{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-271cee2e96a8d789", "name": "Possibly dead Python function: audit_spawn", "shortDescription": {"text": "Possibly dead Python function: audit_spawn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-267109d52d43b6ed", "name": "Possibly dead Python function: audit_despawn", "shortDescription": {"text": "Possibly dead Python function: audit_despawn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1176470a2cf179e5", "name": "Possibly dead Python function: audit_component_added", "shortDescription": {"text": "Possibly dead Python function: audit_component_added"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eea001032fb681c0", "name": "Possibly dead Python function: audit_component_removed", "shortDescription": {"text": "Possibly dead Python function: audit_component_removed"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b57bdddd549db284", "name": "Possibly dead Python function: start_timer", "shortDescription": {"text": "Possibly dead Python function: start_timer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d1da807e002307e", "name": "Possibly dead Python function: publish_metrics", "shortDescription": {"text": "Possibly dead Python function: publish_metrics"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0ebaf944a99d1cd", "name": "Possibly dead Python function: temporary_debug_trace", "shortDescription": {"text": "Possibly dead Python function: temporary_debug_trace"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-437add9bc1c2fd6c", "name": "Possibly dead Python function: task_storage_roundtrip", "shortDescription": {"text": "Possibly dead Python function: task_storage_roundtrip"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48b02a42e65d205b", "name": "Possibly dead Python function: task_simulation_correctness", "shortDescription": {"text": "Possibly dead Python function: task_simulation_correctness"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b04b95f677fcd7f", "name": "Possibly dead Python function: task_poison_in_batch", "shortDescription": {"text": "Possibly dead Python function: task_poison_in_batch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67025081833cafb7", "name": "Possibly dead Python function: task_missing_payload_keys", "shortDescription": {"text": "Possibly dead Python function: task_missing_payload_keys"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-845efe25f5bcde7c", "name": "Possibly dead Python function: task_unknown_component_type", "shortDescription": {"text": "Possibly dead Python function: task_unknown_component_type"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-973e0e77bdf18fd8", "name": "Possibly dead Python function: task_despawn_nonexistent_entity", "shortDescription": {"text": "Possibly dead Python function: task_despawn_nonexistent_entity"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6c3830c05248406", "name": "Possibly dead Python function: task_unhandled_command_noop", "shortDescription": {"text": "Possibly dead Python function: task_unhandled_command_noop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c83c63b1d170cb87", "name": "Possibly dead Python function: task_spec_manifest_traceability", "shortDescription": {"text": "Possibly dead Python function: task_spec_manifest_traceability"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81a7904787f19b30", "name": "Possibly dead Python function: task_role_permission_matrix", "shortDescription": {"text": "Possibly dead Python function: task_role_permission_matrix"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53f292a4d9898b09", "name": "Possibly dead Python function: task_runtime_gate_only_boundary", "shortDescription": {"text": "Possibly dead Python function: task_runtime_gate_only_boundary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd58443323078374", "name": "Possibly dead Python function: task_command_service_gate_map", "shortDescription": {"text": "Possibly dead Python function: task_command_service_gate_map"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fb54dc1f58e21e0", "name": "Possibly dead Python function: task_append_only_protocols", "shortDescription": {"text": "Possibly dead Python function: task_append_only_protocols"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07501e7497bf4898", "name": "Possibly dead Python function: task_info_class_downgrades", "shortDescription": {"text": "Possibly dead Python function: task_info_class_downgrades"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c2f200fda786aba", "name": "Possibly dead Python function: task_component_serde", "shortDescription": {"text": "Possibly dead Python function: task_component_serde"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-403be3454436e9b6", "name": "Possibly dead Python function: task_archetype_signatures", "shortDescription": {"text": "Possibly dead Python function: task_archetype_signatures"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56e31a1dfeef1062", "name": "Possibly dead Python function: task_rbac_enforcement", "shortDescription": {"text": "Possibly dead Python function: task_rbac_enforcement"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca221260d64f93e4", "name": "Possibly dead Python function: task_command_ordering", "shortDescription": {"text": "Possibly dead Python function: task_command_ordering"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b690696084116216", "name": "Possibly dead Python function: task_command_pipeline", "shortDescription": {"text": "Possibly dead Python function: task_command_pipeline"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28ac81b1a8cf7a77", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4f54aeaa7835ad6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9037fe07a1e17d79", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfc81fecf0ef1b75", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0763d85002569570", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25ab70a6a8e4999e", "name": "Very large file: crates/archetype-core/src/aio/async_world.rs (1803 lines)", "shortDescription": {"text": "Very large file: crates/archetype-core/src/aio/async_world.rs (1803 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 265 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 12 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f072054126942a5a", "name": "Agent authority lacks a verifier contract: .claude/skills/archetype-processors/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/archetype-processors/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddedb7c8b7a1174d", "name": "Agent authority lacks a verifier contract: .claude/skills/footgun-detector/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/footgun-detector/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e2e38d407334e15", "name": "Agent authority lacks a verifier contract: .claude/skills/daft-patterns/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/daft-patterns/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd3c00db2511d334", "name": "Legacy-named symbol `model_copy` in tests/app/test_services.py:179", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/app/test_services.py:179"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c6700baf0bc1b08", "name": "Legacy-named symbol `df_old` in tests/aio/test_async_world_mutations.py:126", "shortDescription": {"text": "Legacy-named symbol `df_old` in tests/aio/test_async_world_mutations.py:126"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb52a88460fc16d8", "name": "Commented-code block (6 lines) in tests/aio/test_async_world_execution.py:89", "shortDescription": {"text": "Commented-code block (6 lines) in tests/aio/test_async_world_execution.py:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e20bc5f3480e2ec7", "name": "Commented-code block (5 lines) in tests/experiments/test_components.py:114", "shortDescription": {"text": "Commented-code block (5 lines) in tests/experiments/test_components.py:114"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd2f19ad47f7ec24", "name": "Legacy-named symbol `model_copy` in bench/core/ecs/run.py:21", "shortDescription": {"text": "Legacy-named symbol `model_copy` in bench/core/ecs/run.py:21"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1601e05bef5e5af", "name": "Network/subprocess call without timeout or try/except \u2014 bench/libero/vla_jepa_worker.py:124", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 bench/libero/vla_jepa_worker.py:124"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4fb69ad5720bd5a", "name": "Commented-code block (6 lines) in evals/suites/capability.py:191", "shortDescription": {"text": "Commented-code block (6 lines) in evals/suites/capability.py:191"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a115afe0756fe25", "name": "Stub function `_fake_handler` (body is just `pass`/`return`) \u2014 evals/suites/spec_contracts.py:530", "shortDescription": {"text": "Stub function `_fake_handler` (body is just `pass`/`return`) \u2014 evals/suites/spec_contracts.py:530"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-658fdfdc7402eac9", "name": "Legacy-named symbol `model_copy` in src/archetype/app/world_service.py:164", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/archetype/app/world_service.py:164"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-808c0f2fc2df8310", "name": "Commented-code block (7 lines) in src/archetype/runtime/runtime.py:45", "shortDescription": {"text": "Commented-code block (7 lines) in src/archetype/runtime/runtime.py:45"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2bb6e623245d4953", "name": "Commented-code block (5 lines) in src/archetype/core/aio/async_store.py:54", "shortDescription": {"text": "Commented-code block (5 lines) in src/archetype/core/aio/async_store.py:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5509482a417c13ee", "name": "Commented-code block (8 lines) in src/archetype/core/aio/async_querier.py:88", "shortDescription": {"text": "Commented-code block (8 lines) in src/archetype/core/aio/async_querier.py:88"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-675f6b72058ca4bb", "name": "Commented-code block (5 lines) in src/archetype/core/aio/async_world.py:167", "shortDescription": {"text": "Commented-code block (5 lines) in src/archetype/core/aio/async_world.py:167"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a95788cf7a1fbe12", "name": "Commented-code block (9 lines) in src/archetype/htn/udfs.py:187", "shortDescription": {"text": "Commented-code block (9 lines) in src/archetype/htn/udfs.py:187"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f808a4ef3e1071fb", "name": "14 env vars used in code but missing from .env.example", "shortDescription": {"text": "14 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ARCHETYPE_BENCH_NS`, `ARCHETYPE_DATA_URI`, `ARCT_LANCEDB_INDEX_ENTITY`, `ARCT_LANCEDB_INDEX_RUN`, `ARCT_LANCEDB_INDEX_TICK`, `ARCT_LANCEDB_INDEX_WORLD`, `ARCT_LANCEDB_SUBDIR`, `LOGFIRE_API_KEY` + 6 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/generate_cli_docs.py:main, scripts/generate_api_docs.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbench/core/ecs/entity_cycle.py:run, bench/core/ecs/packed_iteration.py:run, bench/core/ecs/add_remove.py:run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbench/core/ecs/packed_iteration.py:process, bench/core/ecs/packed_iteration.py:process, bench/core/ecs/packed_iteration.py:process, bench/core/ecs/packed_iteration.py:process\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nexamples/pr_triage.py:process, examples/pr_triage.py:process, examples/pr_triage.py:process, examples/pr_triage.py:process\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18a52aa6d2237b29", "name": "FastAPI POST `create_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:29", "shortDescription": {"text": "FastAPI POST `create_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:29"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14c9829bd99b8f6a", "name": "FastAPI DELETE `destroy_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:67", "shortDescription": {"text": "FastAPI DELETE `destroy_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:67"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15955de0a678a6a6", "name": "FastAPI POST `fork_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:84", "shortDescription": {"text": "FastAPI POST `fork_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:84"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08a83652d135d5fc", "name": "FastAPI POST `submit_command` without auth dependency \u2014 src/archetype/api/routes/commands.py:37", "shortDescription": {"text": "FastAPI POST `submit_command` without auth dependency \u2014 src/archetype/api/routes/commands.py:37"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6cf284c69e8ad07b", "name": "FastAPI POST `submit_batch` without auth dependency \u2014 src/archetype/api/routes/commands.py:59", "shortDescription": {"text": "FastAPI POST `submit_batch` without auth dependency \u2014 src/archetype/api/routes/commands.py:59"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45b85c322be5b33f", "name": "FastAPI POST `create_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:34", "shortDescription": {"text": "FastAPI POST `create_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:34"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1650119ed9746263", "name": "FastAPI DELETE `remove_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:49", "shortDescription": {"text": "FastAPI DELETE `remove_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:49"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f152b65456315a91", "name": "FastAPI PATCH `update_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:64", "shortDescription": {"text": "FastAPI PATCH `update_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:64"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd332a8f64b126e5", "name": "FastAPI POST `add_components` without auth dependency \u2014 src/archetype/api/routes/entities.py:80", "shortDescription": {"text": "FastAPI POST `add_components` without auth dependency \u2014 src/archetype/api/routes/entities.py:80"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0d591d85b6c8ee4e", "name": "FastAPI DELETE `remove_components` without auth dependency \u2014 src/archetype/api/routes/entities.py:96", "shortDescription": {"text": "FastAPI DELETE `remove_components` without auth dependency \u2014 src/archetype/api/routes/entities.py:96"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e28c880710157e8", "name": "FastAPI POST `step_world` without auth dependency \u2014 src/archetype/api/routes/simulation.py:36", "shortDescription": {"text": "FastAPI POST `step_world` without auth dependency \u2014 src/archetype/api/routes/simulation.py:36"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf634ff62954ea5f", "name": "FastAPI POST `run_world` without auth dependency \u2014 src/archetype/api/routes/simulation.py:52", "shortDescription": {"text": "FastAPI POST `run_world` without auth dependency \u2014 src/archetype/api/routes/simulation.py:52"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-261cb5355fec007c", "name": "FastAPI POST `run_episode` without auth dependency \u2014 src/archetype/api/routes/simulation.py:73", "shortDescription": {"text": "FastAPI POST `run_episode` without auth dependency \u2014 src/archetype/api/routes/simulation.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-175ee8ff809b2364", "name": "FastAPI POST `run_rollout` without auth dependency \u2014 src/archetype/api/routes/simulation.py:87", "shortDescription": {"text": "FastAPI POST `run_rollout` without auth dependency \u2014 src/archetype/api/routes/simulation.py:87"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/archetype/api/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/archetype/api/routes/worlds.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d82211c89841a57c", "name": "Unused endpoint: GET /{world_id}", "shortDescription": {"text": "Unused endpoint: GET /{world_id}"}, "fullDescription": {"text": "`src/archetype/api/routes/worlds.py` declares `GET /{world_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40a0c61bbc52e538", "name": "Unused endpoint: DELETE /{world_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{world_id}"}, "fullDescription": {"text": "`src/archetype/api/routes/worlds.py` declares `DELETE /{world_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add0f52b40c54e73", "name": "Unused endpoint: POST /{world_id}/fork", "shortDescription": {"text": "Unused endpoint: POST /{world_id}/fork"}, "fullDescription": {"text": "`src/archetype/api/routes/worlds.py` declares `POST /{world_id}/fork` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3f35227ac645505", "name": "Unused endpoint: GET /worlds/{world_id}/state", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/state"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3fcbaba2da26042", "name": "Unused endpoint: GET /worlds/{world_id}/entities/{entity_id}", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/entities/{entity_id}"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/entities/{entity_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b564996712efd0e", "name": "Unused endpoint: GET /worlds/{world_id}/components", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/components"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/components` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3584f9c037741a2", "name": "Unused endpoint: GET /worlds/{world_id}/history", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/history"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f9ac3a9fb884ed5", "name": "Unused endpoint: GET /worlds/{world_id}/processors", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/processors"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/processors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af0c0dbae92cc243", "name": "Unused endpoint: GET /worlds/{world_id}/hooks", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/hooks"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/hooks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f24083d1f1118b4f", "name": "Unused endpoint: GET /worlds/{world_id}/resources", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/resources"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /worlds/{world_id}/resources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93b15b63570e8e35", "name": "Unused endpoint: GET /signatures", "shortDescription": {"text": "Unused endpoint: GET /signatures"}, "fullDescription": {"text": "`src/archetype/api/routes/query.py` declares `GET /signatures` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52c85377cc38e474", "name": "Unused endpoint: POST /batch", "shortDescription": {"text": "Unused endpoint: POST /batch"}, "fullDescription": {"text": "`src/archetype/api/routes/commands.py` declares `POST /batch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd74060295d53d7e", "name": "Unused endpoint: DELETE /{entity_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{entity_id}"}, "fullDescription": {"text": "`src/archetype/api/routes/entities.py` declares `DELETE /{entity_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8261b39d6bc40f4", "name": "Unused endpoint: PATCH /{entity_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{entity_id}"}, "fullDescription": {"text": "`src/archetype/api/routes/entities.py` declares `PATCH /{entity_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43c9c2a729802379", "name": "Unused endpoint: POST /{entity_id}/components", "shortDescription": {"text": "Unused endpoint: POST /{entity_id}/components"}, "fullDescription": {"text": "`src/archetype/api/routes/entities.py` declares `POST /{entity_id}/components` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90abedcd3895a06a", "name": "Unused endpoint: DELETE /{entity_id}/components", "shortDescription": {"text": "Unused endpoint: DELETE /{entity_id}/components"}, "fullDescription": {"text": "`src/archetype/api/routes/entities.py` declares `DELETE /{entity_id}/components` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e5f7bf1997b085e", "name": "Unused endpoint: POST /step", "shortDescription": {"text": "Unused endpoint: POST /step"}, "fullDescription": {"text": "`src/archetype/api/routes/simulation.py` declares `POST /step` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69a693dfc33637f4", "name": "Unused endpoint: POST /run", "shortDescription": {"text": "Unused endpoint: POST /run"}, "fullDescription": {"text": "`src/archetype/api/routes/simulation.py` declares `POST /run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91138503a3f28617", "name": "Unused endpoint: POST /episode", "shortDescription": {"text": "Unused endpoint: POST /episode"}, "fullDescription": {"text": "`src/archetype/api/routes/simulation.py` declares `POST /episode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eab06a6f9d78240d", "name": "Unused endpoint: POST /rollout", "shortDescription": {"text": "Unused endpoint: POST /rollout"}, "fullDescription": {"text": "`src/archetype/api/routes/simulation.py` declares `POST /rollout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22066"}, "properties": {"repository": "VangelisTech/archetype", "repoUrl": "https://github.com/VangelisTech/archetype", "branch": "main"}, "results": [{"ruleId": "scanner-271cee2e96a8d789", "level": "note", "message": {"text": "Possibly dead Python function: audit_spawn"}, "properties": {"repobilityId": "53edb4958d2c92d4", "scanner": "scanner-primary", "fingerprint": "271cee2e96a8d789", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:89"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-267109d52d43b6ed", "level": "note", "message": {"text": "Possibly dead Python function: audit_despawn"}, "properties": {"repobilityId": "fc785f19a2fe1cc5", "scanner": "scanner-primary", "fingerprint": "267109d52d43b6ed", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:93"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1176470a2cf179e5", "level": "note", "message": {"text": "Possibly dead Python function: audit_component_added"}, "properties": {"repobilityId": "a001477d056b1f4a", "scanner": "scanner-primary", "fingerprint": "1176470a2cf179e5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eea001032fb681c0", "level": "note", "message": {"text": "Possibly dead Python function: audit_component_removed"}, "properties": {"repobilityId": "6b5e45af71a15cae", "scanner": "scanner-primary", "fingerprint": "eea001032fb681c0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b57bdddd549db284", "level": "note", "message": {"text": "Possibly dead Python function: start_timer"}, "properties": {"repobilityId": "377ede560e654541", "scanner": "scanner-primary", "fingerprint": "b57bdddd549db284", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:104"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d1da807e002307e", "level": "note", "message": {"text": "Possibly dead Python function: publish_metrics"}, "properties": {"repobilityId": "45cd7e70bd5db4cf", "scanner": "scanner-primary", "fingerprint": "8d1da807e002307e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:107"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0ebaf944a99d1cd", "level": "note", "message": {"text": "Possibly dead Python function: temporary_debug_trace"}, "properties": {"repobilityId": "dcc3e048804b9a26", "scanner": "scanner-primary", "fingerprint": "c0ebaf944a99d1cd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/07_hooks.py:127"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-437add9bc1c2fd6c", "level": "note", "message": {"text": "Possibly dead Python function: task_storage_roundtrip"}, "properties": {"repobilityId": "0de3e32bd9d43f2d", "scanner": "scanner-primary", "fingerprint": "437add9bc1c2fd6c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/capability.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48b02a42e65d205b", "level": "note", "message": {"text": "Possibly dead Python function: task_simulation_correctness"}, "properties": {"repobilityId": "9e4d557f7b0b8842", "scanner": "scanner-primary", "fingerprint": "48b02a42e65d205b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/capability.py:147"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b04b95f677fcd7f", "level": "note", "message": {"text": "Possibly dead Python function: task_poison_in_batch"}, "properties": {"repobilityId": "519ad074ab4a8278", "scanner": "scanner-primary", "fingerprint": "7b04b95f677fcd7f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/poison_command.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67025081833cafb7", "level": "note", "message": {"text": "Possibly dead Python function: task_missing_payload_keys"}, "properties": {"repobilityId": "d5361d37ae555961", "scanner": "scanner-primary", "fingerprint": "67025081833cafb7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/poison_command.py:128"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-845efe25f5bcde7c", "level": "note", "message": {"text": "Possibly dead Python function: task_unknown_component_type"}, "properties": {"repobilityId": "95b3b2b1f34a94df", "scanner": "scanner-primary", "fingerprint": "845efe25f5bcde7c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/poison_command.py:193"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-973e0e77bdf18fd8", "level": "note", "message": {"text": "Possibly dead Python function: task_despawn_nonexistent_entity"}, "properties": {"repobilityId": "cc16eedb779f98a5", "scanner": "scanner-primary", "fingerprint": "973e0e77bdf18fd8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/poison_command.py:270"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6c3830c05248406", "level": "note", "message": {"text": "Possibly dead Python function: task_unhandled_command_noop"}, "properties": {"repobilityId": "c323bc9003e08eb3", "scanner": "scanner-primary", "fingerprint": "e6c3830c05248406", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/poison_command.py:338"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c83c63b1d170cb87", "level": "note", "message": {"text": "Possibly dead Python function: task_spec_manifest_traceability"}, "properties": {"repobilityId": "1401185af5a7d454", "scanner": "scanner-primary", "fingerprint": "c83c63b1d170cb87", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/spec_contracts.py:287"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81a7904787f19b30", "level": "note", "message": {"text": "Possibly dead Python function: task_role_permission_matrix"}, "properties": {"repobilityId": "ca34dbc9832b76cb", "scanner": "scanner-primary", "fingerprint": "81a7904787f19b30", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/spec_contracts.py:307"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53f292a4d9898b09", "level": "note", "message": {"text": "Possibly dead Python function: task_runtime_gate_only_boundary"}, "properties": {"repobilityId": "fea3dc26ca0c6434", "scanner": "scanner-primary", "fingerprint": "53f292a4d9898b09", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/spec_contracts.py:330"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd58443323078374", "level": "note", "message": {"text": "Possibly dead Python function: task_command_service_gate_map"}, "properties": {"repobilityId": "763764908b61ddac", "scanner": "scanner-primary", "fingerprint": "bd58443323078374", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/spec_contracts.py:368"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fb54dc1f58e21e0", "level": "note", "message": {"text": "Possibly dead Python function: task_append_only_protocols"}, "properties": {"repobilityId": "b7cda40910d2c088", "scanner": "scanner-primary", "fingerprint": "3fb54dc1f58e21e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/spec_contracts.py:417"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07501e7497bf4898", "level": "note", "message": {"text": "Possibly dead Python function: task_info_class_downgrades"}, "properties": {"repobilityId": "dfd54c26b843e1e8", "scanner": "scanner-primary", "fingerprint": "07501e7497bf4898", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/spec_contracts.py:438"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c2f200fda786aba", "level": "note", "message": {"text": "Possibly dead Python function: task_component_serde"}, "properties": {"repobilityId": "86f3e969d5346818", "scanner": "scanner-primary", "fingerprint": "2c2f200fda786aba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/regression.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-403be3454436e9b6", "level": "note", "message": {"text": "Possibly dead Python function: task_archetype_signatures"}, "properties": {"repobilityId": "d3cb4cf8bc9c28ae", "scanner": "scanner-primary", "fingerprint": "403be3454436e9b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/regression.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56e31a1dfeef1062", "level": "note", "message": {"text": "Possibly dead Python function: task_rbac_enforcement"}, "properties": {"repobilityId": "7bbe75f2a3a7c3fe", "scanner": "scanner-primary", "fingerprint": "56e31a1dfeef1062", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/regression.py:133"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca221260d64f93e4", "level": "note", "message": {"text": "Possibly dead Python function: task_command_ordering"}, "properties": {"repobilityId": "aa5f06b03b42dc15", "scanner": "scanner-primary", "fingerprint": "ca221260d64f93e4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/regression.py:216"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b690696084116216", "level": "note", "message": {"text": "Possibly dead Python function: task_command_pipeline"}, "properties": {"repobilityId": "3927a8aec62efebf", "scanner": "scanner-primary", "fingerprint": "b690696084116216", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/regression.py:242"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "215f2b7049a32e7c", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5d62d84dd936546", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc308532904ff927", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "901b0be4d170ac5a", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "215f2b7049a32e7c", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5d62d84dd936546", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc308532904ff927", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "215f2b7049a32e7c", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5d62d84dd936546", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc308532904ff927", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "215f2b7049a32e7c", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f5d62d84dd936546", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-28ac81b1a8cf7a77", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc308532904ff927", "scanner": "scanner-primary", "fingerprint": "28ac81b1a8cf7a77", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-tests.yml"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-b4f54aeaa7835ad6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6686fefc62c17752", "scanner": "scanner-primary", "fingerprint": "b4f54aeaa7835ad6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-security-audit.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-b4f54aeaa7835ad6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c1ce5c1937147fe8", "scanner": "scanner-primary", "fingerprint": "b4f54aeaa7835ad6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-security-audit.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-b4f54aeaa7835ad6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6fff719664bbd2b5", "scanner": "scanner-primary", "fingerprint": "b4f54aeaa7835ad6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-security-audit.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-b4f54aeaa7835ad6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "83a8666287429b16", "scanner": "scanner-primary", "fingerprint": "b4f54aeaa7835ad6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-security-audit.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-b4f54aeaa7835ad6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3342dfd03fb2b37b", "scanner": "scanner-primary", "fingerprint": "b4f54aeaa7835ad6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-security-audit.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-9037fe07a1e17d79", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0547bd63b9df1e47", "scanner": "scanner-primary", "fingerprint": "9037fe07a1e17d79", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-security-audit.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfc81fecf0ef1b75", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f7698e94ca805f6b", "scanner": "scanner-primary", "fingerprint": "dfc81fecf0ef1b75", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/footgun-review.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-dfc81fecf0ef1b75", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f035d483938295d8", "scanner": "scanner-primary", "fingerprint": "dfc81fecf0ef1b75", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/footgun-review.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "07018386523c0247", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6cf0b7f54becd5c6", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4953002f92c6cb76", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a633e36a97b301dc", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a633e36a97b301dc", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 187}}}]}, {"ruleId": "scanner-0763d85002569570", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a633e36a97b301dc", "scanner": "scanner-primary", "fingerprint": "0763d85002569570", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs.yml"}, "region": {"startLine": 202}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02600186fc092bd4", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ad86557a2848db6", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a9b606a8a901d536", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ad86557a2848db6", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a9b606a8a901d536", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8eb96fb1706184f3", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25ab70a6a8e4999e", "level": "note", "message": {"text": "Very large file: crates/archetype-core/src/aio/async_world.rs (1803 lines)"}, "properties": {"repobilityId": "f3e5975d5cfb0de8", "scanner": "scanner-primary", "fingerprint": "25ab70a6a8e4999e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "878f80ac6f5a59ed", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6c343a2f691bc3e4", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4a0ab5e8707d855d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "6cad922e72e4d651", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8b2c2e57a74c3617", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f072054126942a5a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/archetype-processors/SKILL.md"}, "properties": {"repobilityId": "795683cb6a938c9b", "scanner": "scanner-primary", "fingerprint": "f072054126942a5a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/archetype-processors/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ddedb7c8b7a1174d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/footgun-detector/SKILL.md"}, "properties": {"repobilityId": "c0c4acdfb3acf2b3", "scanner": "scanner-primary", "fingerprint": "ddedb7c8b7a1174d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/footgun-detector/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e2e38d407334e15", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/daft-patterns/SKILL.md"}, "properties": {"repobilityId": "30cd6b498a6c5894", "scanner": "scanner-primary", "fingerprint": "7e2e38d407334e15", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/daft-patterns/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bd3c00db2511d334", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/app/test_services.py:179"}, "properties": {"repobilityId": "6d29bfd87d646bc8", "scanner": "scanner-primary", "fingerprint": "bd3c00db2511d334", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4c6700baf0bc1b08", "level": "note", "message": {"text": "Legacy-named symbol `df_old` in tests/aio/test_async_world_mutations.py:126"}, "properties": {"repobilityId": "1f5f4d838b1fc1d0", "scanner": "scanner-primary", "fingerprint": "4c6700baf0bc1b08", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-eb52a88460fc16d8", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/aio/test_async_world_execution.py:89"}, "properties": {"repobilityId": "06898c95296438ed", "scanner": "scanner-primary", "fingerprint": "eb52a88460fc16d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e20bc5f3480e2ec7", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/experiments/test_components.py:114"}, "properties": {"repobilityId": "0bea8b7b84d36db4", "scanner": "scanner-primary", "fingerprint": "e20bc5f3480e2ec7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd2f19ad47f7ec24", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in bench/core/ecs/run.py:21"}, "properties": {"repobilityId": "a2783b61b531d679", "scanner": "scanner-primary", "fingerprint": "bd2f19ad47f7ec24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e1601e05bef5e5af", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 bench/libero/vla_jepa_worker.py:124"}, "properties": {"repobilityId": "2c5f54a790109c9c", "scanner": "scanner-primary", "fingerprint": "e1601e05bef5e5af", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b4fb69ad5720bd5a", "level": "none", "message": {"text": "Commented-code block (6 lines) in evals/suites/capability.py:191"}, "properties": {"repobilityId": "c80fd7f897933a52", "scanner": "scanner-primary", "fingerprint": "b4fb69ad5720bd5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a115afe0756fe25", "level": "note", "message": {"text": "Stub function `_fake_handler` (body is just `pass`/`return`) \u2014 evals/suites/spec_contracts.py:530"}, "properties": {"repobilityId": "efbcf9d1ed533ac9", "scanner": "scanner-primary", "fingerprint": "9a115afe0756fe25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-658fdfdc7402eac9", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/archetype/app/world_service.py:164"}, "properties": {"repobilityId": "884ad270e665eb93", "scanner": "scanner-primary", "fingerprint": "658fdfdc7402eac9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-808c0f2fc2df8310", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/archetype/runtime/runtime.py:45"}, "properties": {"repobilityId": "f162a943347e06ac", "scanner": "scanner-primary", "fingerprint": "808c0f2fc2df8310", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2bb6e623245d4953", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/archetype/core/aio/async_store.py:54"}, "properties": {"repobilityId": "083cf093ab0a8445", "scanner": "scanner-primary", "fingerprint": "2bb6e623245d4953", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5509482a417c13ee", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/archetype/core/aio/async_querier.py:88"}, "properties": {"repobilityId": "2192a0bcad15f1bc", "scanner": "scanner-primary", "fingerprint": "5509482a417c13ee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-675f6b72058ca4bb", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/archetype/core/aio/async_world.py:167"}, "properties": {"repobilityId": "7122b455896f9adf", "scanner": "scanner-primary", "fingerprint": "675f6b72058ca4bb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a95788cf7a1fbe12", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/archetype/htn/udfs.py:187"}, "properties": {"repobilityId": "36ed5c0cb78ebf0c", "scanner": "scanner-primary", "fingerprint": "a95788cf7a1fbe12", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f808a4ef3e1071fb", "level": "note", "message": {"text": "14 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "ce6b2ec4be4ec75a", "scanner": "scanner-primary", "fingerprint": "f808a4ef3e1071fb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ff60a27ad700cfc6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e314ebed7ad60dab", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5c7d9bf960104d8e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "663f0c6d30e737df", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "51201f083eef5999", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b04d3ddf3b7a4ade", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "23db28b002da60e9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "310371e29c7b9364", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "0019b1b8e2348b58", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c00e75a6cc9e564c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "41fe9efd87c90f47", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fb285f49dec6e59f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "03e2e81c31009a8f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3e21b28cf5ccdea1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "148763cbf8f3e8e7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4caac2cdef667514", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "45e86779f5f857e3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "673c48cb415aebec", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "cdffe6692c00c466", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e494fb884fdaa50c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-18a52aa6d2237b29", "level": "error", "message": {"text": "FastAPI POST `create_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:29"}, "properties": {"repobilityId": "e52134aa9010b7b3", "scanner": "scanner-primary", "fingerprint": "18a52aa6d2237b29", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/worlds.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-14c9829bd99b8f6a", "level": "error", "message": {"text": "FastAPI DELETE `destroy_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:67"}, "properties": {"repobilityId": "db98187d75c8e51c", "scanner": "scanner-primary", "fingerprint": "14c9829bd99b8f6a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/worlds.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-15955de0a678a6a6", "level": "error", "message": {"text": "FastAPI POST `fork_world` without auth dependency \u2014 src/archetype/api/routes/worlds.py:84"}, "properties": {"repobilityId": "a3b78e04ff0220e2", "scanner": "scanner-primary", "fingerprint": "15955de0a678a6a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/worlds.py"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-08a83652d135d5fc", "level": "error", "message": {"text": "FastAPI POST `submit_command` without auth dependency \u2014 src/archetype/api/routes/commands.py:37"}, "properties": {"repobilityId": "9e25d37734bf606b", "scanner": "scanner-primary", "fingerprint": "08a83652d135d5fc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/commands.py"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-6cf284c69e8ad07b", "level": "error", "message": {"text": "FastAPI POST `submit_batch` without auth dependency \u2014 src/archetype/api/routes/commands.py:59"}, "properties": {"repobilityId": "efbe7d618c258b6d", "scanner": "scanner-primary", "fingerprint": "6cf284c69e8ad07b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/commands.py"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-45b85c322be5b33f", "level": "error", "message": {"text": "FastAPI POST `create_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:34"}, "properties": {"repobilityId": "b869a81f7cb40cdc", "scanner": "scanner-primary", "fingerprint": "45b85c322be5b33f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/entities.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-1650119ed9746263", "level": "error", "message": {"text": "FastAPI DELETE `remove_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:49"}, "properties": {"repobilityId": "8dcc14c809525126", "scanner": "scanner-primary", "fingerprint": "1650119ed9746263", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/entities.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-f152b65456315a91", "level": "error", "message": {"text": "FastAPI PATCH `update_entity` without auth dependency \u2014 src/archetype/api/routes/entities.py:64"}, "properties": {"repobilityId": "b55798bc2eb28411", "scanner": "scanner-primary", "fingerprint": "f152b65456315a91", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/entities.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-cd332a8f64b126e5", "level": "error", "message": {"text": "FastAPI POST `add_components` without auth dependency \u2014 src/archetype/api/routes/entities.py:80"}, "properties": {"repobilityId": "1ba36ade58b220f8", "scanner": "scanner-primary", "fingerprint": "cd332a8f64b126e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/entities.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-0d591d85b6c8ee4e", "level": "error", "message": {"text": "FastAPI DELETE `remove_components` without auth dependency \u2014 src/archetype/api/routes/entities.py:96"}, "properties": {"repobilityId": "347dfb42e74e9e9d", "scanner": "scanner-primary", "fingerprint": "0d591d85b6c8ee4e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/entities.py"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-5e28c880710157e8", "level": "error", "message": {"text": "FastAPI POST `step_world` without auth dependency \u2014 src/archetype/api/routes/simulation.py:36"}, "properties": {"repobilityId": "26ddba16f9347284", "scanner": "scanner-primary", "fingerprint": "5e28c880710157e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/simulation.py"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-bf634ff62954ea5f", "level": "error", "message": {"text": "FastAPI POST `run_world` without auth dependency \u2014 src/archetype/api/routes/simulation.py:52"}, "properties": {"repobilityId": "ffc0f5de8433204f", "scanner": "scanner-primary", "fingerprint": "bf634ff62954ea5f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/simulation.py"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-261cb5355fec007c", "level": "error", "message": {"text": "FastAPI POST `run_episode` without auth dependency \u2014 src/archetype/api/routes/simulation.py:73"}, "properties": {"repobilityId": "fd56a9f0df50e232", "scanner": "scanner-primary", "fingerprint": "261cb5355fec007c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/simulation.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-175ee8ff809b2364", "level": "error", "message": {"text": "FastAPI POST `run_rollout` without auth dependency \u2014 src/archetype/api/routes/simulation.py:87"}, "properties": {"repobilityId": "9d0794ebced046d3", "scanner": "scanner-primary", "fingerprint": "175ee8ff809b2364", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/archetype/api/routes/simulation.py"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9326afb44d2d38f3", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "f481724efd4aae5a", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d82211c89841a57c", "level": "note", "message": {"text": "Unused endpoint: GET /{world_id}"}, "properties": {"repobilityId": "2b6bfe726012e08a", "scanner": "scanner-primary", "fingerprint": "d82211c89841a57c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40a0c61bbc52e538", "level": "note", "message": {"text": "Unused endpoint: DELETE /{world_id}"}, "properties": {"repobilityId": "7a67d2b8b6abc64e", "scanner": "scanner-primary", "fingerprint": "40a0c61bbc52e538", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-add0f52b40c54e73", "level": "note", "message": {"text": "Unused endpoint: POST /{world_id}/fork"}, "properties": {"repobilityId": "91ac6ad0bfc12c2d", "scanner": "scanner-primary", "fingerprint": "add0f52b40c54e73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3f35227ac645505", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/state"}, "properties": {"repobilityId": "b25771ef29481aa3", "scanner": "scanner-primary", "fingerprint": "a3f35227ac645505", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e3fcbaba2da26042", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/entities/{entity_id}"}, "properties": {"repobilityId": "ff86db9d9ac3c5f3", "scanner": "scanner-primary", "fingerprint": "e3fcbaba2da26042", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6b564996712efd0e", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/components"}, "properties": {"repobilityId": "00276309270aced5", "scanner": "scanner-primary", "fingerprint": "6b564996712efd0e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f3584f9c037741a2", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/history"}, "properties": {"repobilityId": "c3754c011fcb8869", "scanner": "scanner-primary", "fingerprint": "f3584f9c037741a2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f9ac3a9fb884ed5", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/processors"}, "properties": {"repobilityId": "61d79e003c6834d3", "scanner": "scanner-primary", "fingerprint": "3f9ac3a9fb884ed5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af0c0dbae92cc243", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/hooks"}, "properties": {"repobilityId": "a8f25f28d2165c33", "scanner": "scanner-primary", "fingerprint": "af0c0dbae92cc243", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f24083d1f1118b4f", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/resources"}, "properties": {"repobilityId": "c6ba79ff72edb70a", "scanner": "scanner-primary", "fingerprint": "f24083d1f1118b4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93b15b63570e8e35", "level": "note", "message": {"text": "Unused endpoint: GET /signatures"}, "properties": {"repobilityId": "f5c7f0e9d939345b", "scanner": "scanner-primary", "fingerprint": "93b15b63570e8e35", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52c85377cc38e474", "level": "note", "message": {"text": "Unused endpoint: POST /batch"}, "properties": {"repobilityId": "777e0ab36685653d", "scanner": "scanner-primary", "fingerprint": "52c85377cc38e474", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd74060295d53d7e", "level": "note", "message": {"text": "Unused endpoint: DELETE /{entity_id}"}, "properties": {"repobilityId": "b85eb3ceeeb4ee85", "scanner": "scanner-primary", "fingerprint": "fd74060295d53d7e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8261b39d6bc40f4", "level": "note", "message": {"text": "Unused endpoint: PATCH /{entity_id}"}, "properties": {"repobilityId": "53680eaff0af02b0", "scanner": "scanner-primary", "fingerprint": "b8261b39d6bc40f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43c9c2a729802379", "level": "note", "message": {"text": "Unused endpoint: POST /{entity_id}/components"}, "properties": {"repobilityId": "0fdb43dbd02e82c3", "scanner": "scanner-primary", "fingerprint": "43c9c2a729802379", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-90abedcd3895a06a", "level": "note", "message": {"text": "Unused endpoint: DELETE /{entity_id}/components"}, "properties": {"repobilityId": "d4adb0a71c96b31a", "scanner": "scanner-primary", "fingerprint": "90abedcd3895a06a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e5f7bf1997b085e", "level": "note", "message": {"text": "Unused endpoint: POST /step"}, "properties": {"repobilityId": "d89f69fc62f33ef5", "scanner": "scanner-primary", "fingerprint": "2e5f7bf1997b085e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69a693dfc33637f4", "level": "note", "message": {"text": "Unused endpoint: POST /run"}, "properties": {"repobilityId": "9d6d5e5b1c47dded", "scanner": "scanner-primary", "fingerprint": "69a693dfc33637f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-91138503a3f28617", "level": "note", "message": {"text": "Unused endpoint: POST /episode"}, "properties": {"repobilityId": "77759529d92c6639", "scanner": "scanner-primary", "fingerprint": "91138503a3f28617", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eab06a6f9d78240d", "level": "note", "message": {"text": "Unused endpoint: POST /rollout"}, "properties": {"repobilityId": "74ce815827757e96", "scanner": "scanner-primary", "fingerprint": "eab06a6f9d78240d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}