fix: honour MEDCHECK_LLM_PROVIDER, validate LLM findings, correct model IDs

[Liohtml]

Three correctness bugs from the repo-health sweep (#68, #71, #73), plus the doc half of #69.

Closes

• Closes [repo-health] Medium: MEDCHECK_LLM_PROVIDER env var silently ignored — operators get wrong default LLM provider #73 — MEDCHECK_LLM_PROVIDER silently ignored
• Closes [repo-health] Medium: StructureFinding(**s) deserializes raw LLM JSON with no field-level validation #71 — StructureFinding(**s) deserializes raw LLM JSON with no validation
• Closes [repo-health] Low: claude.py hardcodes invalid model ID 'claude-opus-4-7' — API calls will fail at runtime #68 — claude.py hardcodes invalid model ID claude-opus-4-7
• Closes [repo-health] Low: Broken links in README.md — SECURITY.md anchor and model table #69 — broken/outdated model references in README & docs

Changes

#73 — honour the configured LLM provider

analyze only read Settings() for the consent flag; ctx.llm_provider was set straight from the --model flag (default None), so VisionAnalysisStep fell back to the offline local provider — which raises NotImplementedError. Now: ctx.llm_provider = model or settings.default_llm_provider.

#71 — defensive LLM finding deserialization

parse_llm_response previously did StructureFinding(**s) on raw LLM JSON — an unexpected key crashed the pipeline, and fabricated/hallucinated entries rendered verbatim with high confidence. New _coerce_structure_finding() accepts only known fields, coerces types, clamps confidence to [0, 1], drops empty entries, and tolerates a non-list structures. (StructureFinding is a dataclass, not Pydantic, so a focused coercer is lighter than converting the model and rippling through report.py.)

#68 / #69 — model IDs

Default Claude model corrected claude-opus-4-7 → claude-opus-4-8, and all three providers now read MEDCHECK_{CLAUDE,OPENAI,GEMINI}_MODEL so IDs aren't hardcoded. Updated every 4.7 reference across README, docs/models.md, docs/workflows.md, and the web UI dropdown. (The SECURITY.md anchor flagged in #69 already resolves correctly since PR #47 added that heading.)

Validation

• ruff ✅ · ruff format ✅ · mypy ✅
• 130 tests pass (+8: confidence clamp / type coercion / non-JSON fallback, model-ID defaults + env override, CLI provider-default flow)

Note: development is constrained to the claude/repo-issues-features-3ZLdb branch.

https://claude.ai/code/session_01KYcUxCGAHaTPrRHTzJCWQz

---

Generated by Claude Code

Summary by CodeRabbit

• Changed

  • Default Claude model updated to Opus 4.8 for improved performance
  • Environment variables now supported for overriding LLM model selections (MEDCHECK_CLAUDE_MODEL, MEDCHECK_OPENAI_MODEL, MEDCHECK_GEMINI_MODEL)

• Fixed

  • LLM provider configuration now properly honored in the analyze command
  • Malformed LLM findings are now validated and confidence scores correctly constrained to valid ranges

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a8456fc-bfd3-441a-a195-35161df9ebd6

📥 Commits

Reviewing files that changed from the base of the PR and between 7c54024 and ce59305.

📒 Files selected for processing (13)

• CHANGELOG.md
• README.md
• docs/models.md
• docs/workflows.md
• src/medcheck/llm/base.py
• src/medcheck/llm/claude.py
• src/medcheck/llm/gemini.py
• src/medcheck/llm/openai_provider.py
• src/medcheck/main.py
• src/medcheck/web/templates/index.html
• tests/unit/test_cli.py
• tests/unit/test_llm/test_base.py
• tests/unit/test_llm/test_providers.py

 _____________________________________________________________
< Return early? Yes. Return *something meaningful*? Also yes. >
 -------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/repo-issues-features-3ZLdb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

❌ Patch coverage is 87.87879% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/medcheck/llm/base.py	83.33%	3 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!