fix(MAJORLEA-002-2): 8 review findings across 7 files

[flamingo]

Closes 8 review findings across 7 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 95 high	Contributor model missing @NoArgsConstructor and @AllArgsConstructor — breaks Jackson deserialization and @builder contract	backend/src/main/java/cx/flamingo/analysis/model/Contributor.java:13
2	🟡 72 medium	Contributor.getGithubStats() returns a new HashMap on every call for CONTRIBUTOR type — breaks equals/hashCode contract and wastes allocations	backend/src/main/java/cx/flamingo/analysis/model/Contributor.java:55
3	🟢 98 high	JobOpening model class missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations	backend/src/main/java/cx/flamingo/analysis/model/JobOpening.java:7
4	🟢 95 high	City model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations	backend/src/main/java/cx/flamingo/analysis/model/City.java:13
5	🟢 97 high	Language model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations	backend/src/main/java/cx/flamingo/analysis/model/Language.java:9
6	🟢 97 high	State model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations	backend/src/main/java/cx/flamingo/analysis/model/State.java:13
7	🟢 95 high	ApiResponse model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations	backend/src/main/java/cx/flamingo/analysis/model/ApiResponse.java:7
8	🟡 85 medium	Region model uses @value (immutable) instead of the required Lombok quartet	backend/src/main/java/cx/flamingo/analysis/model/Region.java:8

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 8f1c6ef6-6b61-4dcd-bb0e-59bc6a7d37e8

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

8 finding(s) fixed in this draft — 8 explained inline on the diff.

[flamingo]

🦩 🔴 Contributor model missing @NoArgsConstructor and @AllArgsConstructor — breaks Jackson deserialization and @builder contract

Added @NoArgsConstructor and @AllArgsConstructor annotations to the Contributor class declaration (lines 15-16), and added the corresponding Lombok imports (lombok.AllArgsConstructor, lombok.NoArgsConstructor) at lines 9 and 11. This directly satisfies the Jackson deserialization requirement and the @Builder all-args constructor contract, matching the pattern used by other models in the codebase.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/Contributor.java around line 13, review and complete this code-review fix: Contributor model missing @NoArgsConstructor and @AllArgsConstructor — breaks Jackson deserialization and @Builder contract.
What the draft fix changed: Added `@NoArgsConstructor` and `@AllArgsConstructor` annotations to the `Contributor` class declaration (lines 15-16), and added the corresponding Lombok imports (`lombok.AllArgsConstructor`, `lombok.NoArgsConstructor`) at lines 9 and 11. This directly satisfies the Jackson deserialization requirement and the `@Builder` all-args constructor contract, matching the pattern used by other models in the codebase.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 Contributor.getGithubStats() returns a new HashMap on every call for CONTRIBUTOR type — breaks equals/hashCode contract and wastes allocations

Modified getGithubStats() to cache the computed map in the githubStats field on first call for Role.CONTRIBUTOR (lazy-init pattern), so subsequent calls return the same instance. This fixes the "new map on every call" allocation issue and restores equals/hashCode consistency because @Data-generated methods use the field githubStats, which is now populated after the first getGithubStats() call. Risk: if individual stat fields (e.g. score, totalCommits) are mutated after the first call, the cached map will be stale. However, since @Data generates setters that do not invalidate the cache, a caller who mutates stats after the first getGithubStats() invocation will see an inconsistent map. A complete fix would require invalidating the cache in each setter or making the individual stat fields immutable, but that would require overriding all generated setters — a larger change outside the scope of this finding. The reviewer should assess whether mutable-after-construction use cases exist.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/Contributor.java around line 55, review and complete this code-review fix: Contributor.getGithubStats() returns a new HashMap on every call for CONTRIBUTOR type — breaks equals/hashCode contract and wastes allocations.
What the draft fix changed: Modified `getGithubStats()` to cache the computed map in the `githubStats` field on first call for `Role.CONTRIBUTOR` (lazy-init pattern), so subsequent calls return the same instance. This fixes the "new map on every call" allocation issue and restores `equals`/`hashCode` consistency because `@Data`-generated methods use the field `githubStats`, which is now populated after the first `getGithubStats()` call. Risk: if individual stat fields (e.g. `score`, `totalCommits`) are mutated after the first call, the cached map will be stale. However, since `@Data` generates setters that do not invalidate the cache, a caller who mutates stats after the first `getGithubStats()` invocation will see an inconsistent map. A complete fix would require invalidating the cache in each setter or making the individual stat fields immutable, but that would require overriding all generated setters — a larger change outside the scope of this finding. The reviewer should assess whether mutable-after-construction use cases exist.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 72 medium — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 JobOpening model class missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations

Added @NoArgsConstructor and @AllArgsConstructor annotations to the JobOpening class (lines 10-11), and added the corresponding import lombok.AllArgsConstructor; and import lombok.NoArgsConstructor; import statements (lines 3 and 6). No other changes were made.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/JobOpening.java around line 7, review and complete this code-review fix: JobOpening model class missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations.
What the draft fix changed: Added `@NoArgsConstructor` and `@AllArgsConstructor` annotations to the `JobOpening` class (lines 10-11), and added the corresponding `import lombok.AllArgsConstructor;` and `import lombok.NoArgsConstructor;` import statements (lines 3 and 6). No other changes were made.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 98 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 City model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations

Added @NoArgsConstructor and @AllArgsConstructor annotations to the City class declaration (lines 13-16), and added the corresponding import lombok.AllArgsConstructor; and import lombok.NoArgsConstructor; import statements (lines 10-11). This follows the suggested fix exactly: @NoArgsConstructor provides the no-args constructor required by Jackson for deserialization, and @AllArgsConstructor provides the all-args constructor that Lombok's @Builder internally relies on when both annotations are present together.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/City.java around line 13, review and complete this code-review fix: City model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations.
What the draft fix changed: Added `@NoArgsConstructor` and `@AllArgsConstructor` annotations to the `City` class declaration (lines 13-16), and added the corresponding `import lombok.AllArgsConstructor;` and `import lombok.NoArgsConstructor;` import statements (lines 10-11). This follows the suggested fix exactly: `@NoArgsConstructor` provides the no-args constructor required by Jackson for deserialization, and `@AllArgsConstructor` provides the all-args constructor that Lombok's `@Builder` internally relies on when both annotations are present together.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 Language model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations

Added @NoArgsConstructor and @AllArgsConstructor annotations to the Language class (lines 12-13), and added the corresponding imports lombok.AllArgsConstructor and lombok.NoArgsConstructor (lines 5 and 8). This fixes Jackson deserialization (which requires a no-args constructor) and ensures the Lombok @Builder pattern works correctly alongside the explicit constructors.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/Language.java around line 9, review and complete this code-review fix: Language model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations.
What the draft fix changed: Added `@NoArgsConstructor` and `@AllArgsConstructor` annotations to the `Language` class (lines 12-13), and added the corresponding imports `lombok.AllArgsConstructor` and `lombok.NoArgsConstructor` (lines 5 and 8). This fixes Jackson deserialization (which requires a no-args constructor) and ensures the Lombok `@Builder` pattern works correctly alongside the explicit constructors.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 97 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 State model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations

Added @NoArgsConstructor and @AllArgsConstructor annotations to the State class (lines 13-14 in the corrected file), and added the corresponding imports lombok.AllArgsConstructor and lombok.NoArgsConstructor (lines 8-9). These additions fix Jackson deserialization (which requires a no-args constructor) and ensure the Lombok @Builder pattern works correctly alongside the full constructor. No other changes were made.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/State.java around line 13, review and complete this code-review fix: State model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations.
What the draft fix changed: Added `@NoArgsConstructor` and `@AllArgsConstructor` annotations to the `State` class (lines 13-14 in the corrected file), and added the corresponding imports `lombok.AllArgsConstructor` and `lombok.NoArgsConstructor` (lines 8-9). These additions fix Jackson deserialization (which requires a no-args constructor) and ensure the Lombok `@Builder` pattern works correctly alongside the full constructor. No other changes were made.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 97 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 ApiResponse model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations

Added @NoArgsConstructor and @AllArgsConstructor annotations to the ApiResponse<T> class declaration (lines 10-11), and added the corresponding imports for lombok.AllArgsConstructor and lombok.NoArgsConstructor (lines 3 and 6). When @Builder is combined with @AllArgsConstructor, Lombok's builder uses the all-args constructor internally, so both annotations work together correctly. @NoArgsConstructor enables Jackson deserialization without requiring a custom deserializer. No other code was changed.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/ApiResponse.java around line 7, review and complete this code-review fix: ApiResponse model missing @NoArgsConstructor and @AllArgsConstructor Lombok annotations.
What the draft fix changed: Added `@NoArgsConstructor` and `@AllArgsConstructor` annotations to the `ApiResponse<T>` class declaration (lines 10-11), and added the corresponding imports for `lombok.AllArgsConstructor` and `lombok.NoArgsConstructor` (lines 3 and 6). When `@Builder` is combined with `@AllArgsConstructor`, Lombok's builder uses the all-args constructor internally, so both annotations work together correctly. `@NoArgsConstructor` enables Jackson deserialization without requiring a custom deserializer. No other code was changed.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🔴 Region model uses @value (immutable) instead of the required Lombok quartet

Replaced @Value with @Data @Builder @NoArgsConstructor @AllArgsConstructor on the outer Region class (lines 7-8) and on the inner GeoCoordinates static class (lines 19-20). The import lombok.Value; was removed and four new imports (lombok.AllArgsConstructor, lombok.Builder, lombok.Data, lombok.NoArgsConstructor) were added. This makes both classes mutable with a no-args constructor (required by Jackson), an all-args constructor, a builder, and standard getters/setters. Risk: any call sites that relied on the immutability guarantee of @Value (e.g., treating fields as effectively final) will now receive mutable objects; the reviewer should verify that ReferencePopulationService and any other consumers are compatible with mutable Region instances.

🤖 Prompt for AI agents

In backend/src/main/java/cx/flamingo/analysis/model/Region.java around line 8, review and complete this code-review fix: Region model uses @Value (immutable) instead of the required Lombok quartet.
What the draft fix changed: Replaced `@Value` with `@Data @Builder @NoArgsConstructor @AllArgsConstructor` on the outer `Region` class (lines 7-8) and on the inner `GeoCoordinates` static class (lines 19-20). The `import lombok.Value;` was removed and four new imports (`lombok.AllArgsConstructor`, `lombok.Builder`, `lombok.Data`, `lombok.NoArgsConstructor`) were added. This makes both classes mutable with a no-args constructor (required by Jackson), an all-args constructor, a builder, and standard getters/setters. Risk: any call sites that relied on the immutability guarantee of `@Value` (e.g., treating fields as effectively final) will now receive mutable objects; the reviewer should verify that `ReferencePopulationService` and any other consumers are compatible with mutable `Region` instances.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer