Make Diffly verdicts proportionate to review risk

[VIVAAN-DHAWAN]

Summary

Rebalances Diffly’s deterministic verdict policy so healthy pull requests reach PASS instead of being routinely quarantined by heuristic uncertainty.

• BLOCK: failed required checks or high-confidence credential exposure in a changed hunk.
• QUARANTINE: security-sensitive code, database schema/migration changes, dependency changes, or pending required checks.
• PASS: no review gate fired. Missing obvious test coverage, unavailable checks, and incomplete repository-tree hints remain visible as low-severity review notes.

The policy also avoids treating generic token assignments or test-only auth code as a credential exposure.

Verification

• python -m pytest -q — 53 passed
• python -m compileall -q src
• git diff --check

[github-actions]

Diffly verdict: QUARANTINE

#13 · 5 files · 102 lines changed · checks: PENDING

Risk flags: NO_TEST_COVERAGE (medium), CHECKS_PENDING (low)

Risk flags and reasoning

• NO_TEST_COVERAGE (medium): Changed production files have no obvious neighboring or repository test coverage. — src/diffly_cli/cli.py
• CHECKS_PENDING (low): Required status checks are still pending. — combined commit status; diffly; test (3.10); test (3.11); test (3.12); test (3.13)
• QUARANTINE because at least one changed production file lacks obvious test coverage.
• QUARANTINE because required checks are still running.

Blast-radius summary

File	Change	Symbols	Direct callers	Tests
README.md	+4/-4	<top-level changes>	—	—
src/diffly_cli/cli.py	+1/-1	<top-level changes>	—	—
src/diffly_cli/triage.py	+38/-17	_is_production_file, str	_is_production_file, str	tests/test_triage.py, tests/test_triage.py
tests/test_local.py	+4/-4	<top-level changes>	—	—
tests/test_triage.py	+28/-1	test_dependency_and_missing_tests_quarantines, test_missing_obvious_test_coverage_is_a_pass_with_review_note, test_unknown_checks_do_not_downgrade_an_otherwise_healthy_pr	—	—

Deterministic triage is authoritative; any optional LLM explanation cannot change the verdict.