feat(engine): apply package-update deltas from embedded components

[bomly-guy]

Gap

sdk.MatchResult.PackageUpdates / sdk.AnalyzeResult.PackageUpdates deltas were honored only by the managed-plugin transport adapters (internal/plugin/registry.go externalMatcher.Match / externalAnalyzer.Analyze). An embedded matcher or analyzer that returned deltas instead of a full registry had its enrichment silently dropped by the engine — the loop only consumed result.Registry.

What changed

Engine.Match and Engine.Analyze (internal/engine/engine.go) now:

• set AcceptPackageUpdates = true on the request before invoking components — placed in the engine methods (the single funnel every request-construction path goes through, including pipeline.go), so every caller gets it;
• mirror the adapter semantics exactly after each result:
  • a returned Registry wins and deltas are ignored;
  • otherwise non-empty PackageUpdates are applied via sdk.ApplyPackageUpdates and the resulting registry threads to the aggregated result and to subsequent components in the same run, identically to how a returned registry threads;
  • a zero-value result preserves the effective registry;
• stats handling is unchanged (matcher stats append, analyzer stats merge).

No double-apply for external plugins: their adapter resolves deltas into a full Registry before the engine sees the result — noted in a code comment at both apply sites.

Tests

internal/engine/package_updates_test.go:

• fake matcher returning only PackageUpdates: enrichment lands in the final registry, stats aggregate, and a second matcher observes the updated registry (that second matcher also covers the zero-value-result case);
• fake analyzer likewise;
• fakes returning BOTH Registry and PackageUpdates: the registry wins (adapter semantics) for both kinds;
• AcceptPackageUpdates asserted visible to components.

Why now

This unlocks per-wave delta adoption in the component-extraction program: embedded components can move to the delta contract before they are extracted, and behave identically after extraction.

🤖 Generated with Claude Code

[github-actions]

Bomly Diff Summary

Compared 16c12fd99b1a8e0b0e3b3d31d97f8c74f2cd5136 to 2d9c12e37dfcfd51b8e48ed0e12bbea358dd5918.

Overview

Status	Manifests	Dependencies	Findings	Duration
✅ Pass	+0 / ~0 / -0	0 added / 0 version changed / 0 detail changes / 0 removed	0 introduced / 0 persisted / 0 resolved	1m 17s

Dependency Changes

✅ No dependency changes.

Vulnerabilities

✅ No vulnerability changes.

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (--matchers +scorecard was not selected).

Policy Findings

✅ No policy differences were identified.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 92b43c7a-2ebf-44a1-a4e5-3fa15be65d7c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}