[performance.go.rebuild-amplifier] Go package "internal/codeguard/core" has 33 transitive dependents; max is 32, so changes here amplify rebuild cascades (sample: cmd/codeguard, cmd/codeguard-dev, internal/cli, internal/codeguard/ai/fix, ...). Fix: Reduce upward coupling around the package, extract volatile code into leaf packages, and separate stable contracts from frequently changing implementation details.

[quality.duplicate-code] duplicate normalized token sequence of 60 tokens also found in internal/codeguard/externalreports/native.go:144 (threshold 60). Fix: Extract the shared logic, consolidate the implementation, or raise the threshold intentionally for acceptable duplication.

[quality.duplicate-code] duplicate normalized token sequence of 60 tokens also found in internal/codeguard/externalreports/sarif.go:172 (threshold 60). Fix: Extract the shared logic, consolidate the implementation, or raise the threshold intentionally for acceptable duplication.

[quality.cyclomatic-complexity] function addRiskArtifacts has cyclomatic complexity 11; max is 10. Fix: Reduce branching in the function or refactor logic into smaller units.

[quality.cyclomatic-complexity] function importSARIF has cyclomatic complexity 12; max is 10. Fix: Reduce branching in the function or refactor logic into smaller units.

[quality.cyclomatic-complexity] function TestImportTrivyNormalizesFindingsAndRedactsSecretPayload has cyclomatic complexity 13; max is 10. Fix: Reduce branching in the function or refactor logic into smaller units.

[quality.max-parameters] function newTrivyFinding has 8 parameters; max is 5. Fix: Group related inputs into a struct or simplify the function signature.

[quality.cyclomatic-complexity] function VerifyBatch has cyclomatic complexity 11; max is 10. Fix: Reduce branching in the function or refactor logic into smaller units.

[quality.ai.narrative-comment] comment narrates the code instead of explaining intent or constraints. Fix: Delete the narration or rewrite the comment so it captures why the code exists, what constraint it protects, or what tradeoff it makes.

[quality.max-parameters] function runEntry has 7 parameters; max is 5. Fix: Group related inputs into a struct or simplify the function signature.