[rchildress87]

What this changes

This PR works through the follow-ups that PR #21 (sdkinv-provider-neutral) left outside its scope. Each phase was reviewed adversarially and committed on its own.

Phase 1: store correctness (deb3012f)

• Postgres bug. ListScans, LatestCompleteScan, LatestIncompleteScan and ListCheckRuns ordered by rowid, which Postgres does not have, so they failed there with 42703. They now use newestFirst(): started_at DESC, then rowid on SQLite (so latest stays the row created last) and id on Postgres.
• Second Postgres bug. PersistCheckRun sent an unrebound ? placeholder to Postgres (42601).
• Test coverage. Both bugs are covered by withDialects tests that run against Postgres.
• --scan-id. It now matches discovered_by OR verified_by, so a scan that only re-verified rows lists them, and the listing agrees with scans.resource_count. All mentions of the old --scan-as are gone.
• Checkpoints removed. The dead checkpoint API is deleted and migration 020 drops scan_checkpoints on both dialects. The --resume help text now describes what resume actually does.
• Flaky test fixed. TestGraphBlast_PrincipalAutoFallback failed because pflag's Changed state leaked between tests.

Phase 2: help text (2daf1994)

• Help text and the README's jq examples used snake_case JSON keys left over from before the v0.18.0 camelCase migration. They now use the real keys.
• Also fixed: a few stale comments, and the plural in "1 SDK extractor warnings".

Phase 3: inventory correctness (4d101f4b)

• Azure module keys. Azure modules are now keyed <rp>/<armX>. resources/ and solutions/ both ship armmanagedapplications, and with basename keys one module's ops overwrote the other's.
• New optional interface. LabelModuler maps a module key back to its label prefix.
• GCP scope match. The query-parameter scope match now compares sdkinv.Ident stems.
• Azure paged union. It now has a fixture test.

Phase 4: provider neutrality (4329a0c1)

• Scaffold stub. Each provider now supplies its own disco-scaffold stub scanner through coverage.ScaffoldStubber, so cmd no longer keeps a per-provider signature table.
• AWS absent-model warning. AWS now warns for a linked aws-sdk-go-v2/service/* module that has no model at the pinned ref (absentModels), like Azure's absentModules.

Phase 5: spike, measured and deferred (3b16282f)

• Azure x-ms-arm-id refs would add 127 refs within the walk depth, on 2.6% of resource candidates.
• The cost is a 64–214 MB source plus picking the API version per module.
• The numbers and the decision are recorded in azureinventory/CLAUDE.md.

Final: CLAUDE.md pass (cad70519, a7a1360f)

• Wrong facts fixed. Every claim was checked against the code. For example:
  • Placeholders do carry reference_only.
  • CI does not run check-migrations.
  • The EventBridge Rego path is Rule, not rule.
• Code comments. Two wrong comments in pairing.go and store/dialect.go are corrected.
• Duplication. Each repeated fact now lives in one owning file, with pointers from the others.
• AWS guide. internal/providers/aws/CLAUDE.md is regrouped under seven parent headings. Every original body line is kept except one cross-reference, which now names its target section.
• Release notes. The release-pipeline explanation moved to docs/release.md; the root keeps the rules that must not break.

Checklist

• Branched from main and targeting main
• CGO_ENABLED=0 go test ./... passes (full run with -tags grpcnotrace; Postgres subtests ran via docker, not skipped)
• go vet ./... and golangci-lint run are clean (golangci-lint: 0 issues)
• Formatting: golangci-lint fmt --diff is empty (the linter formats with gofumpt + goimports; see the root CLAUDE.md change)
• make check-migrations passes (migration 020 added on both dialects)
• No new scanners or resolvers
• No CGO dependency introduced

Notes for reviewers

• Migration 020 drops scan_checkpoints. Nothing ever wrote to it. disco-saas guards the table with to_regclass, so it needs no change.
• Postgres tie order. On a same-second tie, Postgres orders by the random hex id. That order is deterministic but is not creation order. Scan ids stay random on purpose: users paste 8-character prefixes, and time-ordered ids (UUIDv7) would make scans from the same ~65 seconds share a prefix.
• Not done, found during the audit:
  • When a scanner re-verifies a row identical to a placeholder, the update path never clears reference_only. This is unlikely and untested; it is recorded in store/CLAUDE.md.
  • Adding make check-migrations to CI is a separate decision.
• Not committed: .claude/rules/testing.instructions.md was corrected locally, but .claude/ is gitignored, so that fix is not in this PR.

🤖 Generated with Claude Code