Compliance review command

[haasonsaas]

Problem

Qodo Merge's /compliance command runs security checks, ticket requirement validation, codebase duplication detection, and custom org rules in a single pass. This is a high-value enterprise feature that packages existing capabilities into one workflow.

DiffScope already has most of the primitives (security multi-pass, rules system, plugin system) but no unified compliance command.

Proposed Solution

Add a diffscope compliance subcommand that runs:

1. Security scan — Dedicated security-focused review pass
2. Secrets detection — Scan for hardcoded API keys, passwords, tokens
3. Rule compliance — Validate against all configured review rules
4. Ticket compliance — Validate against linked ticket requirements (see #ticket-validation issue)
5. License compliance — Check new dependencies for license compatibility
6. Duplication check — Flag significant code duplication introduced in the diff

Output

{
  "status": "FAIL",
  "checks": [
    {"name": "security", "status": "PASS", "findings": 0},
    {"name": "secrets", "status": "FAIL", "findings": 1, "details": [...]},
    {"name": "rules", "status": "WARN", "findings": 3, "details": [...]},
    {"name": "ticket", "status": "PASS", "coverage": "3/3 criteria met"},
    {"name": "licenses", "status": "PASS"},
    {"name": "duplication", "status": "WARN", "details": [...]}
  ]
}

CI Integration

• Exit code 1 on FAIL — blocks merge in CI
• Configurable severity thresholds per check
• --compliance-checks security,secrets,rules to run subset

Priority

Tier 3 — Enterprise differentiator. Packages existing capabilities for compliance teams.