{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4e54058797798ff6", "name": "Possibly dead Python function: correct_typos", "shortDescription": {"text": "Possibly dead Python function: correct_typos"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9f2b6d651fa81f5", "name": "Possibly dead Python function: extract_entities", "shortDescription": {"text": "Possibly dead Python function: extract_entities"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df16eeecebaab6d7", "name": "Possibly dead Python function: verify_token_sync", "shortDescription": {"text": "Possibly dead Python function: verify_token_sync"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1043a8db80a7c0af", "name": "Possibly dead Python function: index_async", "shortDescription": {"text": "Possibly dead Python function: index_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98144cc74efb4188", "name": "Possibly dead Python function: hybrid_async", "shortDescription": {"text": "Possibly dead Python function: hybrid_async"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08767ba66686c0e4", "name": "Possibly dead Python function: hybrid_sync", "shortDescription": {"text": "Possibly dead Python function: hybrid_sync"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db9d31204f02786f", "name": "Possibly dead Python function: ensure_session", "shortDescription": {"text": "Possibly dead Python function: ensure_session"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d230211eea764242", "name": "Possibly dead Python function: save_message", "shortDescription": {"text": "Possibly dead Python function: save_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16829d3cf9897060", "name": "Possibly dead Python function: expand_on_zero_hits", "shortDescription": {"text": "Possibly dead Python function: expand_on_zero_hits"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b024e35aefffc95", "name": "Possibly dead Python function: update_opt_ins", "shortDescription": {"text": "Possibly dead Python function: update_opt_ins"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5354b51ee309fa36", "name": "Possibly dead Python function: process_header_only", "shortDescription": {"text": "Possibly dead Python function: process_header_only"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f36b6a02bee5c716", "name": "Possibly dead Python function: pdf_to_chunks", "shortDescription": {"text": "Possibly dead Python function: pdf_to_chunks"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2223e3d3747edce", "name": "Possibly dead Python function: harvest_daily_job", "shortDescription": {"text": "Possibly dead Python function: harvest_daily_job"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5749f47147b5d989", "name": "Possibly dead Python function: harvest_koha_weekly_job", "shortDescription": {"text": "Possibly dead Python function: harvest_koha_weekly_job"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af358506463db6f0", "name": "Possibly dead Python function: backup_s3_job", "shortDescription": {"text": "Possibly dead Python function: backup_s3_job"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7918d128029371e", "name": "Possibly dead Python function: feedback_export_job", "shortDescription": {"text": "Possibly dead Python function: feedback_export_job"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-099c6edfe7a3d68f", "name": "Possibly dead Python function: metrics_report_job", "shortDescription": {"text": "Possibly dead Python function: metrics_report_job"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a51621a124d9de9f", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a96dfad48a208535", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/auto-login.js:40", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/auto-login.js:40"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b9ab1a2969e1cfa", "name": "Insecure pattern 'insert_adjacent_html' in public/auto-login.js:134", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in public/auto-login.js:134"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 21 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-48ff0c3aa5a0d016", "name": "Legacy-named symbol `test_chat_agent_timeout_falls_back_to_legacy` in tests/unit/test_chat_service.py:652", "shortDescription": {"text": "Legacy-named symbol `test_chat_agent_timeout_falls_back_to_legacy` in tests/unit/test_chat_service.py:652"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ad8dede25267a22", "name": "Legacy-named symbol `test_none_user_id_is_legacy` in tests/services/test_bucket.py:10", "shortDescription": {"text": "Legacy-named symbol `test_none_user_id_is_legacy` in tests/services/test_bucket.py:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fb450d14ccfade8", "name": "Commented-code block (5 lines) in tests/services/test_agent_orchestrator.py:514", "shortDescription": {"text": "Commented-code block (5 lines) in tests/services/test_agent_orchestrator.py:514"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-787453df5b7c2841", "name": "Commented-code block (5 lines) in public/auto-login.js:9", "shortDescription": {"text": "Commented-code block (5 lines) in public/auto-login.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc2164d580be9f46", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/auto-login.js:356", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/auto-login.js:356"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3965318ecf48aa77", "name": "Commented-code block (5 lines) in src/guia/routing/rules.py:91", "shortDescription": {"text": "Commented-code block (5 lines) in src/guia/routing/rules.py:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96cbc590e7915fa6", "name": "Commented-code block (5 lines) in src/guia/worker/celery_app.py:11", "shortDescription": {"text": "Commented-code block (5 lines) in src/guia/worker/celery_app.py:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7a078b6a00e7923", "name": "Commented-code block (5 lines) in src/guia/services/harvester.py:560", "shortDescription": {"text": "Commented-code block (5 lines) in src/guia/services/harvester.py:560"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eda77d12f297ed0e", "name": "Legacy-named symbol `model_copy` in src/guia/services/search.py:76", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/guia/services/search.py:76"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bae8253ad1b48c4b", "name": "Legacy-named symbol `agent_orchestrator_timeout_fallback_legacy` in src/guia/services/chat.py:636", "shortDescription": {"text": "Legacy-named symbol `agent_orchestrator_timeout_fallback_legacy` in src/guia/services/chat.py:636"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c36dc3abca95243", "name": "Commented-code block (7 lines) in src/guia/services/chat.py:594", "shortDescription": {"text": "Commented-code block (7 lines) in src/guia/services/chat.py:594"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd2ba607e6449217", "name": "Commented-code block (7 lines) in src/guia/channels/telegram_bot.py:79", "shortDescription": {"text": "Commented-code block (7 lines) in src/guia/channels/telegram_bot.py:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39a992880378c068", "name": "Commented-code block (5 lines) in src/guia/domain/chat.py:111", "shortDescription": {"text": "Commented-code block (5 lines) in src/guia/domain/chat.py:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AZURE_TENANT_ID`, `CHAINLIT_URL`, `GUIA_ADMIN_TOKEN`, `GUIA_S3_FEEDBACK_BUCKET`, `NVIDIA_NIM_API_KEY`, `OAUTH_KEYCLOAK_BASE_URL`, `OAUTH_KEYCLOAK_CLIENT_ID`, `OAUTH_KEYCLOAK_CLIENT_SECRET` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/guia/routing/gates.py:evaluate, src/guia/routing/gates.py:evaluate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/guia/audit/repository.py:close, src/guia/services/history.py:close, src/guia/services/telegram_link.py:close\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-490bc13bbc9ce961", "name": "FastAPI POST `embeddings` without auth dependency \u2014 src/guia/embeddings_sidecar.py:113", "shortDescription": {"text": "FastAPI POST `embeddings` without auth dependency \u2014 src/guia/embeddings_sidecar.py:113"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f57acab3802d24a2", "name": "FastAPI POST `chat` without auth dependency \u2014 src/guia/api/routes/chat.py:17", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 src/guia/api/routes/chat.py:17"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c03886a281daa6f", "name": "Unused endpoint: POST /api/embeddings", "shortDescription": {"text": "Unused endpoint: POST /api/embeddings"}, "fullDescription": {"text": "`src/guia/embeddings_sidecar.py` declares `POST /api/embeddings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3cb37cb885206e8f", "name": "Unused endpoint: POST /link", "shortDescription": {"text": "Unused endpoint: POST /link"}, "fullDescription": {"text": "`src/guia/api/routes/telegram_link.py` declares `POST /link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c1ab37c408f90c0", "name": "Unused endpoint: DELETE /link", "shortDescription": {"text": "Unused endpoint: DELETE /link"}, "fullDescription": {"text": "`src/guia/api/routes/telegram_link.py` declares `DELETE /link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/guia/api/routes/oai.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d297d86aa253fe", "name": "Unused endpoint: GET /audit", "shortDescription": {"text": "Unused endpoint: GET /audit"}, "fullDescription": {"text": "`src/guia/api/routes/admin.py` declares `GET /audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4884816c44204959", "name": "Unused endpoint: GET /feedback/stats", "shortDescription": {"text": "Unused endpoint: GET /feedback/stats"}, "fullDescription": {"text": "`src/guia/api/routes/admin.py` declares `GET /feedback/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0492a64e6bfbc3c", "name": "Unused endpoint: GET /feedback/export", "shortDescription": {"text": "Unused endpoint: GET /feedback/export"}, "fullDescription": {"text": "`src/guia/api/routes/admin.py` declares `GET /feedback/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e686634beeea0bb8", "name": "Unused endpoint: GET /export", "shortDescription": {"text": "Unused endpoint: GET /export"}, "fullDescription": {"text": "`src/guia/api/routes/profile.py` declares `GET /export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b30f4c0994a30b4", "name": "Unused endpoint: DELETE /", "shortDescription": {"text": "Unused endpoint: DELETE /"}, "fullDescription": {"text": "`src/guia/api/routes/profile.py` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0476989637783bc2", "name": "Unused endpoint: POST /opt-ins", "shortDescription": {"text": "Unused endpoint: POST /opt-ins"}, "fullDescription": {"text": "`src/guia/api/routes/profile.py` declares `POST /opt-ins` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff8da5fbc19c76d", "name": "Unused endpoint: POST /chat", "shortDescription": {"text": "Unused endpoint: POST /chat"}, "fullDescription": {"text": "`src/guia/api/routes/chat.py` declares `POST /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e91133f23b59e00c", "name": "Unused endpoint: POST /harvest", "shortDescription": {"text": "Unused endpoint: POST /harvest"}, "fullDescription": {"text": "`src/guia/api/routes/harvest.py` declares `POST /harvest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19060"}, "properties": {"repository": "SciBack/guia", "repoUrl": "https://github.com/SciBack/guia", "branch": "main"}, "results": [{"ruleId": "scanner-4e54058797798ff6", "level": "note", "message": {"text": "Possibly dead Python function: correct_typos"}, "properties": {"repobilityId": "ba13719a8903f3a0", "scanner": "scanner-primary", "fingerprint": "4e54058797798ff6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/nlp/speller.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9f2b6d651fa81f5", "level": "note", "message": {"text": "Possibly dead Python function: extract_entities"}, "properties": {"repobilityId": "9c6c991c213227c6", "scanner": "scanner-primary", "fingerprint": "c9f2b6d651fa81f5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/nlp/ner.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df16eeecebaab6d7", "level": "note", "message": {"text": "Possibly dead Python function: verify_token_sync"}, "properties": {"repobilityId": "649c6fa4bde7d896", "scanner": "scanner-primary", "fingerprint": "df16eeecebaab6d7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/auth/identity.py:224"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1043a8db80a7c0af", "level": "note", "message": {"text": "Possibly dead Python function: index_async"}, "properties": {"repobilityId": "d8e28cf34da20ef8", "scanner": "scanner-primary", "fingerprint": "1043a8db80a7c0af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/search/backend.py:110"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98144cc74efb4188", "level": "note", "message": {"text": "Possibly dead Python function: hybrid_async"}, "properties": {"repobilityId": "4dabc51f1ad65ad1", "scanner": "scanner-primary", "fingerprint": "98144cc74efb4188", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/search/backend.py:114"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08767ba66686c0e4", "level": "note", "message": {"text": "Possibly dead Python function: hybrid_sync"}, "properties": {"repobilityId": "f6c2194be4bab679", "scanner": "scanner-primary", "fingerprint": "08767ba66686c0e4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/search/backend.py:135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db9d31204f02786f", "level": "note", "message": {"text": "Possibly dead Python function: ensure_session"}, "properties": {"repobilityId": "5889fe64c679748f", "scanner": "scanner-primary", "fingerprint": "db9d31204f02786f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/services/history.py:86"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d230211eea764242", "level": "note", "message": {"text": "Possibly dead Python function: save_message"}, "properties": {"repobilityId": "ce82b858ebc3c2a4", "scanner": "scanner-primary", "fingerprint": "d230211eea764242", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/services/history.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16829d3cf9897060", "level": "note", "message": {"text": "Possibly dead Python function: expand_on_zero_hits"}, "properties": {"repobilityId": "9c9ad57e5360f2d7", "scanner": "scanner-primary", "fingerprint": "16829d3cf9897060", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/services/query_rewriter.py:126"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b024e35aefffc95", "level": "note", "message": {"text": "Possibly dead Python function: update_opt_ins"}, "properties": {"repobilityId": "b58d0408e5aebea5", "scanner": "scanner-primary", "fingerprint": "8b024e35aefffc95", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/services/profile.py:120"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5354b51ee309fa36", "level": "note", "message": {"text": "Possibly dead Python function: process_header_only"}, "properties": {"repobilityId": "146e2b300da1ed56", "scanner": "scanner-primary", "fingerprint": "5354b51ee309fa36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/pdf/grobid.py:59"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f36b6a02bee5c716", "level": "note", "message": {"text": "Possibly dead Python function: pdf_to_chunks"}, "properties": {"repobilityId": "35586c49008b2c64", "scanner": "scanner-primary", "fingerprint": "f36b6a02bee5c716", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/pdf/grobid.py:138"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2223e3d3747edce", "level": "note", "message": {"text": "Possibly dead Python function: harvest_daily_job"}, "properties": {"repobilityId": "723513174ffc9fdc", "scanner": "scanner-primary", "fingerprint": "e2223e3d3747edce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/scheduler/jobs.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5749f47147b5d989", "level": "note", "message": {"text": "Possibly dead Python function: harvest_koha_weekly_job"}, "properties": {"repobilityId": "ca49a393a0e014bb", "scanner": "scanner-primary", "fingerprint": "5749f47147b5d989", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/scheduler/jobs.py:104"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af358506463db6f0", "level": "note", "message": {"text": "Possibly dead Python function: backup_s3_job"}, "properties": {"repobilityId": "df6aa2841f055bde", "scanner": "scanner-primary", "fingerprint": "af358506463db6f0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/scheduler/jobs.py:122"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7918d128029371e", "level": "note", "message": {"text": "Possibly dead Python function: feedback_export_job"}, "properties": {"repobilityId": "3d2dbc8bbc0d4c73", "scanner": "scanner-primary", "fingerprint": "f7918d128029371e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/scheduler/jobs.py:230"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-099c6edfe7a3d68f", "level": "note", "message": {"text": "Possibly dead Python function: metrics_report_job"}, "properties": {"repobilityId": "0e8f8e101e4ee0b1", "scanner": "scanner-primary", "fingerprint": "099c6edfe7a3d68f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/scheduler/jobs.py:313"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a51621a124d9de9f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim"}, "properties": {"repobilityId": "22b29e99eb4eda59", "scanner": "scanner-primary", "fingerprint": "a51621a124d9de9f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/api/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a51621a124d9de9f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.13-slim"}, "properties": {"repobilityId": "f1abc452b7680570", "scanner": "scanner-primary", "fingerprint": "a51621a124d9de9f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/api/Dockerfile"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-a96dfad48a208535", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/auto-login.js:40"}, "properties": {"repobilityId": "6b5e463ff6e3c356", "scanner": "scanner-primary", "fingerprint": "a96dfad48a208535", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/auto-login.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-8b9ab1a2969e1cfa", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in public/auto-login.js:134"}, "properties": {"repobilityId": "4f1435ecb3403c16", "scanner": "scanner-primary", "fingerprint": "8b9ab1a2969e1cfa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/auto-login.js"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "9946312a5e672a1b", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "48377d3f89c71f40", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7e179ec568ae293d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "cfcb455b0cf7ae6c", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3d108c4d35bee1db", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3cbf0de32f03c82a", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-48ff0c3aa5a0d016", "level": "note", "message": {"text": "Legacy-named symbol `test_chat_agent_timeout_falls_back_to_legacy` in tests/unit/test_chat_service.py:652"}, "properties": {"repobilityId": "2e67af73b144d45e", "scanner": "scanner-primary", "fingerprint": "48ff0c3aa5a0d016", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1ad8dede25267a22", "level": "note", "message": {"text": "Legacy-named symbol `test_none_user_id_is_legacy` in tests/services/test_bucket.py:10"}, "properties": {"repobilityId": "277c26736bcd55c1", "scanner": "scanner-primary", "fingerprint": "1ad8dede25267a22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2fb450d14ccfade8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/services/test_agent_orchestrator.py:514"}, "properties": {"repobilityId": "5a2575134e3a0046", "scanner": "scanner-primary", "fingerprint": "2fb450d14ccfade8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-787453df5b7c2841", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/auto-login.js:9"}, "properties": {"repobilityId": "0ca3b8a0991fbcd5", "scanner": "scanner-primary", "fingerprint": "787453df5b7c2841", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bc2164d580be9f46", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/auto-login.js:356"}, "properties": {"repobilityId": "8b2ddb85a5c18cfd", "scanner": "scanner-primary", "fingerprint": "bc2164d580be9f46", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3965318ecf48aa77", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/guia/routing/rules.py:91"}, "properties": {"repobilityId": "448447c2fbea5891", "scanner": "scanner-primary", "fingerprint": "3965318ecf48aa77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-96cbc590e7915fa6", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/guia/worker/celery_app.py:11"}, "properties": {"repobilityId": "d7d670537744e20d", "scanner": "scanner-primary", "fingerprint": "96cbc590e7915fa6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7a078b6a00e7923", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/guia/services/harvester.py:560"}, "properties": {"repobilityId": "565cd9d3a7198155", "scanner": "scanner-primary", "fingerprint": "f7a078b6a00e7923", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eda77d12f297ed0e", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/guia/services/search.py:76"}, "properties": {"repobilityId": "688c539f8e4db3e8", "scanner": "scanner-primary", "fingerprint": "eda77d12f297ed0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bae8253ad1b48c4b", "level": "note", "message": {"text": "Legacy-named symbol `agent_orchestrator_timeout_fallback_legacy` in src/guia/services/chat.py:636"}, "properties": {"repobilityId": "835bcfe69fbc3331", "scanner": "scanner-primary", "fingerprint": "bae8253ad1b48c4b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0c36dc3abca95243", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/guia/services/chat.py:594"}, "properties": {"repobilityId": "5cd52aa4ec299961", "scanner": "scanner-primary", "fingerprint": "0c36dc3abca95243", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd2ba607e6449217", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/guia/channels/telegram_bot.py:79"}, "properties": {"repobilityId": "66f13103e26aca35", "scanner": "scanner-primary", "fingerprint": "cd2ba607e6449217", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39a992880378c068", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/guia/domain/chat.py:111"}, "properties": {"repobilityId": "b53d7dc784943ea1", "scanner": "scanner-primary", "fingerprint": "39a992880378c068", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d87e1e5248c39fc5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d09b484587085c8d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "caa93c84b13f4348", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bd68d6389895c453", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b0068a6822242e0a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-490bc13bbc9ce961", "level": "error", "message": {"text": "FastAPI POST `embeddings` without auth dependency \u2014 src/guia/embeddings_sidecar.py:113"}, "properties": {"repobilityId": "647f321513e36d02", "scanner": "scanner-primary", "fingerprint": "490bc13bbc9ce961", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/embeddings_sidecar.py"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-f57acab3802d24a2", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 src/guia/api/routes/chat.py:17"}, "properties": {"repobilityId": "9f68ed4312d9d91a", "scanner": "scanner-primary", "fingerprint": "f57acab3802d24a2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/guia/api/routes/chat.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-1c03886a281daa6f", "level": "note", "message": {"text": "Unused endpoint: POST /api/embeddings"}, "properties": {"repobilityId": "2a21a42f347593fe", "scanner": "scanner-primary", "fingerprint": "1c03886a281daa6f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3cb37cb885206e8f", "level": "note", "message": {"text": "Unused endpoint: POST /link"}, "properties": {"repobilityId": "7576e99d6f710320", "scanner": "scanner-primary", "fingerprint": "3cb37cb885206e8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c1ab37c408f90c0", "level": "note", "message": {"text": "Unused endpoint: DELETE /link"}, "properties": {"repobilityId": "e0e5db20762a54d6", "scanner": "scanner-primary", "fingerprint": "0c1ab37c408f90c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "e4f0529a1bdd0e81", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00d297d86aa253fe", "level": "note", "message": {"text": "Unused endpoint: GET /audit"}, "properties": {"repobilityId": "d99d6b0ec4f6f03b", "scanner": "scanner-primary", "fingerprint": "00d297d86aa253fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4884816c44204959", "level": "note", "message": {"text": "Unused endpoint: GET /feedback/stats"}, "properties": {"repobilityId": "e0bc316eabd051d9", "scanner": "scanner-primary", "fingerprint": "4884816c44204959", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0492a64e6bfbc3c", "level": "note", "message": {"text": "Unused endpoint: GET /feedback/export"}, "properties": {"repobilityId": "5a89d7875d3c1a5d", "scanner": "scanner-primary", "fingerprint": "e0492a64e6bfbc3c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e686634beeea0bb8", "level": "note", "message": {"text": "Unused endpoint: GET /export"}, "properties": {"repobilityId": "00220b36a823746f", "scanner": "scanner-primary", "fingerprint": "e686634beeea0bb8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b30f4c0994a30b4", "level": "note", "message": {"text": "Unused endpoint: DELETE /"}, "properties": {"repobilityId": "acebe1c61765258b", "scanner": "scanner-primary", "fingerprint": "3b30f4c0994a30b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0476989637783bc2", "level": "note", "message": {"text": "Unused endpoint: POST /opt-ins"}, "properties": {"repobilityId": "0e9bed6f6c0a75e7", "scanner": "scanner-primary", "fingerprint": "0476989637783bc2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cff8da5fbc19c76d", "level": "note", "message": {"text": "Unused endpoint: POST /chat"}, "properties": {"repobilityId": "359db65d68dacb1b", "scanner": "scanner-primary", "fingerprint": "cff8da5fbc19c76d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e91133f23b59e00c", "level": "note", "message": {"text": "Unused endpoint: POST /harvest"}, "properties": {"repobilityId": "bbbb23d77095cd49", "scanner": "scanner-primary", "fingerprint": "e91133f23b59e00c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}