feat: add generate-context CLI command with auto-discovery

[joshbouncesecurity]

Summary

Adds openant generate-context [repo-path] as a standalone pipeline step that produces application_context.json. Integrated with the project system (openant init / project switch); defaults its output to the project''s scan directory.

Also wires up auto-discovery of application_context.json in analyze and verify (both Go and Python CLIs) so --app-context is no longer required when the file already exists in the scan directory.

Includes documentation updates for PIPELINE_MANUAL.md, CURRENT_IMPLEMENTATION.md, README.md, and DOCUMENTATION.md.

Addresses item 17 from #16 (does not close the issue). Item 18 (override merge mode) builds on this and will be submitted as a separate PR.

Test plan

• openant generate-context <path> writes application_context.json in the scan directory.
• openant analyze discovers application_context.json automatically when present.
• openant verify discovers application_context.json automatically when present.
• Explicit --app-context <other.json> overrides auto-discovery.
• --show-prompt and --json flags work as documented.
• generate-context errors clearly when no API key is configured.
• tests/test_go_cli.py covers help output and API key validation; auto-discovery covered by added Python test.

[joshbouncesecurity]

Manual verification

Requires ANTHROPIC_API_KEY (or local Claude Code session).

• openant generate-context <repo>: writes application_context.json in the active project's scan dir.
• openant generate-context <repo> --show-prompt: prints the prompt sent to the LLM (no API call).
• openant generate-context <repo> --json: emits machine-readable JSON to stdout.
• After running the above: openant analyze no longer requires --app-context — auto-discovers the JSON in the scan dir.
• openant verify: same auto-discovery behavior.
• openant analyze --app-context <other.json>: explicit flag wins over auto-discovery.
• openant generate-context with no API key configured: clear error message.

[joshbouncesecurity]

Local test results

Built and reinstalled openant-core from this branch, then ran generate-context with a real LLM call against the in-tree sample_python_repo fixture.

Commands run:

go build -o openant.exe ./
pip install -e libs/openant-core
openant generate-context <sample_python_repo> --output <out>/application_context.json

Output:

Gathering context sources from .../sample_python_repo...
Generating context with claude-sonnet-4-20250514...
Context saved to .../application_context.json

Application Context Generated
─────────────────────────────
  Type: web_app
  Purpose: A web application with database functionality and utility functions, ...
  Confidence: 75%
  Source: llm

Generated application_context.json (excerpt):

{
  "application_type": "web_app",
  "intended_behaviors": [
    "Serves HTTP requests through Flask or similar web framework",
    "Performs database operations for data persistence",
    ...
  ],
  "trust_boundaries": {
    "http_request_parameters": "untrusted",
    "http_request_body": "untrusted",
    "http_headers": "untrusted",
    "database_content": "semi_trusted",
    "configuration_files": "trusted"
  },
  "not_a_vulnerability": [...],
  "confidence": 0.75,
  ...
}

Auto-discovery sanity-check (without firing analyze itself, to control cost): cmd/analyze.go and cmd/verify.go both contain

if analyzeAppContext == "" {
    analyzeAppContext = ctx.scanFile("application_context.json")
}

so when the flag is omitted, both commands fall back to the scan-dir copy that generate-context writes.

Outcome:

• generate-context end-to-end succeeded; report sensible (web_app, plausible behaviors, plausible trust-boundary labels, 75% confidence) ✅
• analyze --help shows --app-context is optional; auto-discovery code path verified ✅
• Did not separately run openant analyze end-to-end to confirm runtime auto-discovery on this fixture — would have added another LLM call without changing what's tested. Tracking that with the static check is sufficient.

Reported cost on the run: $0.00 (Sonnet, ~6.6s).