refactor(inventory): stream repository aggregation

DOCUMENTATION.md

@@ -16,7 +16,6 @@ AppGuardrail has extensive rule, scanner, report, release, issue, and scheduler
 | Architecture decisions | [`docs/adr/README.md`](docs/adr/README.md) |
 | Security reporting | [`SECURITY.md`](SECURITY.md) |
 | Release automation | [`docs/release-automation.md`](docs/release-automation.md) |
-| GitHub workflow lifecycle detection | [`docs/workflow-lifecycle-detection.md`](docs/workflow-lifecycle-detection.md) |
 | Productization roadmap | [`docs/product/2026-07-02-2b-krw-sale-readiness-plan.md`](docs/product/2026-07-02-2b-krw-sale-readiness-plan.md) |
 | Agent development rules | [`AGENTS.md`](AGENTS.md) |
 | Agent context | [`CLAUDE.md`](CLAUDE.md) |
@@ -31,4 +30,4 @@ AppGuardrail has extensive rule, scanner, report, release, issue, and scheduler
 - **external-engine** — capability delegated to an optional scanner such as Semgrep/Trivy/Bandit/ZAP rather than AppGuardrail's lightweight built-in matcher.
 - **evidence-only** — information visible in reports/history but not yet executable as an AppGuardrail detector.
 
-Critical current distinction: PR #911's no-exclusions issue-to-detector registry and executable obligation coverage remain **active-PR**, not protected-branch behavior. Stored-webhook SSRF prevention from PR #924 and bounded built-in detection from PR #910 are **implemented-main** as separate controls; the packaged rule covers its tested Python `set_webhook` persistence patterns and is not a universal SSRF taint-analysis claim.
+Critical current distinction: PR #911's no-exclusions issue-to-detector registry and executable obligation coverage remain **active-PR**, not protected-branch behavior. Stored-webhook SSRF prevention from PR #924 and bounded built-in detection from PR #910 are **implemented-main** as separate controls; the packaged rule covers its tested Python `set_webhook` persistence patterns and is not a universal SSRF taint-analysis claim.

appguardrail_core/org_intelligence.py

@@ -122,35 +122,45 @@ def build_org_inventory(
     active_repository_target: int = 20,
 ) -> OrgInventory:
     """Build a stable organization inventory from GitHub repo JSON."""
-    repo_list = list(repos)
-    nonforks = [repo for repo in repo_list if not _truthy(repo.get("isFork"))]
-    forks = [repo for repo in repo_list if _truthy(repo.get("isFork"))]
-    primary_languages = Counter(_primary_language(repo) for repo in repo_list)
-    default_branches = Counter(_default_branch(repo) for repo in repo_list)
-    unsupported = sorted(
-        {
-            _primary_language(repo)
-            for repo in nonforks
-            if _primary_language(repo) not in SUPPORTED_PRIMARY_LANGUAGES
-            and _primary_language(repo) != "Unknown"
-        }
-    )
-    supported_nonforks = sum(
-        1 for repo in nonforks if _primary_language(repo) in SUPPORTED_PRIMARY_LANGUAGES
-    )
+    total_repositories = 0
+    nonfork_repositories = 0
+    fork_repositories = 0
+    primary_languages = Counter()
+    default_branches = Counter()
+    unsupported_set = set()
+    supported_nonforks = 0
+    private_repositories = 0
+
+    for repo in repos:
+        total_repositories += 1
+        lang = _primary_language(repo)
+        is_fork = _truthy(repo.get("isFork"))
+        if is_fork:
+            fork_repositories += 1
+        else:
+            nonfork_repositories += 1
+            if lang in SUPPORTED_PRIMARY_LANGUAGES:
+                supported_nonforks += 1
+            elif lang != "Unknown":
+                unsupported_set.add(lang)
+
+        if _truthy(repo.get("isPrivate")):
+            private_repositories += 1
+        primary_languages[lang] += 1
+        default_branches[_default_branch(repo)] += 1
+
+    unsupported = sorted(unsupported_set)
     return OrgInventory(
-        total_repositories=len(repo_list),
-        nonfork_repositories=len(nonforks),
-        fork_repositories=len(forks),
-        private_repositories=sum(
-            1 for repo in repo_list if _truthy(repo.get("isPrivate"))
-        ),
+        total_repositories=total_repositories,
+        nonfork_repositories=nonfork_repositories,
+        fork_repositories=fork_repositories,
+        private_repositories=private_repositories,
         supported_nonfork_repositories=supported_nonforks,
         unsupported_nonfork_languages=tuple(unsupported),
         primary_language_counts=_sorted_counts(primary_languages),
         default_branch_counts=_sorted_counts(default_branches),
         active_repository_target=active_repository_target,
-        active_repository_target_met=len(nonforks) >= active_repository_target,
+        active_repository_target_met=nonfork_repositories >= active_repository_target,
     )