Fix runtime config database risk calibration

Author: kunaldhongade

docs/scoring.md

@@ -22,6 +22,10 @@ changes, lockfile-only changes, and package metadata-only changes stay low
 unless they are paired with source, dependency, runtime config, or structural
 changes.
 
+Runtime config plus database/schema changes receive a small structural lift.
+That combination is treated as production-sensitive because it can change
+deployment defaults and persisted behavior in the same PR.
+
 ## Decay Score
 
 Decay score estimates whether the PR makes the codebase harder to maintain.

packages/core/src/index.ts

@@ -357,6 +357,17 @@ function calculateScoreBreakdown(
     });
   }
 
+  const runtimePersistenceScore = scoreKind === "merge" ? runtimePersistenceBoundaryScore(contributors) : 0;
+  if (runtimePersistenceScore > 0) {
+    contributors.push({
+      id: "runtime-persistence-boundary",
+      label: "Runtime config plus persistence boundary",
+      points: runtimePersistenceScore,
+      evidence: "structural",
+      reason: "Runtime configuration and database/schema behavior changed together, which increases production regression risk."
+    });
+  }
+
   const rawScore = clampScore(contributors.reduce((score, contributor) => score + contributor.points, 0));
   const dampeners: ScoreContributor[] = [];
   let adjustedScore = rawScore;
@@ -413,6 +424,14 @@ function createFindingContributor(finding: Finding): ScoreContributor {
   };
 }
 
+function runtimePersistenceBoundaryScore(contributors: ScoreContributor[]): number {
+  const hasDatabaseChange = contributors.some((contributor) => contributor.ruleId === "risky-database-change");
+  const hasConfigChange = contributors.some((contributor) => contributor.ruleId === "risky-config-change");
+  const hasHighSeveritySignal = contributors.some((contributor) => contributor.severity === "high");
+
+  return hasDatabaseChange && hasConfigChange && hasHighSeveritySignal ? 8 : 0;
+}
+
 function scoreEvidenceForFinding(finding: Finding): ScoreEvidenceKind {
   if ([...DIRECT_FINDING_RULE_IDS].some((ruleId) => finding.ruleId === ruleId || finding.ruleId.startsWith(`${ruleId}-`))) {
     return "direct";

packages/core/test/core.test.ts

@@ -214,6 +214,67 @@ describe("createAnalysisReport", () => {
     expect(shouldFailForRisk(report.summary.riskLevel, "high")).toBe(true);
   });
 
+  it("treats runtime config and database changes together as high production risk", () => {
+    const report = createAnalysisReport({
+      changedFiles: [
+        {
+          path: "next.config.js",
+          status: "modified",
+          additions: 8,
+          deletions: 6,
+          addedLines: [{ line: 2, content: "const sessionSecret = env.SESSION_SECRET ?? 'dev-secret';" }]
+        },
+        {
+          path: "src/db/schema.js",
+          status: "modified",
+          additions: 4,
+          deletions: 1,
+          addedLines: [{ line: 2, content: '  role: "admin",' }]
+        }
+      ],
+      analyzerResult: {
+        impactedAreas: [],
+        findings: [
+          {
+            ruleId: "risky-config-change",
+            title: "Config area changed",
+            description: "Runtime config changed.",
+            severity: "medium",
+            category: "configuration",
+            file: "next.config.js",
+            line: 2
+          },
+          {
+            ruleId: "risky-database-change",
+            title: "Database area changed",
+            description: "Database defaults changed.",
+            severity: "high",
+            category: "regression",
+            file: "src/db/schema.js",
+            line: 2
+          },
+          {
+            ruleId: "missing-nearby-tests",
+            title: "Risky source changes without changed tests",
+            description: "Risky source changed without changed tests.",
+            severity: "high",
+            category: "coverage",
+            file: "next.config.js",
+            line: 2
+          }
+        ],
+        recommendedTests: []
+      },
+      generatedAt: "2026-06-22T00:00:00.000Z"
+    });
+
+    expect(report.summary.mergeRiskScore).toBeGreaterThanOrEqual(70);
+    expect(report.summary.riskLevel).toBe("high");
+    expect(report.summary.mergeRiskBreakdown?.contributors).toEqual(
+      expect.arrayContaining([expect.objectContaining({ id: "runtime-persistence-boundary", points: 8 })])
+    );
+  });
+
   it("caps heuristic-only merge risk below high even with severe findings", () => {
     const changedFiles = createSyntheticChanges(6);
     const findings = createSyntheticFindings(4, "high", "snapshot-only-test", "coverage");