{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f25b7346a20bdf3c", "name": "Stray `console.log` in TS/JS \u2014 scripts/preflight.js:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/preflight.js:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a161c33c9f5c8c0f", "name": "Icon-only button without accessible name \u2014 packages/client/public/admin/admin-shared.js:1717", "shortDescription": {"text": "Icon-only button without accessible name \u2014 packages/client/public/admin/admin-shared.js:1717"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b02a8e432a291eef", "name": "Icon-only button without accessible name \u2014 packages/client/src/screens/TestScenarioScreen.tsx:1428", "shortDescription": {"text": "Icon-only button without accessible name \u2014 packages/client/src/screens/TestScenarioScreen.tsx:1428"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f2a38e41169833c", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/ruleEngine.test.ts:866", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/ruleEngine.test.ts:866"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14b3a267eec7363e", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/checks.test.ts:165", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/checks.test.ts:165"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dffee843ab030a7", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/bootstrap.test.ts:225", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/bootstrap.test.ts:225"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fae0b58271f3224", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/gameProgress.test.ts:286", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/gameProgress.test.ts:286"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71fb73b6d2f71599", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/hiddenInvestigation.test.ts:96", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/hiddenInvestigation.test.ts:96"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9de7c78b8921bc99", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/encounters.test.ts:106", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/encounters.test.ts:106"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08cf548d2d6bfd79", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/upkeep.test.ts:110", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/upkeep.test.ts:110"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34298fd027d0bf33", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/investigatorAI.test.ts:324", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/investigatorAI.test.ts:324"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58e221c5d6e3dc4e", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/messageBus.test.ts:184", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/messageBus.test.ts:184"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faf8674b29ab1dc0", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/effectsExecutor.test.ts:76", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/effectsExecutor.test.ts:76"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de298275aeb0d112", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/turnLoop.test.ts:109", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/turnLoop.test.ts:109"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c3a250aeb8ee4d2", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/monsterActions.test.ts:275", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/monsterActions.test.ts:275"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ae04180b6a72d19", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/monsterBehavior.test.ts:178", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/monsterBehavior.test.ts:178"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b276d19e12c2ec5b", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/dying.test.ts:109", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/dying.test.ts:109"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17886dde736fa90c", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/keeperAI.test.ts:223", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/keeperAI.test.ts:223"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f75695d4b0a4a427", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/statusEffects.test.ts:228", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/statusEffects.test.ts:228"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-645bbeb06f8fd928", "name": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/ally.test.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/ally.test.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-691c1cbd442bcc47", "name": "Stray `console.log` in TS/JS \u2014 packages/calibration/src/components/Hotspot.tsx:94", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/calibration/src/components/Hotspot.tsx:94"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65ede0157824da2e", "name": "Stray `console.log` in TS/JS \u2014 packages/server/src/index.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/index.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52c22eb1bf625e00", "name": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/seed.ts:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/seed.ts:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8012d6074090a74", "name": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/migrate.ts:3356", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/migrate.ts:3356"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34408a3519013ca7", "name": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/seeds/talisman-templates.ts:134", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/seeds/talisman-templates.ts:134"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43c077bacd2bfaf3", "name": "Insecure pattern 'new_function_used' in scripts/preflight.js:42", "shortDescription": {"text": "Insecure pattern 'new_function_used' in scripts/preflight.js:42"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d20c5a897aae933", "name": "Insecure pattern 'new_function_used' in scripts/g1-sandbox/restore-mythos-descriptions.mjs:25", "shortDescription": {"text": "Insecure pattern 'new_function_used' in scripts/g1-sandbox/restore-mythos-descriptions.mjs:25"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c46a7170b2234d7", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-card-designer.html:991", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-card-designer.html:991"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f317f9ecc56fec6c", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-investigator-designer.html:665", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-investigator-designer.html:665"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe666e82af276087", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-scenario-editor.html:707", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-scenario-editor.html:707"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-756387e5f5f1b334", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-rulebook-viewer.html:435", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-rulebook-viewer.html:435"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7225006b6fef290d", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-ai-console.js:84", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-ai-console.js:84"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5b63d37dabba1cd", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-team-spirit.html:296", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-team-spirit.html:296"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5248d39faafacf1d", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-campaign.html:665", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-campaign.html:665"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e45b7c20259e081a", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-enemy-tier.html:398", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-enemy-tier.html:398"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b51e10892400ea8e", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-shared.js:849", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-shared.js:849"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed5c571b4d2b6dc3", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-proficiency.html:275", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-proficiency.html:275"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0bac93a668a13aff", "name": "Insecure pattern 'local_storage_auth_token' in packages/client/public/admin/login.html:76", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in packages/client/public/admin/login.html:76"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08a19365450cbfe1", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/index.html:247", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/index.html:247"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c0d592bde1d47ff", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-location-designer.html:820", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-location-designer.html:820"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7273783739ae50ef", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-character-creation.html:583", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-character-creation.html:583"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66eec95ab75ebb1a", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-card-checker.html:188", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-card-checker.html:188"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9cefa9479424663", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-boss-combat.html:518", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-boss-combat.html:518"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf592beb6370fc8f", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-talent-skill.html:326", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-talent-skill.html:326"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8b0c51bc79a66bc", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-damage-curve.html:484", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-damage-curve.html:484"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae5b5a053366a737", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-forge-craft.html:419", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-forge-craft.html:419"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59da698f31a63415", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-system-diag.html:223", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-system-diag.html:223"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5f60a12094c872", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-axis-series.html:177", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-axis-series.html:177"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21b31a0b5e9e4e6e", "name": "Insecure pattern 'insert_adjacent_html' in packages/client/public/admin/admin-axis-series.html:455", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in packages/client/public/admin/admin-axis-series.html:455"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a792695dc1b034d0", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-boot.js:78", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-boot.js:78"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc1af9ae1c042e5d", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-dice-probability.html:564", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-dice-probability.html:564"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a441f6cb4da64490", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-card-economy.html:461", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-card-economy.html:461"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a9ef0731a914d1e", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-enemy-designer.html:346", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-enemy-designer.html:346"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d419bb1af6cb3b1d", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-keeper-designer.html:976", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-keeper-designer.html:976"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d670c8137537adc0", "name": "Very large file: packages/client/public/admin/admin-shared.js (1747 lines)", "shortDescription": {"text": "Very large file: packages/client/public/admin/admin-shared.js (1747 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b3d8f9146da445e", "name": "Very large file: packages/client/public/admin/admin-card-prompt.js (999 lines)", "shortDescription": {"text": "Very large file: packages/client/public/admin/admin-card-prompt.js (999 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d531d8ebc903e86", "name": "Very large file: packages/client/public/admin/admin-ai-tasks/geminiDirectClient.js (1208 lines)", "shortDescription": {"text": "Very large file: packages/client/public/admin/admin-ai-tasks/geminiDirectClient.js (1208 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61a7fae6b9f5ae74", "name": "Very large file: packages/client/src/screens/TestScenarioScreen.tsx (1621 lines)", "shortDescription": {"text": "Very large file: packages/client/src/screens/TestScenarioScreen.tsx (1621 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-045a17ad5c577faa", "name": "Very large file: packages/shared/src/game/ruleEngine.ts (1530 lines)", "shortDescription": {"text": "Very large file: packages/shared/src/game/ruleEngine.ts (1530 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10733ec98d69e5af", "name": "Very large file: packages/server/src/routes/stages.ts (1776 lines)", "shortDescription": {"text": "Very large file: packages/server/src/routes/stages.ts (1776 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fee7127e1b1a610d", "name": "Very large file: packages/server/src/routes/keeper.ts (1025 lines)", "shortDescription": {"text": "Very large file: packages/server/src/routes/keeper.ts (1025 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-799cd2821e9c9011", "name": "Very large file: packages/server/src/routes/campaigns.ts (1260 lines)", "shortDescription": {"text": "Very large file: packages/server/src/routes/campaigns.ts (1260 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b60ff03ee911a0e4", "name": "Very large file: packages/server/src/db/migrate.ts (3451 lines)", "shortDescription": {"text": "Very large file: packages/server/src/db/migrate.ts (3451 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "18 tests / 148 src (ratio 0.12)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1f0c52db7c97cef", "name": "Node manifest has dependencies but no lockfile: packages/client/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff9b333afafcbaf", "name": "Node manifest has dependencies but no lockfile: packages/calibration/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/calibration/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b739f2f2be1d714d", "name": "Node manifest has dependencies but no lockfile: packages/server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 267 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a0a311faa272229", "name": "Commented-code block (5 lines) in scripts/preflight.js:77", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/preflight.js:77"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8078b682f03f0d9", "name": "Commented-code block (9 lines) in scripts/g1-sandbox/restore-mythos-descriptions.mjs:1", "shortDescription": {"text": "Commented-code block (9 lines) in scripts/g1-sandbox/restore-mythos-descriptions.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0dad9648c2db5b5", "name": "Legacy-named symbol `withOld` in scripts/g1-sandbox/41-verify-migration029.mjs:69", "shortDescription": {"text": "Legacy-named symbol `withOld` in scripts/g1-sandbox/41-verify-migration029.mjs:69"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31c78b0864e02011", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/41-verify-migration029.mjs:11", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/41-verify-migration029.mjs:11"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b380d63c28c63d32", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/backfill-behavior-scripts.mjs:23", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/backfill-behavior-scripts.mjs:23"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-addbd6432c7ce27d", "name": "Commented-code block (7 lines) in scripts/g1-sandbox/15-create-j-faction-cards.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/g1-sandbox/15-create-j-faction-cards.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf48d0170f9b4297", "name": "Commented-code block (5 lines) in scripts/g1-sandbox/16-create-p-faction-cards.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/g1-sandbox/16-create-p-faction-cards.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75506d06412be51c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/api.mjs:32", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/api.mjs:32"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d8d3f3868fbc6a5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/read-cred-and-login.mjs:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/read-cred-and-login.mjs:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d9dd48210442c75", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/00-login.mjs:16", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/00-login.mjs:16"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0906f26964a057bd", "name": "Commented-code block (9 lines) in scripts/g1-sandbox/lib/api-key.mjs:1", "shortDescription": {"text": "Commented-code block (9 lines) in scripts/g1-sandbox/lib/api-key.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97fa4509d4ca7039", "name": "Commented-code block (5 lines) in packages/client/public/admin/admin-ai-console.js:204", "shortDescription": {"text": "Commented-code block (5 lines) in packages/client/public/admin/admin-ai-console.js:204"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-135a6fd6fe166150", "name": "Commented-code block (6 lines) in packages/client/public/admin/admin-shared.js:25", "shortDescription": {"text": "Commented-code block (6 lines) in packages/client/public/admin/admin-shared.js:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1dc5ffcd6cf56a4f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/public/admin/admin-shared.js:73", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/public/admin/admin-shared.js:73"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0467ff7f594088b0", "name": "Commented-code block (9 lines) in packages/client/public/admin/admin-ai-tasks/itemMapper.js:7", "shortDescription": {"text": "Commented-code block (9 lines) in packages/client/public/admin/admin-ai-tasks/itemMapper.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf80fe1441947d4e", "name": "Commented-code block (5 lines) in packages/client/public/admin/admin-ai-tasks/geminiDirectClient.js:77", "shortDescription": {"text": "Commented-code block (5 lines) in packages/client/public/admin/admin-ai-tasks/geminiDirectClient.js:77"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0baa99c62956c8d", "name": "Commented-code block (5 lines) in packages/calibration/src/components/Hotspot.tsx:67", "shortDescription": {"text": "Commented-code block (5 lines) in packages/calibration/src/components/Hotspot.tsx:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d03c9bd2661a8bf5", "name": "Commented-code block (8 lines) in packages/server/src/routes/cards.ts:275", "shortDescription": {"text": "Commented-code block (8 lines) in packages/server/src/routes/cards.ts:275"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ace8d7dec98f8d6a", "name": "Legacy-named symbol `Claude_Code_\u5361\u7247\u5347\u7d1a\u7cfb\u7d71\u91cd\u69cb_v1` in packages/server/src/db/migrate.ts:2738", "shortDescription": {"text": "Legacy-named symbol `Claude_Code_\u5361\u7247\u5347\u7d1a\u7cfb\u7d71\u91cd\u69cb_v1` in packages/server/src/db/migrate.ts:2738"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a6cdf198272704c", "name": "Commented-code block (6 lines) in packages/server/src/db/migrate.ts:2317", "shortDescription": {"text": "Commented-code block (6 lines) in packages/server/src/db/migrate.ts:2317"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0b5e7cb1208a7cd", "name": "13 env vars used in code but missing from .env.example", "shortDescription": {"text": "13 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ADMIN_PASS`, `ADMIN_USER`, `ALLOWED_ORIGINS`, `BRIDGE_URL`, `G1_API_BASE`, `GEMINI_API_KEY_PERSONAL`, `GITHUB_BRANCH`, `GITHUB_OWNER` + 5 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e276d767ea7168bb", "name": "Frontend route `/scenario/:stageId/briefing` has no Link/navigate to it \u2014 packages/client/src/App.tsx", "shortDescription": {"text": "Frontend route `/scenario/:stageId/briefing` has no Link/navigate to it \u2014 packages/client/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4df2adb5c84fca0", "name": "Frontend route `/scenario/:stageId` has no Link/navigate to it \u2014 packages/client/src/App.tsx", "shortDescription": {"text": "Frontend route `/scenario/:stageId` has no Link/navigate to it \u2014 packages/client/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd06b33f6e06a2c0", "name": "Frontend route `/admin/calibration` has no Link/navigate to it \u2014 packages/client/src/App.tsx", "shortDescription": {"text": "Frontend route `/admin/calibration` has no Link/navigate to it \u2014 packages/client/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bd5b11f37c6cfcf", "name": "Unused endpoint: POST /task", "shortDescription": {"text": "Unused endpoint: POST /task"}, "fullDescription": {"text": "`gemma-bridge/src/routes/task.ts` declares `POST /task` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3308cf650fcc235", "name": "Unused endpoint: GET /api/cards/export", "shortDescription": {"text": "Unused endpoint: GET /api/cards/export"}, "fullDescription": {"text": "`packages/server/src/routes/cards.ts` declares `GET /api/cards/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee4aa5ddab88c9dc", "name": "Unused endpoint: GET /api/auth/me", "shortDescription": {"text": "Unused endpoint: GET /api/auth/me"}, "fullDescription": {"text": "`packages/server/src/routes/auth.ts` declares `GET /api/auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5a39262ac205120", "name": "Unused endpoint: POST /api/auth/logout", "shortDescription": {"text": "Unused endpoint: POST /api/auth/logout"}, "fullDescription": {"text": "`packages/server/src/routes/auth.ts` declares `POST /api/auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9c9bb8955f09d50", "name": "Unused endpoint: GET /api/admin/locations/stats/overview", "shortDescription": {"text": "Unused endpoint: GET /api/admin/locations/stats/overview"}, "fullDescription": {"text": "`packages/server/src/routes/locations.ts` declares `GET /api/admin/locations/stats/overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c120ebc8d6f5520", "name": "Unused endpoint: GET /api/admin/locations/tags", "shortDescription": {"text": "Unused endpoint: GET /api/admin/locations/tags"}, "fullDescription": {"text": "`packages/server/src/routes/locations.ts` declares `GET /api/admin/locations/tags` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-225ab8299b91dd1e", "name": "Unused endpoint: POST /api/admin/locations/tags", "shortDescription": {"text": "Unused endpoint: POST /api/admin/locations/tags"}, "fullDescription": {"text": "`packages/server/src/routes/locations.ts` declares `POST /api/admin/locations/tags` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c582dad3ec2b46ec", "name": "Unused endpoint: GET /api/admin/locations", "shortDescription": {"text": "Unused endpoint: GET /api/admin/locations"}, "fullDescription": {"text": "`packages/server/src/routes/locations.ts` declares `GET /api/admin/locations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dc7e3d36f1663a6", "name": "Unused endpoint: POST /api/admin/locations", "shortDescription": {"text": "Unused endpoint: POST /api/admin/locations"}, "fullDescription": {"text": "`packages/server/src/routes/locations.ts` declares `POST /api/admin/locations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c239872d7d41186e", "name": "Unused endpoint: GET /api/talent-trees/export", "shortDescription": {"text": "Unused endpoint: GET /api/talent-trees/export"}, "fullDescription": {"text": "`packages/server/src/routes/talent-trees.ts` declares `GET /api/talent-trees/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fe8c0b50b314cb3", "name": "Unused endpoint: POST /api/talent-trees/import", "shortDescription": {"text": "Unused endpoint: POST /api/talent-trees/import"}, "fullDescription": {"text": "`packages/server/src/routes/talent-trees.ts` declares `POST /api/talent-trees/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81d7dd2a10a32988", "name": "Unused endpoint: GET /api/talent-trees/compare", "shortDescription": {"text": "Unused endpoint: GET /api/talent-trees/compare"}, "fullDescription": {"text": "`packages/server/src/routes/talent-trees.ts` declares `GET /api/talent-trees/compare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fdade196ec015b7", "name": "Unused endpoint: GET /api/talent-trees", "shortDescription": {"text": "Unused endpoint: GET /api/talent-trees"}, "fullDescription": {"text": "`packages/server/src/routes/talent-trees.ts` declares `GET /api/talent-trees` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93fff78320726c71", "name": "Unused endpoint: GET /api/play/stages", "shortDescription": {"text": "Unused endpoint: GET /api/play/stages"}, "fullDescription": {"text": "`packages/server/src/routes/play.ts` declares `GET /api/play/stages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c53c63426bdae034", "name": "Unused endpoint: GET /api/play/investigators", "shortDescription": {"text": "Unused endpoint: GET /api/play/investigators"}, "fullDescription": {"text": "`packages/server/src/routes/play.ts` declares `GET /api/play/investigators` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bad4b14bec8e13d5", "name": "Unused endpoint: GET /api/materials/categories", "shortDescription": {"text": "Unused endpoint: GET /api/materials/categories"}, "fullDescription": {"text": "`packages/server/src/routes/forge-craft.ts` declares `GET /api/materials/categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22e1617e5d38dc4c", "name": "Unused endpoint: GET /api/forging/stats", "shortDescription": {"text": "Unused endpoint: GET /api/forging/stats"}, "fullDescription": {"text": "`packages/server/src/routes/forge-craft.ts` declares `GET /api/forging/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a572d90129384d4", "name": "Unused endpoint: GET /api/crafting/stats", "shortDescription": {"text": "Unused endpoint: GET /api/crafting/stats"}, "fullDescription": {"text": "`packages/server/src/routes/forge-craft.ts` declares `GET /api/crafting/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7a5a10e74e07636", "name": "Unused endpoint: GET /api/combat-styles/export", "shortDescription": {"text": "Unused endpoint: GET /api/combat-styles/export"}, "fullDescription": {"text": "`packages/server/src/routes/combat-styles.ts` declares `GET /api/combat-styles/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-054a346f0cd86173", "name": "Unused endpoint: GET /api/combat-styles/stats", "shortDescription": {"text": "Unused endpoint: GET /api/combat-styles/stats"}, "fullDescription": {"text": "`packages/server/src/routes/combat-styles.ts` declares `GET /api/combat-styles/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0dc9d74ed9f41fe4", "name": "Unused endpoint: GET /api/combat-styles", "shortDescription": {"text": "Unused endpoint: GET /api/combat-styles"}, "fullDescription": {"text": "`packages/server/src/routes/combat-styles.ts` declares `GET /api/combat-styles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2883eadd42f62387", "name": "Unused endpoint: POST /api/admin/calibration/save", "shortDescription": {"text": "Unused endpoint: POST /api/admin/calibration/save"}, "fullDescription": {"text": "`packages/server/src/routes/calibration.ts` declares `POST /api/admin/calibration/save` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-652ef285c49acc53", "name": "Unused endpoint: GET /api/admin/keeper/stats/overview", "shortDescription": {"text": "Unused endpoint: GET /api/admin/keeper/stats/overview"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `GET /api/admin/keeper/stats/overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbb892f196c49eba", "name": "Unused endpoint: GET /api/admin/keeper/balance", "shortDescription": {"text": "Unused endpoint: GET /api/admin/keeper/balance"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `GET /api/admin/keeper/balance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b3f3ab372c0ae6", "name": "Unused endpoint: POST /api/admin/keeper/balance/simulate", "shortDescription": {"text": "Unused endpoint: POST /api/admin/keeper/balance/simulate"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `POST /api/admin/keeper/balance/simulate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3a06786ddbd31e4", "name": "Unused endpoint: GET /api/admin/keeper/mythos-cards", "shortDescription": {"text": "Unused endpoint: GET /api/admin/keeper/mythos-cards"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `GET /api/admin/keeper/mythos-cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c92070727bf464d2", "name": "Unused endpoint: POST /api/admin/keeper/mythos-cards", "shortDescription": {"text": "Unused endpoint: POST /api/admin/keeper/mythos-cards"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `POST /api/admin/keeper/mythos-cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a19afdc60d0ad47e", "name": "Unused endpoint: GET /api/admin/keeper/encounter-cards", "shortDescription": {"text": "Unused endpoint: GET /api/admin/keeper/encounter-cards"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `GET /api/admin/keeper/encounter-cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14692e9d634fae2a", "name": "Unused endpoint: POST /api/admin/keeper/encounter-cards", "shortDescription": {"text": "Unused endpoint: POST /api/admin/keeper/encounter-cards"}, "fullDescription": {"text": "`packages/server/src/routes/keeper.ts` declares `POST /api/admin/keeper/encounter-cards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5411e3b96d6e5903", "name": "Unused endpoint: GET /api/admin/monsters/stats/overview", "shortDescription": {"text": "Unused endpoint: GET /api/admin/monsters/stats/overview"}, "fullDescription": {"text": "`packages/server/src/routes/monsters.ts` declares `GET /api/admin/monsters/stats/overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72e6ed9cf65270d0", "name": "Unused endpoint: GET /api/admin/monsters/families", "shortDescription": {"text": "Unused endpoint: GET /api/admin/monsters/families"}, "fullDescription": {"text": "`packages/server/src/routes/monsters.ts` declares `GET /api/admin/monsters/families` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96cc7328373cae6a", "name": "Unused endpoint: GET /api/team-spirits/export", "shortDescription": {"text": "Unused endpoint: GET /api/team-spirits/export"}, "fullDescription": {"text": "`packages/server/src/routes/team-spirits.ts` declares `GET /api/team-spirits/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60a78f6c114fdfea", "name": "Unused endpoint: GET /api/team-spirits/stats", "shortDescription": {"text": "Unused endpoint: GET /api/team-spirits/stats"}, "fullDescription": {"text": "`packages/server/src/routes/team-spirits.ts` declares `GET /api/team-spirits/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05cbd246f809841b", "name": "Unused endpoint: GET /api/team-spirits/compare", "shortDescription": {"text": "Unused endpoint: GET /api/team-spirits/compare"}, "fullDescription": {"text": "`packages/server/src/routes/team-spirits.ts` declares `GET /api/team-spirits/compare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f2dd5b8e1b49b1e", "name": "Unused endpoint: GET /api/ai-console/bridge/health", "shortDescription": {"text": "Unused endpoint: GET /api/ai-console/bridge/health"}, "fullDescription": {"text": "`packages/server/src/routes/ai-console.ts` declares `GET /api/ai-console/bridge/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6321c3c89508db6f", "name": "Unused endpoint: DELETE /api/ai-console/tasks/clear-history", "shortDescription": {"text": "Unused endpoint: DELETE /api/ai-console/tasks/clear-history"}, "fullDescription": {"text": "`packages/server/src/routes/ai-console.ts` declares `DELETE /api/ai-console/tasks/clear-history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cc2dba1b39712d4", "name": "Unused endpoint: GET /api/admin/diag/campaigns-schema", "shortDescription": {"text": "Unused endpoint: GET /api/admin/diag/campaigns-schema"}, "fullDescription": {"text": "`packages/server/src/routes/campaigns.ts` declares `GET /api/admin/diag/campaigns-schema` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0984dc171bbcd25a", "name": "Unused endpoint: POST /api/admin/diag/run-migration-028", "shortDescription": {"text": "Unused endpoint: POST /api/admin/diag/run-migration-028"}, "fullDescription": {"text": "`packages/server/src/routes/campaigns.ts` declares `POST /api/admin/diag/run-migration-028` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dec45df3f48d6581", "name": "Unused endpoint: POST /api/admin/db-diag/rerun-axis-migrations", "shortDescription": {"text": "Unused endpoint: POST /api/admin/db-diag/rerun-axis-migrations"}, "fullDescription": {"text": "`packages/server/src/routes/db-diag.ts` declares `POST /api/admin/db-diag/rerun-axis-migrations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28ab0e625b6565a4", "name": "Unused endpoint: GET /api/admin/threat-types", "shortDescription": {"text": "Unused endpoint: GET /api/admin/threat-types"}, "fullDescription": {"text": "`packages/server/src/routes/types-registry.ts` declares `GET /api/admin/threat-types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f932dbc36e2d4da4", "name": "Unused endpoint: GET /api/admin/talisman-types", "shortDescription": {"text": "Unused endpoint: GET /api/admin/talisman-types"}, "fullDescription": {"text": "`packages/server/src/routes/types-registry.ts` declares `GET /api/admin/talisman-types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-164b979c14754ad2", "name": "Unused endpoint: GET /api/admin/investigators/preset-matrix", "shortDescription": {"text": "Unused endpoint: GET /api/admin/investigators/preset-matrix"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/investigators/preset-matrix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a774ea9f8b014ad", "name": "Unused endpoint: GET /api/admin/investigators/stats", "shortDescription": {"text": "Unused endpoint: GET /api/admin/investigators/stats"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/investigators/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-267bbb57ad2c9375", "name": "Unused endpoint: GET /api/admin/investigators/value-matrix", "shortDescription": {"text": "Unused endpoint: GET /api/admin/investigators/value-matrix"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/investigators/value-matrix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14a107339a4fbd79", "name": "Unused endpoint: GET /api/admin/investigators/value-stats", "shortDescription": {"text": "Unused endpoint: GET /api/admin/investigators/value-stats"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/investigators/value-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e69cb27623bec26", "name": "Unused endpoint: POST /api/admin/investigators/recalculate-all", "shortDescription": {"text": "Unused endpoint: POST /api/admin/investigators/recalculate-all"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `POST /api/admin/investigators/recalculate-all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1826fac95c85dd96", "name": "Unused endpoint: GET /api/admin/value-config", "shortDescription": {"text": "Unused endpoint: GET /api/admin/value-config"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/value-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb71466234092032", "name": "Unused endpoint: PATCH /api/admin/value-config", "shortDescription": {"text": "Unused endpoint: PATCH /api/admin/value-config"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `PATCH /api/admin/value-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e3d9f4d70544f3a", "name": "Unused endpoint: GET /api/admin/faction-attribute-map", "shortDescription": {"text": "Unused endpoint: GET /api/admin/faction-attribute-map"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/faction-attribute-map` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55192fea2f624772", "name": "Unused endpoint: GET /api/admin/proficiencies", "shortDescription": {"text": "Unused endpoint: GET /api/admin/proficiencies"}, "fullDescription": {"text": "`packages/server/src/routes/investigators.ts` declares `GET /api/admin/proficiencies` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21957"}, "properties": {"repository": "Uria030/cthulhu-card-game", "repoUrl": "https://github.com/Uria030/cthulhu-card-game", "branch": "main"}, "results": [{"ruleId": "scanner-f25b7346a20bdf3c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/preflight.js:17"}, "properties": {"repobilityId": "cb59fe1be7c376fd", "scanner": "scanner-primary", "fingerprint": "f25b7346a20bdf3c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a161c33c9f5c8c0f", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 packages/client/public/admin/admin-shared.js:1717"}, "properties": {"repobilityId": "884a6d62e7d6fb02", "scanner": "scanner-primary", "fingerprint": "a161c33c9f5c8c0f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-b02a8e432a291eef", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 packages/client/src/screens/TestScenarioScreen.tsx:1428"}, "properties": {"repobilityId": "0bf23ee6fa16a42f", "scanner": "scanner-primary", "fingerprint": "b02a8e432a291eef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-8f2a38e41169833c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/ruleEngine.test.ts:866"}, "properties": {"repobilityId": "289ce88f3750c856", "scanner": "scanner-primary", "fingerprint": "8f2a38e41169833c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-14b3a267eec7363e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/checks.test.ts:165"}, "properties": {"repobilityId": "2ab95e537b51c6f3", "scanner": "scanner-primary", "fingerprint": "14b3a267eec7363e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8dffee843ab030a7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/bootstrap.test.ts:225"}, "properties": {"repobilityId": "48e355b3c7bac7e2", "scanner": "scanner-primary", "fingerprint": "8dffee843ab030a7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9fae0b58271f3224", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/gameProgress.test.ts:286"}, "properties": {"repobilityId": "ea007c0a221b19a1", "scanner": "scanner-primary", "fingerprint": "9fae0b58271f3224", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-71fb73b6d2f71599", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/hiddenInvestigation.test.ts:96"}, "properties": {"repobilityId": "3f114f67b88ed6a7", "scanner": "scanner-primary", "fingerprint": "71fb73b6d2f71599", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9de7c78b8921bc99", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/encounters.test.ts:106"}, "properties": {"repobilityId": "3cdf94bcd4ce78ac", "scanner": "scanner-primary", "fingerprint": "9de7c78b8921bc99", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-08cf548d2d6bfd79", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/upkeep.test.ts:110"}, "properties": {"repobilityId": "4b563a4c1cb73403", "scanner": "scanner-primary", "fingerprint": "08cf548d2d6bfd79", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-34298fd027d0bf33", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/investigatorAI.test.ts:324"}, "properties": {"repobilityId": "58ea0f0d90899729", "scanner": "scanner-primary", "fingerprint": "34298fd027d0bf33", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-58e221c5d6e3dc4e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/messageBus.test.ts:184"}, "properties": {"repobilityId": "6844a063aae8d1a4", "scanner": "scanner-primary", "fingerprint": "58e221c5d6e3dc4e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-faf8674b29ab1dc0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/effectsExecutor.test.ts:76"}, "properties": {"repobilityId": "25f7c5dfab29bb16", "scanner": "scanner-primary", "fingerprint": "faf8674b29ab1dc0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de298275aeb0d112", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/turnLoop.test.ts:109"}, "properties": {"repobilityId": "8f148b37550ee936", "scanner": "scanner-primary", "fingerprint": "de298275aeb0d112", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3c3a250aeb8ee4d2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/monsterActions.test.ts:275"}, "properties": {"repobilityId": "63fa6c073a9eb218", "scanner": "scanner-primary", "fingerprint": "3c3a250aeb8ee4d2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9ae04180b6a72d19", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/monsterBehavior.test.ts:178"}, "properties": {"repobilityId": "e0dc59e78f35a6ee", "scanner": "scanner-primary", "fingerprint": "9ae04180b6a72d19", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b276d19e12c2ec5b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/dying.test.ts:109"}, "properties": {"repobilityId": "c5a6d3fcec871587", "scanner": "scanner-primary", "fingerprint": "b276d19e12c2ec5b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-17886dde736fa90c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/keeperAI.test.ts:223"}, "properties": {"repobilityId": "b4417c26235874a5", "scanner": "scanner-primary", "fingerprint": "17886dde736fa90c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f75695d4b0a4a427", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/statusEffects.test.ts:228"}, "properties": {"repobilityId": "f4a7e5bd97679f3a", "scanner": "scanner-primary", "fingerprint": "f75695d4b0a4a427", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-645bbeb06f8fd928", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/shared/src/game/ally.test.ts:69"}, "properties": {"repobilityId": "ceb1aea1e14f55b3", "scanner": "scanner-primary", "fingerprint": "645bbeb06f8fd928", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-691c1cbd442bcc47", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/calibration/src/components/Hotspot.tsx:94"}, "properties": {"repobilityId": "c9adf309b84ff0a0", "scanner": "scanner-primary", "fingerprint": "691c1cbd442bcc47", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-65ede0157824da2e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/index.ts:32"}, "properties": {"repobilityId": "ac04c2b36447664c", "scanner": "scanner-primary", "fingerprint": "65ede0157824da2e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-52c22eb1bf625e00", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/seed.ts:23"}, "properties": {"repobilityId": "d4a3c0235ac3e127", "scanner": "scanner-primary", "fingerprint": "52c22eb1bf625e00", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a8012d6074090a74", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/migrate.ts:3356"}, "properties": {"repobilityId": "aa8e63b9d28ff8b6", "scanner": "scanner-primary", "fingerprint": "a8012d6074090a74", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-34408a3519013ca7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/server/src/db/seeds/talisman-templates.ts:134"}, "properties": {"repobilityId": "a057790baab07ea5", "scanner": "scanner-primary", "fingerprint": "34408a3519013ca7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-43c077bacd2bfaf3", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in scripts/preflight.js:42"}, "properties": {"repobilityId": "2cac2a29937e82e4", "scanner": "scanner-primary", "fingerprint": "43c077bacd2bfaf3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preflight.js"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-5d20c5a897aae933", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in scripts/g1-sandbox/restore-mythos-descriptions.mjs:25"}, "properties": {"repobilityId": "1598df8c7584ef23", "scanner": "scanner-primary", "fingerprint": "5d20c5a897aae933", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/g1-sandbox/restore-mythos-descriptions.mjs"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-3c46a7170b2234d7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-card-designer.html:991"}, "properties": {"repobilityId": "e4028b3e88f7d46d", "scanner": "scanner-primary", "fingerprint": "3c46a7170b2234d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-card-designer.html"}, "region": {"startLine": 991}}}]}, {"ruleId": "scanner-f317f9ecc56fec6c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-investigator-designer.html:665"}, "properties": {"repobilityId": "10af80a95ebf7b46", "scanner": "scanner-primary", "fingerprint": "f317f9ecc56fec6c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-investigator-designer.html"}, "region": {"startLine": 665}}}]}, {"ruleId": "scanner-fe666e82af276087", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-scenario-editor.html:707"}, "properties": {"repobilityId": "2cf13558bbb62e06", "scanner": "scanner-primary", "fingerprint": "fe666e82af276087", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-scenario-editor.html"}, "region": {"startLine": 707}}}]}, {"ruleId": "scanner-756387e5f5f1b334", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-rulebook-viewer.html:435"}, "properties": {"repobilityId": "c51210ecee846992", "scanner": "scanner-primary", "fingerprint": "756387e5f5f1b334", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-rulebook-viewer.html"}, "region": {"startLine": 435}}}]}, {"ruleId": "scanner-7225006b6fef290d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-ai-console.js:84"}, "properties": {"repobilityId": "4f5e2f91a7a8b265", "scanner": "scanner-primary", "fingerprint": "7225006b6fef290d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-ai-console.js"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-d5b63d37dabba1cd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-team-spirit.html:296"}, "properties": {"repobilityId": "4054242178e67b7e", "scanner": "scanner-primary", "fingerprint": "d5b63d37dabba1cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-team-spirit.html"}, "region": {"startLine": 296}}}]}, {"ruleId": "scanner-5248d39faafacf1d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-campaign.html:665"}, "properties": {"repobilityId": "1d00c3e1d39d6bbb", "scanner": "scanner-primary", "fingerprint": "5248d39faafacf1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-campaign.html"}, "region": {"startLine": 665}}}]}, {"ruleId": "scanner-e45b7c20259e081a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-enemy-tier.html:398"}, "properties": {"repobilityId": "6ac3e790f3b06bfa", "scanner": "scanner-primary", "fingerprint": "e45b7c20259e081a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-enemy-tier.html"}, "region": {"startLine": 398}}}]}, {"ruleId": "scanner-b51e10892400ea8e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-shared.js:849"}, "properties": {"repobilityId": "d3de4bbe06ee03c9", "scanner": "scanner-primary", "fingerprint": "b51e10892400ea8e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-shared.js"}, "region": {"startLine": 849}}}]}, {"ruleId": "scanner-ed5c571b4d2b6dc3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-proficiency.html:275"}, "properties": {"repobilityId": "0db42c81f2887c82", "scanner": "scanner-primary", "fingerprint": "ed5c571b4d2b6dc3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-proficiency.html"}, "region": {"startLine": 275}}}]}, {"ruleId": "scanner-0bac93a668a13aff", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in packages/client/public/admin/login.html:76"}, "properties": {"repobilityId": "882c90c5e3153ee5", "scanner": "scanner-primary", "fingerprint": "0bac93a668a13aff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/login.html"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-08a19365450cbfe1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/index.html:247"}, "properties": {"repobilityId": "cafe06776dd54f90", "scanner": "scanner-primary", "fingerprint": "08a19365450cbfe1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/index.html"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-3c0d592bde1d47ff", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-location-designer.html:820"}, "properties": {"repobilityId": "61373763507f0c59", "scanner": "scanner-primary", "fingerprint": "3c0d592bde1d47ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-location-designer.html"}, "region": {"startLine": 820}}}]}, {"ruleId": "scanner-7273783739ae50ef", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-character-creation.html:583"}, "properties": {"repobilityId": "67cd0be1a0dad8cf", "scanner": "scanner-primary", "fingerprint": "7273783739ae50ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-character-creation.html"}, "region": {"startLine": 583}}}]}, {"ruleId": "scanner-66eec95ab75ebb1a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-card-checker.html:188"}, "properties": {"repobilityId": "c7fba3109c829d18", "scanner": "scanner-primary", "fingerprint": "66eec95ab75ebb1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-card-checker.html"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-e9cefa9479424663", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-boss-combat.html:518"}, "properties": {"repobilityId": "69fa285109f8df59", "scanner": "scanner-primary", "fingerprint": "e9cefa9479424663", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-boss-combat.html"}, "region": {"startLine": 518}}}]}, {"ruleId": "scanner-bf592beb6370fc8f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-talent-skill.html:326"}, "properties": {"repobilityId": "6fee979b633bf1c4", "scanner": "scanner-primary", "fingerprint": "bf592beb6370fc8f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-talent-skill.html"}, "region": {"startLine": 326}}}]}, {"ruleId": "scanner-b8b0c51bc79a66bc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-damage-curve.html:484"}, "properties": {"repobilityId": "4cf64f2478f2bb5e", "scanner": "scanner-primary", "fingerprint": "b8b0c51bc79a66bc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-damage-curve.html"}, "region": {"startLine": 484}}}]}, {"ruleId": "scanner-ae5b5a053366a737", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-forge-craft.html:419"}, "properties": {"repobilityId": "760b32987644874d", "scanner": "scanner-primary", "fingerprint": "ae5b5a053366a737", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-forge-craft.html"}, "region": {"startLine": 419}}}]}, {"ruleId": "scanner-59da698f31a63415", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-system-diag.html:223"}, "properties": {"repobilityId": "7a60c0215282673d", "scanner": "scanner-primary", "fingerprint": "59da698f31a63415", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-system-diag.html"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-2c5f60a12094c872", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-axis-series.html:177"}, "properties": {"repobilityId": "a33ac648b0fc6c9e", "scanner": "scanner-primary", "fingerprint": "2c5f60a12094c872", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-axis-series.html"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-21b31a0b5e9e4e6e", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in packages/client/public/admin/admin-axis-series.html:455"}, "properties": {"repobilityId": "eba9a0036f1d3d19", "scanner": "scanner-primary", "fingerprint": "21b31a0b5e9e4e6e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-axis-series.html"}, "region": {"startLine": 455}}}]}, {"ruleId": "scanner-a792695dc1b034d0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-boot.js:78"}, "properties": {"repobilityId": "84f34d3112c99099", "scanner": "scanner-primary", "fingerprint": "a792695dc1b034d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-boot.js"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-cc1af9ae1c042e5d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-dice-probability.html:564"}, "properties": {"repobilityId": "b473db16a83feb3a", "scanner": "scanner-primary", "fingerprint": "cc1af9ae1c042e5d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-dice-probability.html"}, "region": {"startLine": 564}}}]}, {"ruleId": "scanner-a441f6cb4da64490", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/sim-card-economy.html:461"}, "properties": {"repobilityId": "8c4466ceb94c5fe5", "scanner": "scanner-primary", "fingerprint": "a441f6cb4da64490", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/sim-card-economy.html"}, "region": {"startLine": 461}}}]}, {"ruleId": "scanner-0a9ef0731a914d1e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-enemy-designer.html:346"}, "properties": {"repobilityId": "e187a2baece98b0a", "scanner": "scanner-primary", "fingerprint": "0a9ef0731a914d1e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-enemy-designer.html"}, "region": {"startLine": 346}}}]}, {"ruleId": "scanner-d419bb1af6cb3b1d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/client/public/admin/admin-keeper-designer.html:976"}, "properties": {"repobilityId": "3c78a7ccb2c600d4", "scanner": "scanner-primary", "fingerprint": "d419bb1af6cb3b1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/public/admin/admin-keeper-designer.html"}, "region": {"startLine": 976}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d670c8137537adc0", "level": "note", "message": {"text": "Very large file: packages/client/public/admin/admin-shared.js (1747 lines)"}, "properties": {"repobilityId": "d31327c9dbdbf53b", "scanner": "scanner-primary", "fingerprint": "d670c8137537adc0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4b3d8f9146da445e", "level": "note", "message": {"text": "Very large file: packages/client/public/admin/admin-card-prompt.js (999 lines)"}, "properties": {"repobilityId": "a1c5f3261663cccc", "scanner": "scanner-primary", "fingerprint": "4b3d8f9146da445e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0d531d8ebc903e86", "level": "note", "message": {"text": "Very large file: packages/client/public/admin/admin-ai-tasks/geminiDirectClient.js (1208 lines)"}, "properties": {"repobilityId": "be91a27440955b33", "scanner": "scanner-primary", "fingerprint": "0d531d8ebc903e86", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-61a7fae6b9f5ae74", "level": "note", "message": {"text": "Very large file: packages/client/src/screens/TestScenarioScreen.tsx (1621 lines)"}, "properties": {"repobilityId": "a2d6a601002b7ab4", "scanner": "scanner-primary", "fingerprint": "61a7fae6b9f5ae74", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-045a17ad5c577faa", "level": "note", "message": {"text": "Very large file: packages/shared/src/game/ruleEngine.ts (1530 lines)"}, "properties": {"repobilityId": "32ad4253e0ee2c1e", "scanner": "scanner-primary", "fingerprint": "045a17ad5c577faa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-10733ec98d69e5af", "level": "note", "message": {"text": "Very large file: packages/server/src/routes/stages.ts (1776 lines)"}, "properties": {"repobilityId": "68cf39eac6a588a8", "scanner": "scanner-primary", "fingerprint": "10733ec98d69e5af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fee7127e1b1a610d", "level": "note", "message": {"text": "Very large file: packages/server/src/routes/keeper.ts (1025 lines)"}, "properties": {"repobilityId": "8fce38e8fa06f0c5", "scanner": "scanner-primary", "fingerprint": "fee7127e1b1a610d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-799cd2821e9c9011", "level": "note", "message": {"text": "Very large file: packages/server/src/routes/campaigns.ts (1260 lines)"}, "properties": {"repobilityId": "e8241bce4b600b36", "scanner": "scanner-primary", "fingerprint": "799cd2821e9c9011", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b60ff03ee911a0e4", "level": "note", "message": {"text": "Very large file: packages/server/src/db/migrate.ts (3451 lines)"}, "properties": {"repobilityId": "e70ca26672acd8fd", "scanner": "scanner-primary", "fingerprint": "b60ff03ee911a0e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "83c369aa6143fb00", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-f1f0c52db7c97cef", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/client/package.json"}, "properties": {"repobilityId": "708197ec3b624f59", "scanner": "scanner-primary", "fingerprint": "f1f0c52db7c97cef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cff9b333afafcbaf", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/calibration/package.json"}, "properties": {"repobilityId": "f18e2ffa18a09a24", "scanner": "scanner-primary", "fingerprint": "cff9b333afafcbaf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/calibration/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b739f2f2be1d714d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/server/package.json"}, "properties": {"repobilityId": "d7cb4fafc3b292b2", "scanner": "scanner-primary", "fingerprint": "b739f2f2be1d714d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4bae004538847e10", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f1281c09666d8a93", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "ec32ca40ff6ad895", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "76ba22608202282d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "af8b0e3d907cca35", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6482399d3607f8a1", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a0a311faa272229", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/preflight.js:77"}, "properties": {"repobilityId": "d2c0218bdc9902de", "scanner": "scanner-primary", "fingerprint": "4a0a311faa272229", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8078b682f03f0d9", "level": "none", "message": {"text": "Commented-code block (9 lines) in scripts/g1-sandbox/restore-mythos-descriptions.mjs:1"}, "properties": {"repobilityId": "871be58ce7493e7c", "scanner": "scanner-primary", "fingerprint": "f8078b682f03f0d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0dad9648c2db5b5", "level": "note", "message": {"text": "Legacy-named symbol `withOld` in scripts/g1-sandbox/41-verify-migration029.mjs:69"}, "properties": {"repobilityId": "4e985fc04b5542dd", "scanner": "scanner-primary", "fingerprint": "e0dad9648c2db5b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-31c78b0864e02011", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/41-verify-migration029.mjs:11"}, "properties": {"repobilityId": "5b7f333eeba6ec25", "scanner": "scanner-primary", "fingerprint": "31c78b0864e02011", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b380d63c28c63d32", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/backfill-behavior-scripts.mjs:23"}, "properties": {"repobilityId": "9ee894c8bba5e2b1", "scanner": "scanner-primary", "fingerprint": "b380d63c28c63d32", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-addbd6432c7ce27d", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/g1-sandbox/15-create-j-faction-cards.mjs:1"}, "properties": {"repobilityId": "1e43ba92527fb3b8", "scanner": "scanner-primary", "fingerprint": "addbd6432c7ce27d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bf48d0170f9b4297", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/g1-sandbox/16-create-p-faction-cards.mjs:1"}, "properties": {"repobilityId": "cc382be0d98642ec", "scanner": "scanner-primary", "fingerprint": "bf48d0170f9b4297", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75506d06412be51c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/api.mjs:32"}, "properties": {"repobilityId": "5b6d136ad71df9a9", "scanner": "scanner-primary", "fingerprint": "75506d06412be51c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6d8d3f3868fbc6a5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/read-cred-and-login.mjs:29"}, "properties": {"repobilityId": "5478bd2a22f67536", "scanner": "scanner-primary", "fingerprint": "6d8d3f3868fbc6a5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2d9dd48210442c75", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/g1-sandbox/00-login.mjs:16"}, "properties": {"repobilityId": "825e15f287521c5b", "scanner": "scanner-primary", "fingerprint": "2d9dd48210442c75", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0906f26964a057bd", "level": "none", "message": {"text": "Commented-code block (9 lines) in scripts/g1-sandbox/lib/api-key.mjs:1"}, "properties": {"repobilityId": "db4f43d5615a7416", "scanner": "scanner-primary", "fingerprint": "0906f26964a057bd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-97fa4509d4ca7039", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/client/public/admin/admin-ai-console.js:204"}, "properties": {"repobilityId": "f09a3c212c8ba4ed", "scanner": "scanner-primary", "fingerprint": "97fa4509d4ca7039", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-135a6fd6fe166150", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/client/public/admin/admin-shared.js:25"}, "properties": {"repobilityId": "720d7cfad94a5f5a", "scanner": "scanner-primary", "fingerprint": "135a6fd6fe166150", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1dc5ffcd6cf56a4f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/client/public/admin/admin-shared.js:73"}, "properties": {"repobilityId": "a21c31376e7f1689", "scanner": "scanner-primary", "fingerprint": "1dc5ffcd6cf56a4f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0467ff7f594088b0", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/client/public/admin/admin-ai-tasks/itemMapper.js:7"}, "properties": {"repobilityId": "b9fe509caf93eae4", "scanner": "scanner-primary", "fingerprint": "0467ff7f594088b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bf80fe1441947d4e", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/client/public/admin/admin-ai-tasks/geminiDirectClient.js:77"}, "properties": {"repobilityId": "69a022f987331f2c", "scanner": "scanner-primary", "fingerprint": "bf80fe1441947d4e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0baa99c62956c8d", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/calibration/src/components/Hotspot.tsx:67"}, "properties": {"repobilityId": "2e6c1c04a7773ff4", "scanner": "scanner-primary", "fingerprint": "d0baa99c62956c8d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d03c9bd2661a8bf5", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/server/src/routes/cards.ts:275"}, "properties": {"repobilityId": "92eca4e1c5daf52a", "scanner": "scanner-primary", "fingerprint": "d03c9bd2661a8bf5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ace8d7dec98f8d6a", "level": "note", "message": {"text": "Legacy-named symbol `Claude_Code_\u5361\u7247\u5347\u7d1a\u7cfb\u7d71\u91cd\u69cb_v1` in packages/server/src/db/migrate.ts:2738"}, "properties": {"repobilityId": "9045491b2c15679f", "scanner": "scanner-primary", "fingerprint": "ace8d7dec98f8d6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6a6cdf198272704c", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/server/src/db/migrate.ts:2317"}, "properties": {"repobilityId": "660bfeed04736f32", "scanner": "scanner-primary", "fingerprint": "6a6cdf198272704c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0b5e7cb1208a7cd", "level": "note", "message": {"text": "13 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "2737b8666c1f7eeb", "scanner": "scanner-primary", "fingerprint": "b0b5e7cb1208a7cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-e276d767ea7168bb", "level": "warning", "message": {"text": "Frontend route `/scenario/:stageId/briefing` has no Link/navigate to it \u2014 packages/client/src/App.tsx"}, "properties": {"repobilityId": "a67cece610817d5a", "scanner": "scanner-primary", "fingerprint": "e276d767ea7168bb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-b4df2adb5c84fca0", "level": "warning", "message": {"text": "Frontend route `/scenario/:stageId` has no Link/navigate to it \u2014 packages/client/src/App.tsx"}, "properties": {"repobilityId": "2b942137a47c6489", "scanner": "scanner-primary", "fingerprint": "b4df2adb5c84fca0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-cd06b33f6e06a2c0", "level": "warning", "message": {"text": "Frontend route `/admin/calibration` has no Link/navigate to it \u2014 packages/client/src/App.tsx"}, "properties": {"repobilityId": "0e769d887b2ff479", "scanner": "scanner-primary", "fingerprint": "cd06b33f6e06a2c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-8bd5b11f37c6cfcf", "level": "note", "message": {"text": "Unused endpoint: POST /task"}, "properties": {"repobilityId": "cfa01afa46dee8a9", "scanner": "scanner-primary", "fingerprint": "8bd5b11f37c6cfcf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3308cf650fcc235", "level": "note", "message": {"text": "Unused endpoint: GET /api/cards/export"}, "properties": {"repobilityId": "6da3b28ff3c7691d", "scanner": "scanner-primary", "fingerprint": "a3308cf650fcc235", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee4aa5ddab88c9dc", "level": "note", "message": {"text": "Unused endpoint: GET /api/auth/me"}, "properties": {"repobilityId": "048cc14b66235eb9", "scanner": "scanner-primary", "fingerprint": "ee4aa5ddab88c9dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5a39262ac205120", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/logout"}, "properties": {"repobilityId": "df240a05dcdd9bf3", "scanner": "scanner-primary", "fingerprint": "d5a39262ac205120", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a9c9bb8955f09d50", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/locations/stats/overview"}, "properties": {"repobilityId": "534e8729400abef2", "scanner": "scanner-primary", "fingerprint": "a9c9bb8955f09d50", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c120ebc8d6f5520", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/locations/tags"}, "properties": {"repobilityId": "c87bcfa394a92174", "scanner": "scanner-primary", "fingerprint": "9c120ebc8d6f5520", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-225ab8299b91dd1e", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/locations/tags"}, "properties": {"repobilityId": "4d36a94be742bd66", "scanner": "scanner-primary", "fingerprint": "225ab8299b91dd1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c582dad3ec2b46ec", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/locations"}, "properties": {"repobilityId": "29eb88618d6c9f3e", "scanner": "scanner-primary", "fingerprint": "c582dad3ec2b46ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6dc7e3d36f1663a6", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/locations"}, "properties": {"repobilityId": "ae7f9f91d2e62685", "scanner": "scanner-primary", "fingerprint": "6dc7e3d36f1663a6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c239872d7d41186e", "level": "note", "message": {"text": "Unused endpoint: GET /api/talent-trees/export"}, "properties": {"repobilityId": "afc3b3fe7222459d", "scanner": "scanner-primary", "fingerprint": "c239872d7d41186e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fe8c0b50b314cb3", "level": "note", "message": {"text": "Unused endpoint: POST /api/talent-trees/import"}, "properties": {"repobilityId": "2a7a50a0a3c23d0e", "scanner": "scanner-primary", "fingerprint": "5fe8c0b50b314cb3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81d7dd2a10a32988", "level": "note", "message": {"text": "Unused endpoint: GET /api/talent-trees/compare"}, "properties": {"repobilityId": "e06fb2570b51d1d7", "scanner": "scanner-primary", "fingerprint": "81d7dd2a10a32988", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7fdade196ec015b7", "level": "note", "message": {"text": "Unused endpoint: GET /api/talent-trees"}, "properties": {"repobilityId": "22b3d25a31f0a733", "scanner": "scanner-primary", "fingerprint": "7fdade196ec015b7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93fff78320726c71", "level": "note", "message": {"text": "Unused endpoint: GET /api/play/stages"}, "properties": {"repobilityId": "6efd98c32e153e02", "scanner": "scanner-primary", "fingerprint": "93fff78320726c71", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c53c63426bdae034", "level": "note", "message": {"text": "Unused endpoint: GET /api/play/investigators"}, "properties": {"repobilityId": "c3c0d25d18e1b9f1", "scanner": "scanner-primary", "fingerprint": "c53c63426bdae034", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bad4b14bec8e13d5", "level": "note", "message": {"text": "Unused endpoint: GET /api/materials/categories"}, "properties": {"repobilityId": "4940563801d95fb0", "scanner": "scanner-primary", "fingerprint": "bad4b14bec8e13d5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22e1617e5d38dc4c", "level": "note", "message": {"text": "Unused endpoint: GET /api/forging/stats"}, "properties": {"repobilityId": "38fb53b1f16f9fda", "scanner": "scanner-primary", "fingerprint": "22e1617e5d38dc4c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a572d90129384d4", "level": "note", "message": {"text": "Unused endpoint: GET /api/crafting/stats"}, "properties": {"repobilityId": "9a064d741a0647f2", "scanner": "scanner-primary", "fingerprint": "6a572d90129384d4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7a5a10e74e07636", "level": "note", "message": {"text": "Unused endpoint: GET /api/combat-styles/export"}, "properties": {"repobilityId": "947704abacc06173", "scanner": "scanner-primary", "fingerprint": "d7a5a10e74e07636", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-054a346f0cd86173", "level": "note", "message": {"text": "Unused endpoint: GET /api/combat-styles/stats"}, "properties": {"repobilityId": "3935e434d9f20024", "scanner": "scanner-primary", "fingerprint": "054a346f0cd86173", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0dc9d74ed9f41fe4", "level": "note", "message": {"text": "Unused endpoint: GET /api/combat-styles"}, "properties": {"repobilityId": "cc2bbab84ff2394b", "scanner": "scanner-primary", "fingerprint": "0dc9d74ed9f41fe4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2883eadd42f62387", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/calibration/save"}, "properties": {"repobilityId": "0bf6524f88c1c4bc", "scanner": "scanner-primary", "fingerprint": "2883eadd42f62387", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-652ef285c49acc53", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/keeper/stats/overview"}, "properties": {"repobilityId": "9b777f280c1e249b", "scanner": "scanner-primary", "fingerprint": "652ef285c49acc53", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fbb892f196c49eba", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/keeper/balance"}, "properties": {"repobilityId": "80201e4f4b8cc253", "scanner": "scanner-primary", "fingerprint": "fbb892f196c49eba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8b3f3ab372c0ae6", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/keeper/balance/simulate"}, "properties": {"repobilityId": "67cef9d5f79be300", "scanner": "scanner-primary", "fingerprint": "b8b3f3ab372c0ae6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b3a06786ddbd31e4", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/keeper/mythos-cards"}, "properties": {"repobilityId": "503a1daaec78295b", "scanner": "scanner-primary", "fingerprint": "b3a06786ddbd31e4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c92070727bf464d2", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/keeper/mythos-cards"}, "properties": {"repobilityId": "c5b4f63f2e07496e", "scanner": "scanner-primary", "fingerprint": "c92070727bf464d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a19afdc60d0ad47e", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/keeper/encounter-cards"}, "properties": {"repobilityId": "8f1833fbaad2ee51", "scanner": "scanner-primary", "fingerprint": "a19afdc60d0ad47e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14692e9d634fae2a", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/keeper/encounter-cards"}, "properties": {"repobilityId": "c288b58fc4e17328", "scanner": "scanner-primary", "fingerprint": "14692e9d634fae2a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5411e3b96d6e5903", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/monsters/stats/overview"}, "properties": {"repobilityId": "73e182d96bb8bf6b", "scanner": "scanner-primary", "fingerprint": "5411e3b96d6e5903", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72e6ed9cf65270d0", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/monsters/families"}, "properties": {"repobilityId": "0e0a04f33a00c9ba", "scanner": "scanner-primary", "fingerprint": "72e6ed9cf65270d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-96cc7328373cae6a", "level": "note", "message": {"text": "Unused endpoint: GET /api/team-spirits/export"}, "properties": {"repobilityId": "295eaef6c5bc4137", "scanner": "scanner-primary", "fingerprint": "96cc7328373cae6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60a78f6c114fdfea", "level": "note", "message": {"text": "Unused endpoint: GET /api/team-spirits/stats"}, "properties": {"repobilityId": "311e2657ba8a6d37", "scanner": "scanner-primary", "fingerprint": "60a78f6c114fdfea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05cbd246f809841b", "level": "note", "message": {"text": "Unused endpoint: GET /api/team-spirits/compare"}, "properties": {"repobilityId": "dbc02813b40239c6", "scanner": "scanner-primary", "fingerprint": "05cbd246f809841b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f2dd5b8e1b49b1e", "level": "note", "message": {"text": "Unused endpoint: GET /api/ai-console/bridge/health"}, "properties": {"repobilityId": "3c7832f15173399f", "scanner": "scanner-primary", "fingerprint": "1f2dd5b8e1b49b1e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6321c3c89508db6f", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/ai-console/tasks/clear-history"}, "properties": {"repobilityId": "d180d5a353d8d9d3", "scanner": "scanner-primary", "fingerprint": "6321c3c89508db6f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0cc2dba1b39712d4", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/diag/campaigns-schema"}, "properties": {"repobilityId": "f0adc4a8062597f1", "scanner": "scanner-primary", "fingerprint": "0cc2dba1b39712d4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0984dc171bbcd25a", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/diag/run-migration-028"}, "properties": {"repobilityId": "fcfea2eed2116765", "scanner": "scanner-primary", "fingerprint": "0984dc171bbcd25a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dec45df3f48d6581", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/db-diag/rerun-axis-migrations"}, "properties": {"repobilityId": "9f3d1495ca4c4651", "scanner": "scanner-primary", "fingerprint": "dec45df3f48d6581", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-28ab0e625b6565a4", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/threat-types"}, "properties": {"repobilityId": "7f9f7258372ab470", "scanner": "scanner-primary", "fingerprint": "28ab0e625b6565a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f932dbc36e2d4da4", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/talisman-types"}, "properties": {"repobilityId": "fd267004a260860e", "scanner": "scanner-primary", "fingerprint": "f932dbc36e2d4da4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-164b979c14754ad2", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/investigators/preset-matrix"}, "properties": {"repobilityId": "1b908bd9f27d4987", "scanner": "scanner-primary", "fingerprint": "164b979c14754ad2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a774ea9f8b014ad", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/investigators/stats"}, "properties": {"repobilityId": "9357002add6df5b1", "scanner": "scanner-primary", "fingerprint": "9a774ea9f8b014ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-267bbb57ad2c9375", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/investigators/value-matrix"}, "properties": {"repobilityId": "c5059402cc800872", "scanner": "scanner-primary", "fingerprint": "267bbb57ad2c9375", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14a107339a4fbd79", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/investigators/value-stats"}, "properties": {"repobilityId": "3c45ee9ed8bd6fa0", "scanner": "scanner-primary", "fingerprint": "14a107339a4fbd79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e69cb27623bec26", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/investigators/recalculate-all"}, "properties": {"repobilityId": "bd9894ab99d87cfc", "scanner": "scanner-primary", "fingerprint": "1e69cb27623bec26", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1826fac95c85dd96", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/value-config"}, "properties": {"repobilityId": "ade0b4b47b18f925", "scanner": "scanner-primary", "fingerprint": "1826fac95c85dd96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb71466234092032", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/admin/value-config"}, "properties": {"repobilityId": "bafe48da89365c08", "scanner": "scanner-primary", "fingerprint": "eb71466234092032", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e3d9f4d70544f3a", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/faction-attribute-map"}, "properties": {"repobilityId": "cc9f73aeb40ccef4", "scanner": "scanner-primary", "fingerprint": "3e3d9f4d70544f3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55192fea2f624772", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/proficiencies"}, "properties": {"repobilityId": "b398979bd0e05e9c", "scanner": "scanner-primary", "fingerprint": "55192fea2f624772", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}