{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a2bb18a3332a607", "name": "Insecure pattern 'weak_hash' in docs/DECODER-SUPPORT-MATRIX.toml:99", "shortDescription": {"text": "Insecure pattern 'weak_hash' in docs/DECODER-SUPPORT-MATRIX.toml:99"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bdebffa6a358e73", "name": "Insecure pattern 'weak_hash' in docs/LOCAL-REFERENCE-EVIDENCE.toml:71", "shortDescription": {"text": "Insecure pattern 'weak_hash' in docs/LOCAL-REFERENCE-EVIDENCE.toml:71"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb202430b717a2d7", "name": "Insecure pattern 'weak_hash' in docs/IMPLEMENTATION-MATRIX.toml:2578", "shortDescription": {"text": "Insecure pattern 'weak_hash' in docs/IMPLEMENTATION-MATRIX.toml:2578"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60a59a605b773b17", "name": "Insecure pattern 'weak_hash' in xtask/src/decoder_conformance_coverage.rs:300", "shortDescription": {"text": "Insecure pattern 'weak_hash' in xtask/src/decoder_conformance_coverage.rs:300"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-063997d8d14f8d5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-888be1959eb32204", "name": "Very large file: xtask/src/concurrency_policy.rs (1541 lines)", "shortDescription": {"text": "Very large file: xtask/src/concurrency_policy.rs (1541 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f21d663ece82b07", "name": "Very large file: xtask/src/feature_status.rs (1741 lines)", "shortDescription": {"text": "Very large file: xtask/src/feature_status.rs (1741 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44de9184d2d16b74", "name": "Very large file: xtask/src/main.rs (1447 lines)", "shortDescription": {"text": "Very large file: xtask/src/main.rs (1447 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10ade38d7132ea09", "name": "Very large file: xtask/src/audit_scope.rs (2475 lines)", "shortDescription": {"text": "Very large file: xtask/src/audit_scope.rs (2475 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1dfa67b12dd64356", "name": "Very large file: crates/splot-validate/src/frame_unit.rs (1490 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/frame_unit.rs (1490 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8598a95c2f8f306d", "name": "Very large file: crates/splot-validate/src/celu.rs (3693 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/celu.rs (3693 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adb65dfca3bb3664", "name": "Very large file: crates/splot-validate/src/validator/tests/reference_state.rs (1330 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/validator/tests/reference_state.rs (1330 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d9373df64fcb529", "name": "Very large file: crates/splot-validate/src/context/mod.rs (819 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/context/mod.rs (819 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9cf7f109294d52b", "name": "Very large file: crates/splot-validate/src/context/cmvs.rs (866 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/context/cmvs.rs (866 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c973f231ef1144d1", "name": "Very large file: crates/splot-validate/src/context/sequence.rs (877 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/context/sequence.rs (877 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b156ce7481e69889", "name": "Very large file: crates/splot-validate/src/checks/mod.rs (1978 lines)", "shortDescription": {"text": "Very large file: crates/splot-validate/src/checks/mod.rs (1978 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90a7b7c5c05d57e6", "name": "Very large file: crates/splot-core/src/obu.rs (1162 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/obu.rs (1162 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5c9f5fd6367ec19", "name": "Very large file: crates/splot-core/src/write/seq_config_tests.rs (1400 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/write/seq_config_tests.rs (1400 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d84e4c74c9c57ad", "name": "Very large file: crates/splot-core/src/write/seq_header.rs (1612 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/write/seq_header.rs (1612 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f09596f96da4571", "name": "Very large file: crates/splot-core/src/headers/tile_group.rs (1516 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/tile_group.rs (1516 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7a8c93444b76a8a", "name": "Very large file: crates/splot-core/src/headers/metadata.rs (1535 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/metadata.rs (1535 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b58a35edf7886b62", "name": "Very large file: crates/splot-core/src/headers/sequence.rs (3328 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/sequence.rs (3328 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbb5378736507310", "name": "Very large file: crates/splot-core/src/headers/frame/restoration.rs (1253 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/frame/restoration.rs (1253 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca2ba3898434c9d0", "name": "Very large file: crates/splot-core/src/headers/frame/global_motion.rs (1122 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/frame/global_motion.rs (1122 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee37f18737ba54a3", "name": "Very large file: crates/splot-core/src/headers/frame/filtering.rs (1233 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/frame/filtering.rs (1233 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a5b64266b33f5e7", "name": "Very large file: crates/splot-core/src/headers/frame/quant.rs (1658 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/frame/quant.rs (1658 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-999b4e8781cc32ef", "name": "Very large file: crates/splot-core/src/headers/frame/info.rs (4620 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/frame/info.rs (4620 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e767cefae3a33ee5", "name": "Very large file: crates/splot-core/src/headers/frame/inter.rs (1483 lines)", "shortDescription": {"text": "Very large file: crates/splot-core/src/headers/frame/inter.rs (1483 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fea8be302da18d5b", "name": "Very large file: crates/splot-cli/src/commands/inspect.rs (1929 lines)", "shortDescription": {"text": "Very large file: crates/splot-cli/src/commands/inspect.rs (1929 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 14 placeholder/mock markers across 6 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbb5857940ba0dc2", "name": "Agent instruction/config may expose a secret: AGENTS.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c10344bdf57df51", "name": "Agent authority lacks a verifier contract: .claude/commands/opsx/sync.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/sync.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df8d7aecf447de62", "name": "Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-021b572fe2fa6b9c", "name": "Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14b94de34d897ad4", "name": "Agent authority lacks a verifier contract: .claude/skills/openspec-apply-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-apply-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a585f74bb40a5f1", "name": "Agent authority lacks a verifier contract: .claude/skills/openspec-archive-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-archive-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1861f29946301e43", "name": "Agent authority lacks a verifier contract: .claude/skills/openspec-sync-specs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-sync-specs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e3165ef0855ee88", "name": "Agent authority lacks a verifier contract: .codex/skills/openspec-apply-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/openspec-apply-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51799bb0bf7a6b08", "name": "Agent authority lacks a verifier contract: .codex/skills/openspec-archive-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/openspec-archive-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-468e295a9451bd3e", "name": "Agent authority lacks a verifier contract: .codex/skills/openspec-sync-specs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/openspec-sync-specs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5dabd4d268bfaaa2", "name": "Agent authority lacks a verifier contract: .github/skills/openspec-apply-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .github/skills/openspec-apply-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61ee0e5ebb78eeef", "name": "Agent authority lacks a verifier contract: .github/skills/openspec-archive-change/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .github/skills/openspec-archive-change/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27cfb5ad7ee46df8", "name": "Agent authority lacks a verifier contract: .github/skills/openspec-sync-specs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .github/skills/openspec-sync-specs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27e1cbd86282c085", "name": "Commented-code block (11 lines) in scripts/spec/build_av2_mirror.py:32", "shortDescription": {"text": "Commented-code block (11 lines) in scripts/spec/build_av2_mirror.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20123"}, "properties": {"repository": "splotlabs/splot", "repoUrl": "https://github.com/splotlabs/splot", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3a2bb18a3332a607", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in docs/DECODER-SUPPORT-MATRIX.toml:99"}, "properties": {"repobilityId": "815e0ddf94b52068", "scanner": "scanner-primary", "fingerprint": "3a2bb18a3332a607", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/DECODER-SUPPORT-MATRIX.toml"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-1bdebffa6a358e73", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in docs/LOCAL-REFERENCE-EVIDENCE.toml:71"}, "properties": {"repobilityId": "f3bfd858c41dd80d", "scanner": "scanner-primary", "fingerprint": "1bdebffa6a358e73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/LOCAL-REFERENCE-EVIDENCE.toml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-fb202430b717a2d7", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in docs/IMPLEMENTATION-MATRIX.toml:2578"}, "properties": {"repobilityId": "57843651c808e906", "scanner": "scanner-primary", "fingerprint": "fb202430b717a2d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/IMPLEMENTATION-MATRIX.toml"}, "region": {"startLine": 2578}}}]}, {"ruleId": "scanner-60a59a605b773b17", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in xtask/src/decoder_conformance_coverage.rs:300"}, "properties": {"repobilityId": "61575b6cb3680092", "scanner": "scanner-primary", "fingerprint": "60a59a605b773b17", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "xtask/src/decoder_conformance_coverage.rs"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-063997d8d14f8d5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b268301d4ba9d1b9", "scanner": "scanner-primary", "fingerprint": "063997d8d14f8d5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-888be1959eb32204", "level": "note", "message": {"text": "Very large file: xtask/src/concurrency_policy.rs (1541 lines)"}, "properties": {"repobilityId": "ff5faeaa1db25887", "scanner": "scanner-primary", "fingerprint": "888be1959eb32204", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9f21d663ece82b07", "level": "note", "message": {"text": "Very large file: xtask/src/feature_status.rs (1741 lines)"}, "properties": {"repobilityId": "b1ee54a6ce87977f", "scanner": "scanner-primary", "fingerprint": "9f21d663ece82b07", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-44de9184d2d16b74", "level": "note", "message": {"text": "Very large file: xtask/src/main.rs (1447 lines)"}, "properties": {"repobilityId": "75e5cd3958daa901", "scanner": "scanner-primary", "fingerprint": "44de9184d2d16b74", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-10ade38d7132ea09", "level": "note", "message": {"text": "Very large file: xtask/src/audit_scope.rs (2475 lines)"}, "properties": {"repobilityId": "c1332ec031011f12", "scanner": "scanner-primary", "fingerprint": "10ade38d7132ea09", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1dfa67b12dd64356", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/frame_unit.rs (1490 lines)"}, "properties": {"repobilityId": "12e366dcb3877252", "scanner": "scanner-primary", "fingerprint": "1dfa67b12dd64356", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8598a95c2f8f306d", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/celu.rs (3693 lines)"}, "properties": {"repobilityId": "d25fda9b8e74984b", "scanner": "scanner-primary", "fingerprint": "8598a95c2f8f306d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-adb65dfca3bb3664", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/validator/tests/reference_state.rs (1330 lines)"}, "properties": {"repobilityId": "2627289b3825e333", "scanner": "scanner-primary", "fingerprint": "adb65dfca3bb3664", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8d9373df64fcb529", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/context/mod.rs (819 lines)"}, "properties": {"repobilityId": "7d393aa3ed073dd8", "scanner": "scanner-primary", "fingerprint": "8d9373df64fcb529", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a9cf7f109294d52b", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/context/cmvs.rs (866 lines)"}, "properties": {"repobilityId": "bd9e260271b226c7", "scanner": "scanner-primary", "fingerprint": "a9cf7f109294d52b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c973f231ef1144d1", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/context/sequence.rs (877 lines)"}, "properties": {"repobilityId": "aaa52b53f4cbcfc5", "scanner": "scanner-primary", "fingerprint": "c973f231ef1144d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b156ce7481e69889", "level": "note", "message": {"text": "Very large file: crates/splot-validate/src/checks/mod.rs (1978 lines)"}, "properties": {"repobilityId": "cc712935d3df9b0c", "scanner": "scanner-primary", "fingerprint": "b156ce7481e69889", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-90a7b7c5c05d57e6", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/obu.rs (1162 lines)"}, "properties": {"repobilityId": "38719ee951fa6b0e", "scanner": "scanner-primary", "fingerprint": "90a7b7c5c05d57e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e5c9f5fd6367ec19", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/write/seq_config_tests.rs (1400 lines)"}, "properties": {"repobilityId": "240ac249d5afd30a", "scanner": "scanner-primary", "fingerprint": "e5c9f5fd6367ec19", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9d84e4c74c9c57ad", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/write/seq_header.rs (1612 lines)"}, "properties": {"repobilityId": "4e0080a0a5c26d0e", "scanner": "scanner-primary", "fingerprint": "9d84e4c74c9c57ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f09596f96da4571", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/tile_group.rs (1516 lines)"}, "properties": {"repobilityId": "315d50fecc62f30a", "scanner": "scanner-primary", "fingerprint": "2f09596f96da4571", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f7a8c93444b76a8a", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/metadata.rs (1535 lines)"}, "properties": {"repobilityId": "de506c401dc152dc", "scanner": "scanner-primary", "fingerprint": "f7a8c93444b76a8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b58a35edf7886b62", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/sequence.rs (3328 lines)"}, "properties": {"repobilityId": "baef5979975e8336", "scanner": "scanner-primary", "fingerprint": "b58a35edf7886b62", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bbb5378736507310", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/frame/restoration.rs (1253 lines)"}, "properties": {"repobilityId": "bd09d7a38af5f579", "scanner": "scanner-primary", "fingerprint": "bbb5378736507310", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ca2ba3898434c9d0", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/frame/global_motion.rs (1122 lines)"}, "properties": {"repobilityId": "bfa2364f9f917549", "scanner": "scanner-primary", "fingerprint": "ca2ba3898434c9d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee37f18737ba54a3", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/frame/filtering.rs (1233 lines)"}, "properties": {"repobilityId": "5c4dc8ce3bbcb13f", "scanner": "scanner-primary", "fingerprint": "ee37f18737ba54a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2a5b64266b33f5e7", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/frame/quant.rs (1658 lines)"}, "properties": {"repobilityId": "cdcb410e273dd043", "scanner": "scanner-primary", "fingerprint": "2a5b64266b33f5e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-999b4e8781cc32ef", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/frame/info.rs (4620 lines)"}, "properties": {"repobilityId": "a3072054a32a94b9", "scanner": "scanner-primary", "fingerprint": "999b4e8781cc32ef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e767cefae3a33ee5", "level": "note", "message": {"text": "Very large file: crates/splot-core/src/headers/frame/inter.rs (1483 lines)"}, "properties": {"repobilityId": "7e5449abb8c8106c", "scanner": "scanner-primary", "fingerprint": "e767cefae3a33ee5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fea8be302da18d5b", "level": "note", "message": {"text": "Very large file: crates/splot-cli/src/commands/inspect.rs (1929 lines)"}, "properties": {"repobilityId": "b2eac5ab11332d6f", "scanner": "scanner-primary", "fingerprint": "fea8be302da18d5b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2d0dece9a661e907", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "87d4a31f3ee7b22c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "42faf1e94e5bf859", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "43b1e41635a7d8bb", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cbb5857940ba0dc2", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "properties": {"repobilityId": "e12c7213d5eadf3e", "scanner": "scanner-primary", "fingerprint": "cbb5857940ba0dc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-6c10344bdf57df51", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/sync.md"}, "properties": {"repobilityId": "c67e0c803c0dbcac", "scanner": "scanner-primary", "fingerprint": "6c10344bdf57df51", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/opsx/sync.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df8d7aecf447de62", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/archive.md"}, "properties": {"repobilityId": "222623e99b9cb4f7", "scanner": "scanner-primary", "fingerprint": "df8d7aecf447de62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/opsx/archive.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-021b572fe2fa6b9c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/opsx/apply.md"}, "properties": {"repobilityId": "5ba922ec1bca34d1", "scanner": "scanner-primary", "fingerprint": "021b572fe2fa6b9c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/opsx/apply.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14b94de34d897ad4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-apply-change/SKILL.md"}, "properties": {"repobilityId": "ff525910a58aad1b", "scanner": "scanner-primary", "fingerprint": "14b94de34d897ad4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/openspec-apply-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a585f74bb40a5f1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-archive-change/SKILL.md"}, "properties": {"repobilityId": "1499167b45dee6be", "scanner": "scanner-primary", "fingerprint": "8a585f74bb40a5f1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/openspec-archive-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1861f29946301e43", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/openspec-sync-specs/SKILL.md"}, "properties": {"repobilityId": "67a28bca6aa28ab2", "scanner": "scanner-primary", "fingerprint": "1861f29946301e43", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/openspec-sync-specs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e3165ef0855ee88", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/openspec-apply-change/SKILL.md"}, "properties": {"repobilityId": "7b5c3314768d2a9a", "scanner": "scanner-primary", "fingerprint": "1e3165ef0855ee88", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/openspec-apply-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51799bb0bf7a6b08", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/openspec-archive-change/SKILL.md"}, "properties": {"repobilityId": "80567c4db3eb1c0f", "scanner": "scanner-primary", "fingerprint": "51799bb0bf7a6b08", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/openspec-archive-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-468e295a9451bd3e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/openspec-sync-specs/SKILL.md"}, "properties": {"repobilityId": "6472bb3ba2ad95db", "scanner": "scanner-primary", "fingerprint": "468e295a9451bd3e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/openspec-sync-specs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5dabd4d268bfaaa2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .github/skills/openspec-apply-change/SKILL.md"}, "properties": {"repobilityId": "c46c24f4a50f427b", "scanner": "scanner-primary", "fingerprint": "5dabd4d268bfaaa2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/skills/openspec-apply-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61ee0e5ebb78eeef", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .github/skills/openspec-archive-change/SKILL.md"}, "properties": {"repobilityId": "7550f888b901a386", "scanner": "scanner-primary", "fingerprint": "61ee0e5ebb78eeef", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/skills/openspec-archive-change/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27cfb5ad7ee46df8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .github/skills/openspec-sync-specs/SKILL.md"}, "properties": {"repobilityId": "f32925ead409e023", "scanner": "scanner-primary", "fingerprint": "27cfb5ad7ee46df8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/skills/openspec-sync-specs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27e1cbd86282c085", "level": "none", "message": {"text": "Commented-code block (11 lines) in scripts/spec/build_av2_mirror.py:32"}, "properties": {"repobilityId": "67f4e2ec9ec7a2e9", "scanner": "scanner-primary", "fingerprint": "27e1cbd86282c085", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}