api/analytics_precommit BUILTIN_CHECKS drifted from engine — API missing 5 checks incl. SEC005/SEC006 #9873

Summary

api/analytics_precommit.py carries its own copy of the BUILTIN_CHECKS dict that has drifted out of sync with the canonical definitions in the analyzer engine code_intelligence/precommit_analyzer.py. The API copy is a stale subset — it is missing 5 checks the engine defines, including two security checks.

Found during the duplication-elimination sweep (#9794, PR #9865). The CheckDefinition class is already shared (the API imports it from the engine at api/analytics_precommit.py:23); only the data dict is duplicated, and it has diverged. The dedup sweep deliberately did not consolidate it because doing so would change the API's check surface (not behavior-preserving) — this is a product/correctness decision, filed here.

Evidence

Engine (code_intelligence/precommit_analyzer.py) — 19 checks:
SEC001-006, DBG001-004, DOC001-002, QUA001-004, STY001-003

API (api/analytics_precommit.py) — 14 checks, missing:

• SEC005
• SEC006
• DOC002
• QUA004
• STY003

$ comm -3 <(engine IDs) <(api IDs)
DOC002
QUA004
SEC005
SEC006
STY003

Impact

If the /api/.../precommit endpoint is meant to reflect the same checks the engine runs, the API is silently under-reporting — notably two security checks (SEC005/SEC006) are absent from whatever the API surfaces (check catalog / config UI / results). If the subset is intentional, that intent is undocumented and fragile (new engine checks won't propagate).

Recommended fix

Make api/analytics_precommit.py import BUILTIN_CHECKS from code_intelligence/precommit_analyzer.py (the engine is the SSOT; the API already imports CheckDefinition from it). If the API genuinely needs a curated subset, derive it explicitly from the engine dict (e.g. an allow-list of IDs) rather than maintaining a hand-copied dict, and document why. Either way eliminates the ~111 lines of duplicated definitions and prevents future drift.

Verify against code_intelligence/precommit_analyzer_test.py and any API tests for the precommit endpoint.