feat(ai-review 對話收斂與誤報裁決): 對話一律關閉並三分類，誤報改由防守方角色平行 sub-agent 裁決

app/findings.js

@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
 import { chatJSON } from './llm.js';
-import { buildAnalysisPrompt } from './roles.js';
+import { buildAnalysisPrompt, loadRole, buildVerdictPrompt } from './roles.js';
 import { FINDINGS_PATH, EXCLUSIONS_PATH } from './config.js';
 import { line, ok, warn } from './log.js';
 
@@ -320,6 +320,50 @@ export function loadExclusions(workspace, repoState = null, mirrorWorkspace = nu
   return exclusions;
 }
 
+/**
+ * 把新的排除條目（raw 形式）append 到 exclusions.json，去重後以頂層陣列寫回 workspace 與 mirror。
+ * 去重以「檔案路徑 + 正規化原文」為準。回傳合併後的 raw 陣列（無新增時回傳既有陣列）。
+ */
+export function appendExclusions(workspace, newEntries, mirrorWorkspace = null) {
+  if (!newEntries || newEntries.length === 0) return null;
+  const fileOf = loc => String(loc || '').split(':')[0].trim();
+  const sigOf = e => `${fileOf(e.location)}|${normalizeText(e.original_finding || e.suggestion || e.text || e.title || '')}`;
+
+  const fullPath = path.join(workspace, EXCLUSIONS_PATH);
+  let existing = [];
+  if (fs.existsSync(fullPath)) {
+    try {
+      existing = normalizeExclusions(JSON.parse(fs.readFileSync(fullPath, 'utf8')));
+    } catch (e) {
+      warn(`讀取排除問題以追加失敗，視為空: ${e.message}`);
+      existing = [];
+    }
+  }
+
+  const seen = new Set(existing.map(sigOf));
+  const additions = newEntries.filter(e => {
+    const sig = sigOf(e);
+    if (seen.has(sig)) return false;
+    seen.add(sig);
+    return true;
+  });
+  if (additions.length === 0) {
+    line(`誤報排除無新增（皆已存在）: 候選 ${newEntries.length} 筆`);
+    return existing;
+  }
+
+  const merged = [...existing, ...additions];
+  const targets = [workspace];
+  if (mirrorWorkspace && path.resolve(mirrorWorkspace) !== path.resolve(workspace)) targets.push(mirrorWorkspace);
+  for (const dir of targets) {
+    const target = path.join(dir, EXCLUSIONS_PATH);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    writeCanonicalExclusions(target, merged);
+  }
+  ok(`誤報寫入 exclusions: 新增 ${additions.length} 筆（總計 ${merged.length} 筆）`);
+  return merged;
+}
+
 /**
  * 套用排除規則，過濾掉符合排除條件的 findings
  * location 只比對檔案路徑（忽略行數），suggestion 省略時視為萬用
@@ -341,28 +385,36 @@ export function applyExclusions(findings, exclusions) {
   return filtered;
 }
 
+/** 派一個「防守方」sub-agent 裁決單一 finding 是否為誤報；任何失敗都保守視為成立（保留）。 */
+async function judgeFindingIsFalsePositive(finding, defender, exclusionHint, chatFn) {
+  const systemPrompt = buildVerdictPrompt(defender, exclusionHint);
+  try {
+    const result = await chatFn(systemPrompt, JSON.stringify(toAIPayload([finding])[0]));
+    return result?.verdict === 'false_positive';
+  } catch (e) {
+    warn(`誤報裁決失敗（保守視為成立）: ${finding.location} error=${e.message}`);
+    return false;
+  }
+}
+
 /**
- * 呼叫 AI 判斷哪些問題是誤報或不需處理，失敗時降級回傳原始 findings
+ * 由「防守方」角色（Paladin）逐條裁決 findings 是否為誤報，剔除誤報、保留成立者。
+ * 多個問題時各派一個 sub-agent 平行裁決；任一裁決失敗保守保留該問題，不中斷流程。
  */
 export async function filterFalsePositivesWithAI(findings, exclusions = [], chatFn = chatJSON) {
   if (findings.length === 0) return findings;
 
+  const defender = loadRole('Paladin');
   const exclusionContext = buildExclusionContext(exclusions);
   const exclusionHint = exclusionContext.prompt
-    ? `\n${exclusionContext.prompt}\n規則：若 finding 與上述任何一類的路徑、角色或描述高度相似，優先視為誤報或不適用。`
+    ? `${exclusionContext.prompt}\n規則：若此 finding 與上述任何一類的路徑、角色或描述高度相似，優先視為誤報或不適用。`
     : '';
 
-  const systemPrompt = `你是 🛡️ Paladin（聖騎士），公正的裁判。逐條審視攻擊方的指控，剔除誤報或不適用者（例如：已正確使用 secrets、CI/CD 必要權限、他處已妥善處理、語義其實正確）。不冤枉無辜的程式碼，也不放水。移除誤報後，只回傳需保留（成立）的 JSON 陣列，不要有其他文字。${exclusionHint}`;
-
-  try {
-    const result = await chatFn(systemPrompt, JSON.stringify(toAIPayload(findings)));
-    if (Array.isArray(result) && result.length > 0) {
-      ok(`AI 誤報過濾: ${findings.length} -> ${result.length} 筆`);
-      const origMap = new Map(findings.map(f => [`${f.location}|${String(f.suggestion).slice(0, 50)}`, f]));
-      return result.map(r => origMap.get(`${r.location}|${String(r.suggestion).slice(0, 50)}`) ?? r);
-    }
-    throw new Error('AI 回傳空陣列或非陣列');
-  } catch (e) {
-    return fallback('AI 誤報過濾', findings, e);
-  }
+  // 每條 finding 各派一個防守方 sub-agent 裁決，多條時平行處理
+  const verdicts = await Promise.all(
+    findings.map(f => judgeFindingIsFalsePositive(f, defender, exclusionHint, chatFn).then(isFP => ({ f, isFP }))),
+  );
+  const kept = verdicts.filter(v => !v.isFP).map(v => v.f);
+  ok(`AI 誤報過濾（防守方${findings.length > 1 ? '平行' : ''}裁決）: ${findings.length} -> ${kept.length} 筆`);
+  return kept;
 }