Problem
Room requires an external analyzer executable (ROOM_ANALYZER_EXECUTABLE) to produce receipts that the policy engine evaluates. Without an analyzer connected, all evaluations return INDETERMINATE and enforcement blocks everything. Currently there is no reference analyzer implementation — users must build their own from the analyzer contract docs before Room does anything useful.
Proposal
Ship a companion reference analyzer (separate repo or examples/analyzer) that:
- Implements the analyzer contract from
docs/analyzer.md
- Detects at least a baseline set of signals (e.g., secrets in diffs, known vulnerable patterns)
- Produces valid signed receipts that Room can evaluate
- Serves as both a usable starting point and a test fixture for the CI suite
This would let new users get end-to-end enforcement working without writing an analyzer from scratch, and would give the project a concrete integration test path.
Out of scope
The reference analyzer does not need to be production-grade. It needs to demonstrate the contract and cover a minimal useful signal set.
Problem
Room requires an external analyzer executable (
ROOM_ANALYZER_EXECUTABLE) to produce receipts that the policy engine evaluates. Without an analyzer connected, all evaluations returnINDETERMINATEand enforcement blocks everything. Currently there is no reference analyzer implementation — users must build their own from the analyzer contract docs before Room does anything useful.Proposal
Ship a companion reference analyzer (separate repo or
examples/analyzer) that:docs/analyzer.mdThis would let new users get end-to-end enforcement working without writing an analyzer from scratch, and would give the project a concrete integration test path.
Out of scope
The reference analyzer does not need to be production-grade. It needs to demonstrate the contract and cover a minimal useful signal set.