fix(hybrid): resolve 4 pre-existing test_hybrid_engine confidence field failures

[Wolfvin]

Summary

Fixes 4 pre-existing test failures in tests/test_hybrid_engine.py that have been present on main since commit 52ab89b (the original hybrid engine commit) — not caused by any Phase 1 work.

FAILED tests/test_hybrid_engine.py::TestHybridIntegration::test_query_confidence_without_deep
FAILED tests/test_hybrid_engine.py::TestHybridIntegration::test_impact_confidence_without_deep
FAILED tests/test_hybrid_engine.py::TestHybridIntegration::test_ai_format_confidence_distribution
FAILED tests/test_hybrid_engine.py::TestHybridIntegration::test_dead_code_confidence_fields

Root Cause (with evidence)

Path C — Feature partially implemented.

The 4 failing tests were added in commit 52ab89b ("feat: hybrid analysis engine — LSP integration for deep accuracy") alongside the hybrid engine itself. The tests assert that query/impact/dead-code output carries confidence metadata (confidence field, confidence_distribution in stats) even without --deep.

However, the engine only attached these fields on the --deep code path:

• scripts/codelens.py lines 1010-1046 and 1056-1107: both --deep post-processing blocks call HybridEngine.enhance_query / enhance_impact / verify_dead_code / add_confidence_to_result — but only when getattr(args, 'deep', False) is True.
• The non-deep branch (codelens.py lines 1108-1122) only prints an LSP-availability hint; it does not attach any confidence metadata.
• The command execute() entry points (scripts/commands/query.py, impact.py, dead_code.py) did not call the engine helpers at all.

Evidence that this is a partial implementation, not a removed feature or rename:

1. git log --oneline --all -- tests/test_hybrid_engine.py shows only one commit (52ab89b) — the tests were never modified after initial creation.
2. git show 52ab89b:scripts/codelens.py confirms the non-deep branch never attached confidence, even at the original commit. I verified the 4 tests fail at 52ab89b by checking out that commit's versions of the 3 files and running the tests.
3. The hybrid engine already has the correct no-LSP behavior: HybridEngine.enhance_query (line 162-164), enhance_impact (line 217-219), and verify_dead_code (line 114-118) all set confidence = CONFIDENCE_MEDIUM when lsp_active is False. The module docstring documents: high = LSP verified, medium = AST matched, low = regex only. CodeLens's default analysis path is tree-sitter AST = medium.
4. The helpers existed but were never wired into the non-deep command path — a classic partial implementation.

Fix (Path C)

Complete the partial implementation by calling the existing engine helpers from each command's execute() entry point with deep=False. The engine sets confidence = MEDIUM (AST-based analysis) when LSP is not active. When --deep is later applied in codelens.py post-processing, LSP verification may override individual fields to HIGH or LOW as before.

Files modified

• scripts/commands/query.py — Added _attach_baseline_confidence() helper called from execute() after cmd_query(). Calls create_hybrid_engine(workspace, deep=False).enhance_query(result, query_name), which sets result["confidence"] = "medium" when LSP is not active. Only runs when result.get("found") is True.

• scripts/commands/impact.py — Added inline confidence attachment inside the existing if result.get("status") == "ok": block. Calls create_hybrid_engine(workspace, deep=False).enhance_impact(result, args.name).

• scripts/commands/dead_code.py — Added confidence attachment inside the existing if result.get("status") == "ok": block. Collects all findings from result["results"].values(), calls engine.verify_dead_code(all_findings) (sets confidence = "medium" on each finding), then add_confidence_to_result(result) (adds confidence_distribution to stats). Includes a best-effort fallback if the engine import fails.

• CHANGELOG.md — Added "Confidence Fields on Non-Deep Output (test fix)" section under [8.2.0] documenting root cause, new fields, and non-breaking guarantees.

Why Path C (not A or B)

• Not Path A (feature removed): The feature was never removed — the engine helpers exist and work correctly. They were just not invoked on the non-deep path.
• Not Path B (field renamed): No rename occurred. The field names in the tests (confidence, confidence_distribution) match the engine's actual output field names exactly.
• Path C (partial implementation): The tests correctly assert the intended behavior documented in the engine's module docstring. The fix completes the implementation by wiring the existing helpers into the command entry points.

Test Results

Before (on main / branch HEAD before this PR)

tests/test_hybrid_engine.py: 4 failed, 12 passed, 1 skipped
Full suite (excluding test_integration.py OOM): 4 failed, 645 passed, 12 skipped

After (this PR)

tests/test_hybrid_engine.py: 0 failed, 16 passed, 1 skipped
  PASS test_query_confidence_without_deep
  PASS test_impact_confidence_without_deep
  PASS test_ai_format_confidence_distribution
  PASS test_dead_code_confidence_fields

Full suite (excluding test_integration.py OOM + test_graph_incremental.py):
  649 passed, 12 skipped, 0 new failures

Note on test_graph_incremental.py: Excluded because it belongs to worker 4-b's domain (feat/issue-25-incremental-graph — graph_model.py + scan.py). Those failures are pre-existing on that branch and unrelated to this PR. This PR does not touch graph_model.py or scan.py.

Manual verification of command output

$ codelens query detect_dead_code . --format json | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d["confidence"])'
medium

$ codelens impact detect_dead_code . --format json | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d["confidence"])'
medium

$ codelens dead-code . --format ai --top 5 | python3 -c 'import sys,json; d=json.load(sys.stdin); print("confidence_distribution" in d["stats"])'
True

$ codelens dead-code . --format json --top 5 | python3 -c '
import sys,json
d=json.load(sys.stdin)
for cat, items in d["results"].items():
    if items: print(f"{cat}: first item confidence = {items[0][\"confidence\"]}")'
unused_vars: first item confidence = medium
unreachable: first item confidence = medium
registry_dead: first item confidence = medium

--deep path still works

$ codelens query detect_dead_code . --deep --format json 2>/dev/null | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d["confidence"], d.get("lsp_active"), d.get("deep_analysis"))'
medium False False

Without pyright installed, --deep gracefully degrades and confidence stays at medium (the baseline set by this fix). With pyright installed, the --deep post-processing in codelens.py would override to high/low based on LSP verification — exactly as before.

Non-Breaking Guarantees

1. Additive only — no existing field is removed or renamed. The new confidence / confidence_distribution fields are added alongside existing fields.
2. All previously-passing tests continue to pass — verified with full suite run (649 passed, 0 new failures).
3. --deep override preserved — the --deep post-processing layer in codelens.py still runs after execute() and may override confidence based on LSP verification.
4. --format ai surfaces confidence — the existing _META_KEYS extraction in formatters/__init__.py (line 141) already includes confidence and confidence_distribution, so the AI-normalized output picks them up automatically.
5. Graceful fallback — if the hybrid engine import fails (shouldn't happen in practice), each command falls back to setting confidence = "medium" directly.

Constraints compliance

• Python 3.8+, no new deps OK
• Zero dead code (the direct_dependents/indirect_dependents/affected_files vars in impact.py are pre-existing and out of scope) OK
• No currently-passing test broken OK
• No test coverage removed — the 4 failing tests now pass with their original assertions intact OK
• New fields documented in CHANGELOG OK
• Did not touch osv_client.py, vuln_scan.py, vulnscan_engine.py (worker 4-a), graph_model.py, scan.py (worker 4-b), hybrid_type_resolver.py OK

Coordination notes

Used an isolated git worktree (/home/z/my-project/CodeLens-4c) to avoid disturbing parallel workers 4-a and 4-b who share the main checkout. The shared checkout remains on feat/issue-25-incremental-graph with worker 4-b's uncommitted changes intact.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud