first commit

docs/future_roadmap.md

@@ -0,0 +1,82 @@
+# Future Features Roadmap
+
+This document outlines the strategic plan for evolving the AI Code Review system. These features are proposed for future implementation to enhance security coverage, context awareness, and user interaction.
+
+---
+
+## Phase 1: Advanced Security Scanning
+
+Expand the current 17-rule regex scanner with dedicated industry-standard tools for **Static Application Security Testing (SAST)** and **Software Composition Analysis (SCA)**.
+
+### Proposed Integrations
+
+| Tool | Type | Purpose | Implementation Plan |
+|------|------|---------|---------------------|
+| **Bandit** | SAST | Analyze Python code for common vulnerability patterns (e.g., `exec`, weak crypto). | Run `bandit -r . -f json` and parse results into the review report. |
+| **Semgrep** | SAST | Polyglot scanning with custom rule support. | Integrate `semgrep --config=p/security-audit` for broader language support (JS, Go, Java). |
+| **Safety** | SCA | Check installed dependencies against known vulnerability databases. | Run `safety check --json` during CI to flag vulnerable packages in `requirements.txt`. |
+| **Trivy** | SCA/Container | Scan container images (Dockerfiles) and filesystem. | Add a workflow step to run Trivy for container-based projects. |
+
+**Impact:** significantly reduces false negatives and covers dependency chain risks (Supply Chain Security).
+
+---
+
+## Phase 2: "Chat with Codebase" (RAG)
+
+Move beyond single-file context by implementing **Retrieval-Augmented Generation (RAG)**. This allows the AI to answer questions like *"Where is authentication handled?"* by searching the entire codebase semantically.
+
+### Architecture
+
+1.  **Vector Database:**
+    *   **ChromaDB** or **Qdrant**: Lightweight, open-source choices for storing code embeddings.
+2.  **Embeddings Model:**
+    *   **OpenAI `text-embedding-3-small`** or **FastEmbed**: To convert code chunks (functions/classes) into vectors.
+3.  **Workflow:**
+    *   **Index:** Run a nightly job to parse the codebase -> chunk it -> embed it -> store in Vector DB.
+    *   **Query:** When `@ai-bot` receives a question, convert the question to a vector -> search Vector DB -> inject relevant snippets into the LLM prompt.
+
+**Impact:** Enables high-accuracy architectural advice and deep-dive explanations spanning multiple files.
+
+---
+
+## Phase 3: Interactive Code Repair
+
+Transform the bot from a passive reviewer into an active collaborator.
+
+### Features
+
+*   **`@ai-bot apply <suggestion_id>`**:
+    *   The bot generates a secure `git patch` for a specific recommendation.
+    *   The system commits the patch directly to the PR branch.
+*   **Refactoring Assistance**:
+    *   Command: `@ai-bot refactor this function to use dependency injection`.
+    *   Bot proposes the changed code block and offers to commit it.
+
+**Risk Mitigation:**
+*   Require human approval (comment reply) before any commit is pushed.
+*   Run tests automatically after bot commits.
+
+---
+
+## Phase 4: Enterprise Dashboard
+
+Provide a high-level view of engineering health across the organization.
+
+### Metrics to Visualize
+
+*   **Security Health:** Trend of High/Critical issues over time.
+*   **Code Quality:** Technical debt accumulation vs. reduction rate.
+*   **Review Velocity:** Average time to AI review vs. Human review.
+*   **Bot Usage:** Most frequent commands and value-add interactions.
+
+### Tech Stack
+*   **Prometheus** (already implemented) + **Grafana**: For time-series tracking.
+*   **Streamlit** / **Next.js**: For a custom management console to configure rules and view logs.
+
+---
+
+## Strategic Recommendations
+
+1.  **Immediate Win:** Implement **Bandit** integration. It is low-effort (Python library) and high-value (detects real vulnerabilities).
+2.  **High Impact:** **Safety** dependency scanning. Vulnerable dependencies are the #1 attack vector for modern apps.
+3.  **Long Term:** Work on **Vector DB** integration only after the core review logic is flawless, as it introduces significant infrastructure complexity.