fix(enrichment): include changed-file usage in dead-export scan (#1509)

.env.example

@@ -64,18 +64,18 @@ GITTENSORY_REVIEW_ENRICHMENT=false
 # BEGIN GENERATED REES ANALYZERS
 # Current analyzer names:
 # dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol,redos
-# provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature,iacMisconfig,nativeBuild
-# history,docCommentDrift
+# provenance,codeowners,callerImpact,secretLog,assetWeight,typosquat,commitSignature
+# iacMisconfig,nativeBuild,history,docCommentDrift
 #
 # Profile defaults:
 # fast: dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol
 # redos,provenance,secretLog,typosquat,iacMisconfig,nativeBuild
 # balanced (default): dependency,lockfileDrift,secret,license,installScript,heavyDependency
-# actionPin,eol,redos,provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature
-# iacMisconfig,nativeBuild,history,docCommentDrift
+# actionPin,eol,redos,provenance,codeowners,callerImpact,secretLog,assetWeight,typosquat
+# commitSignature,iacMisconfig,nativeBuild,history,docCommentDrift
 # deep: dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol
-# redos,provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature,iacMisconfig
-# nativeBuild,history,docCommentDrift
+# redos,provenance,codeowners,callerImpact,secretLog,assetWeight,typosquat,commitSignature
+# iacMisconfig,nativeBuild,history,docCommentDrift
 # END GENERATED REES ANALYZERS
 
 # Submitter-reputation spend control (internal-only): downgrades new/burst/low-rep

apps/gittensory-ui/src/lib/rees-analyzers.ts

@@ -327,6 +327,31 @@ export const REES_ANALYZERS = [
         "Leave REES_FORWARD_GITHUB_TOKEN unset/false to disable token forwarding; this analyzer will then skip when it cannot read CODEOWNERS.",
     },
   },
+  {
+    name: "callerImpact",
+    title: "Cross-file caller impact + dead exports",
+    category: "quality",
+    cost: "github-light",
+    defaultEnabled: true,
+    profiles: ["balanced", "deep"],
+    requires: ["files", "github-token", "head-sha"],
+    limits: {
+      maxFindings: 18,
+      maxSearchResults: 30,
+    },
+    docs: {
+      summary:
+        "Detects export-surface changes with live callsites and new exports with no callsites.",
+      looksAt:
+        "Top-level exported symbols in the PR diff plus a bounded symbol search in unchanged files at headSha.",
+      reports:
+        "Changed/removed/renamed exports with unchanged file callsites, and dead exports with zero external callsites.",
+      network:
+        "Calls GitHub code search and per-file contents APIs. Requires headSha plus GitHub token forwarding for private repos.",
+      notes:
+        "The analyzer is additive and fail-safe: network failures yield fewer findings, never errors in brief assembly.",
+    },
+  },
   {
     name: "secretLog",
     title: "Secrets or PII in logs",

review-enrichment/README.md

@@ -36,6 +36,7 @@ inside the operator's trust boundary. The engine prefers a short-lived installat
 | `redos`         | Regex literals with catastrophic-backtracking structure.                     | Pure local.                                                  |
 | `provenance`    | Missing package attestations plus binary/vendored/minified additions.        | Calls npm/PyPI for attestations; path checks are local.      |
 | `codeowners`    | Changed files owned by CODEOWNERS entries that do not include the PR author. | Calls GitHub API; needs author and token for private repos.  |
+| `callerImpact`  | Export-surface changes with live cross-file callsites or dead new exports.   | Calls GitHub code search and contents APIs; needs token/private-read access. |
 | `secretLog`     | Secrets, PII, or request/session objects written to logs/stdout.             | Pure local.                                                  |
 | `assetWeight`   | Heavy binary assets added or grown.                                          | Calls GitHub API; needs headSha, baseSha for growth, and token for private repos. |
 | `typosquat`     | New dependency names that look squatted or publicly claimable.               | Uses bundled popular-package lists plus npm/PyPI lookups.    |

review-enrichment/analyzer-metadata.json

@@ -369,6 +369,33 @@
         "notes": "Leave REES_FORWARD_GITHUB_TOKEN unset/false to disable token forwarding; this analyzer will then skip when it cannot read CODEOWNERS."
       }
     },
+    {
+      "name": "callerImpact",
+      "title": "Cross-file caller impact + dead exports",
+      "category": "quality",
+      "cost": "github-light",
+      "defaultEnabled": true,
+      "profiles": [
+        "balanced",
+        "deep"
+      ],
+      "requires": [
+        "files",
+        "github-token",
+        "head-sha"
+      ],
+      "limits": {
+        "maxFindings": 18,
+        "maxSearchResults": 30
+      },
+      "docs": {
+        "summary": "Detects export-surface changes with live callsites and new exports with no callsites.",
+        "looksAt": "Top-level exported symbols in the PR diff plus a bounded symbol search in unchanged files at headSha.",
+        "reports": "Changed/removed/renamed exports with unchanged file callsites, and dead exports with zero external callsites.",
+        "network": "Calls GitHub code search and per-file contents APIs. Requires headSha plus GitHub token forwarding for private repos.",
+        "notes": "The analyzer is additive and fail-safe: network failures yield fewer findings, never errors in brief assembly."
+      }
+    },
     {
       "name": "secretLog",
       "title": "Secrets or PII in logs",