe, narrow, testable edit path.

Output formatters and exports such as SARIF, compact JSON, and human-readable reports.

Touch when: Use this when scan results are right but the output is wrong or hard to consume.

Rule catalog and concrete rule implementations for quality, security, AI-defect, config, edge, CI/CD, and SCA findings.

Touch when: Start here when adding rule IDs, tuning scanner semantics, config posture checks, or changing rule docs parity.

Scale and performance helpers for larger repositories.

Touch when: Use this when scan runtime, batching, or large-repo behavior changes.

Security contract detection, secret handling, and security-specific analysis helpers.

Touch when: Treat this as gate-sensitive; regressions here can hide vulnerabilities.

Terminal UI and presentation helpers.

Touch when: Use this when the scan is correct but terminal interaction is confusing.

Generated facts are available; this folder still needs a curated summary.

Touch when: Use the module list and tests to decide whether this is the right ownership area.

AST/tree visitors that collect findings and semantic evidence.

Touch when: Use this when a language-specific scan is missing or over-reporting code patterns.

Unit and regression tests covering CLI, analyzer, rules, integrations, and benchmarks.

Touch when: Add narrow tests here before trusting analyzer or policy changes.