Feature: Review history and learning via Uteke memory integration

[ajianaz]

Feature: Review History & Learning via Uteke Memory Integration

Problem

Cora reviews are stateless — each review is independent with no memory of past findings. Same false positives get flagged repeatedly. No learning from history.

Architecture: 3-Level Integration

Level	Flag	Behavior	Uteke Required?
None	(default)	Standalone review, like today	❌ No
Context	--memory	Recall project patterns from Uteke before review, enrich system prompt	✅ Yes
Learning	--memory --learn	Context + save review findings + user feedback to Uteke	✅ Yes

Key principle: Cora works 100% without Uteke. Integration is purely additive.

Implementation: Single New Module

Add src/engine/memory.rs — optional, graceful degradation:

pub struct MemoryBackend {
 enabled: bool, // false by default, auto-detect uteke binary
 namespace: String, // "cora" by default
}

impl MemoryBackend {
 /// Auto-detect: check if `uteke` CLI is available
 pub fn detect() -> Self {
 let has_uteke = which::which("uteke").is_ok();
 Self { enabled: has_uteke, namespace: "cora".into() }
 }

 /// Recall project patterns before review
 /// Calls: uteke recall "{project} code-pattern" --namespace cora --limit 5
 pub fn recall_context(&self, project: &str) -> Vec<String> { ... }

 /// Save review findings after review
 /// Calls: uteke remember "cora:{project}:pattern:{desc}" --tags cora,pattern
 pub fn save_findings(&self, project: &str, response: &ReviewResponse) { ... }

 /// Save user feedback (false positives, dismissals)
 /// Calls: uteke remember "cora:{project}:fp:{pattern}" --tags cora,false-positive
 pub fn save_feedback(&self, project: &str, issue_id: &str, feedback: &str) { ... }
}

Integration via subprocess — Cora calls uteke recall and uteke remember via CLI. No Rust library dependency. Clean separation.

Flow

cora review --memory --learn
│
├─ 1. MemoryBackend::detect()
│ └─ uteke found? → enabled=true
│ └─ uteke not found? → warn + continue without memory
│
├─ 2. MemoryBackend::recall_context("ajianaz/uteke")
│ └─ uteke recall "uteke-project code-pattern" --namespace cora
│ └─ Returns: ["null-check pattern common", "unwrap common in tests"]
│ └─ Inject into LLM system prompt as project context
│
├─ 3. [NORMAL REVIEW FLOW — diff → LLM → SARIF]
│ └─ LLM now has enriched context → fewer false positives
│
├─ 4. MemoryBackend::save_findings("ajianaz/uteke", response)
│ └─ uteke remember "cora:uteke:pattern:null-check" --tags cora,pattern
│ └─ uteke remember "cora:uteke:stats:2026-06:review-count=1,issues=3"
│
└─ 5. [Optional] User feedback loop
 └─ cora review --memory --learn --feedback "FP on #2"
 └─ MemoryBackend::save_feedback(...) → false positive pattern stored

Commands

cora review # Standalone, no memory (default)
cora review --memory # Recall context before review
cora review --memory --learn # Recall + save findings
cora review --memory --learn --feedback "FP on #2" # + user feedback
cora history <file> # Review history from Uteke
cora history --stats # Aggregate review statistics

Stored in Uteke

# Auto-learn findings:
uteke remember "cora:project:uteke:pattern:null-check-common" \
 --tags cora,pattern,null-check --type fact --entity "uteke-project"

# False positives:
uteke remember "cora:project:uteke:fp:unwrap-in-test" \
 --tags cora,false-positive --type preference --entity "uteke-project"

# Stats:
uteke remember "cora:stats:2026-06:review-count=12,issues-found=34,false-pos=2" \
 --tags cora,stats --type fact

Priority Strategy

Uteke first (80% focus) → Cora integration second (20% focus)

• Uteke must be stable + published to crates.io (Task 3.4: Final launch verification checklist #136) before Cora integration
• Cora standalone improvements (quality profiles, security scanner) can proceed in parallel
• This issue depends on Uteke v0.0.12 being complete

Effort

Medium (2-3 weeks)

• Week 1: memory.rs module + subprocess integration + auto-detect
• Week 2: Pre-review context injection + post-review storage
• Week 3: history commands + testing + false positive measurement

Acceptance Criteria

• cora review works identically without Uteke (zero regression)
• cora review --memory enriches prompt with project context when Uteke available
• cora review --memory --learn saves findings to Uteke
• False positive rate reduction measurable over 5+ reviews
• Graceful degradation: missing uteke = warning, not error

[ajianaz]

Uteke v0.0.13 — Ready for Review History Integration

The MemoryBackend described in this issue can now be implemented. Key capabilities available:

For context level (--memory):

• uteke recall "project X error handling patterns" --namespace cora --json → returns ranked results with scores
• FTS5 hybrid search gives both semantic AND exact keyword matches
• --entity / --category filters for scoped recall (e.g. --entity cora --category finding)

For learning level (--memory --learn):

• uteke remember "Missing error handling in auth middleware" --namespace cora --entity cora --category finding --meta "severity:major,file:src/auth.rs,rule:error-handling"
• Auto type detection for meta values (string/number/bool)
• Tags for categorization, entity/category for structured filtering

Server mode for CI:

• uteke-serve --port 8767 → ~42ms recall, ~32ms remember
• HTTP API: POST /recall, POST /remember, POST /search
• Graceful: MemoryBackend::detect() can check /health endpoint or which::which("uteke")

Auto-detect pattern from the issue:

pub fn detect() -> Self {
 let has_uteke = which::which("uteke").is_ok();
 Self { enabled: has_uteke, namespace: "cora".into() }
}

This pattern works as-is. Uteke CLI is zero-config — first run auto-downloads the embedding model.

Release: https://github.com/codecoradev/uteke/releases/tag/v0.0.13

[ajianaz]

✅ Implemented in PR #256. Memory backend with --memory and --learn flags. Graceful degradation when Uteke not installed. 506 tests, CI green.