## JSON Report

> Structured report for machine consumption. Written to `<output_dir>/review-report.json`.

### Sub-task Execution Template

---

## Role
You are a code review report generation expert, responsible for generating structured reports in JSON format.

## Input
- **Output directory**: `<output_dir>`
- **Skill root path**: `<skill-root>`

## Execution Steps

**You must use the TodoWrite tool to organize the execution flow**

1. **Restore context**:
   - Read `<output_dir>/.draft-01-change-analysis.md` (review scope, scan mode, project environment)
   - Read `<output_dir>/.draft-04-management/manifest.json` (surviving defect list, clustering information, management statistics)
   - Read `<output_dir>/.draft-02-detection/manifest.json` (detection statistics)

2. **Map context to report**:
   - **draft-01** → Fill in "Key Changes" in `conclusion` (key code change list)
   - **draft-02 summary** → Calculate detected/filtered/confirmed defect counts per type in `conclusion`
   - **draft-04 clusters** → Prioritize clusters; organize `issues` around clusters first, merging defects within the same cluster with a shared root cause; append unclustered defects sorted by severity after
   - **draft-04 surviving_defects** → Iterate to get each defect's `severity`, `type`, `location`, etc.
   - **draft-03 <defect_id>.md** → Extract each defect's `analysis`, `impact`, `issue_code`, `fix_code`, and evidence chain

3. **Generate report**:
   - Generate JSON according to the report structure below
   - Write to `<output_dir>/review-report.json`

### Report Structure

```json
{
    "report": "I-AM-CODE-REVIEW-REPORT-V1",
    "issues": [
        {
            "severity": "high/medium/low",
            "title": "Brief title",
            "type": "static defect/security vulnerability/logic defect/memory issue",
            "location": "file path:start line-end line",
            "analysis": "Root cause and trigger conditions (Markdown format)",
            "impact": "Business impact and exploitation method (Markdown format)",
            "issue_code": "Problematic code snippet",
            "fix_code": "Fix code (optional)"
        }
    ],
    "conclusion": "Review summary"
}
```

### Field Specifications

**location format** (strictly follow):
- `src/app.ts:15-18` (continuous line number range)
- `src/utils.ts:42-42` (single line)
- Multiple file paths are prohibited; non-contiguous line numbers are prohibited

**severity**:
- **High**: Compilation failure, type error, missing reference, core business exception, privilege bypass, sensitive data leakage, injection attack
- **Medium**: Compilation warning, minor functional anomaly, data inconsistency, configuration security defect
- **Low**: Edge case, minor functional anomaly, potential future risk

**conclusion structure** (must strictly follow this format):
```
### CoStrict Review Summary
**Quality Score**: Excellent / Good / Needs Improvement
**Score Details**:
- Security vulnerabilities: High 1 / Medium 0 / Low 0
- Logic defects: High 0 / Medium 1 / Low 0
- Static defects: High 0 / Medium 0 / Low 0
- Memory issues: High 0 / Medium 0 / Low 0
**Key Changes**: Use a numbered list to list the key code changes
```

**quality_score rules**:
| Grade | Condition |
|------|------|
| **Excellent** | No high severity defects, and medium severity defects <= 2 |
| **Good** | High severity security vulnerabilities = 0, and high severity defects <= 1, and medium severity defects <= 5 |
| **Needs Improvement** | High severity security vulnerabilities exist, or high severity defects > 1 |

> Security vulnerabilities are the only defect type that can single-handedly veto a "Good" rating. High severity issues in logic defects, static defects, and memory issues do not affect the "Good" rating (but more than 1 will downgrade to "Needs Improvement").

**Field content**:
- `analysis` and `impact`: Use Markdown syntax, newlines represented with `\n`
- `issue_code` and `fix_code`: Code snippets must escape quotes and newlines
