feat: reputation end-to-end — append then query

[Ipramking]

Summary

• Adds lib/reputation/db.ts — SQLite backend using better-sqlite3 with openDb, appendRow, queryRows
• Adds tests/reputation-e2e.spec.ts — 7 end-to-end tests using an in-memory SQLite database
• Full round trip: redact raw intent → append to SQLite → query rows → build scorecards → assert visible in aggregate

Test plan

• npm test — 7 e2e tests pass
• Round trip: appended row visible in 7-day scorecard
• Anchor isolation: row for anchor-a not visible when querying anchor-b
• Unfilled row reduces fill rate to 0.5
• Row recorded 20 days ago only appears in 30 and 90-day windows
• Idempotent append: same intentHash inserted twice counts as 1 row
• PII fields absent from stored DB row
• Multiple anchors isolated from each other

Closes #224

[vercel]

@Ipramking is attempting to deploy a commit to the ezedikeevan's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Ipramking Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ezedike-evan]

Review — NOT READY TO MERGE (merge conflict + duplicate files)

Thanks for delivering the full e2e stack — the SQLite backend, PII redaction, and round-trip tests are exactly what issue #224 asked for. The implementation is clean and the test isolation (per-anchor, idempotency, window boundaries, PII absence) is comprehensive.

Blocker 1 — Merge conflict

This PR has a merge conflict against main and cannot be merged as-is.

Blocker 2 — Duplicate files from PR #275

This PR includes app/api/reputation/[anchor]/route.ts and lib/reputation/aggregate.ts (and their tests in tests/reputation-aggregate.spec.ts) which are identical to what PR #275 adds. These files will conflict on merge whether #275 goes first or second.

Required fix: Rebase this branch on top of PR #275's branch (or wait for #275 to merge into main, then rebase here). After the rebase, this PR should only carry the net-new files:

• lib/reputation/db.ts
• lib/reputation/redact.ts
• tests/reputation-e2e.spec.ts
• tests/reputation-redact.spec.ts
• package.json / package-lock.json (for better-sqlite3 and @types/better-sqlite3)

The duplicated route.ts, aggregate.ts, and reputation-aggregate.spec.ts should be dropped from this branch entirely.

One additional note — better-sqlite3 as devDependency

better-sqlite3 is correctly placed in devDependencies, which is right for test-only use. However, lib/reputation/db.ts sits under lib/ (a path Next.js will include in the production bundle if anything imports it). Please add a comment at the top of db.ts making clear it must never be imported from production app code (only from tests and server-side scripts), or move it to tests/helpers/ so the boundary is structural rather than documented.

Once the rebase is done and the devDependency note is addressed, this will be ready to merge immediately after #275. Please re-request review.

[ezedike-evan]

Sprint re-review — still blocked.

Duplicate files with #275 (sequencing not resolved).
Both PRs introduce:

• app/api/reputation/[anchor]/route.ts
• lib/reputation/aggregate.ts
• tests/reputation-aggregate.spec.ts

#276 is the intended superset (adds lib/reputation/db.ts, lib/reputation/redact.ts, tests/reputation-e2e.spec.ts, tests/reputation-redact.spec.ts). The correct merge order is #275 first, then this PR — but after #275 merges, you must remove the three duplicate files from this branch's diff (since they'll already be on main) so the diff only contains the net-new db/redact/e2e layer.

Branch is also CONFLICTING against main.

Action items:

• Wait for feat: rolling scorecard query for GET /api/reputation/:anchor #275 to merge (or coordinate with @Ipramking to decide which lands first)
• Rebase on main after feat: rolling scorecard query for GET /api/reputation/:anchor #275 merges; the three shared files should disappear from your diff naturally if they match — resolve any remaining conflicts
• Confirm npm test passes on the rebased branch (the e2e tests depend on aggregate.ts being present)
• Force-push the clean branch

[ezedike-evan]

Reviewed during sprint. The implementation here is clean on its own — but main has since gained a full reputation-aggregate system (computeCorridorAggregate, computeWindowAggregate, groupByCorridor in lib/reputation/aggregate.ts, plus GET /api/reputation/[anchor]) from PRs #364, #365, and #375.

This PR brings a parallel, differently-shaped implementation of the same surface (percentile-based Scorecard/buildScorecards and its own route.ts internals). Merging as-is would leave two competing reputation modules defining the same endpoint and the same conceptual aggregates — an add/add conflict on both aggregate.ts and route.ts that can't be resolved by taking a superset.

This needs a design decision, not a conflict resolution: either (a) rebase onto main and express the percentile/SQLite work as an extension of the existing aggregate.ts API rather than a replacement, or (b) if the percentile approach is preferred, open a focused PR that migrates the existing callers. Happy to merge once it composes with the current reputation surface rather than duplicating it.