{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-361c650179624c28", "name": "Possibly dead Python function: enable_device_tools", "shortDescription": {"text": "Possibly dead Python function: enable_device_tools"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b0dc566aa1d27dd", "name": "Possibly dead Python function: emit", "shortDescription": {"text": "Possibly dead Python function: emit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e0b8e7980d69653", "name": "Possibly dead Python function: promote_edges", "shortDescription": {"text": "Possibly dead Python function: promote_edges"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f0204e39ce9aea6", "name": "Possibly dead Python function: save_cache", "shortDescription": {"text": "Possibly dead Python function: save_cache"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79e6ead867db7486", "name": "Possibly dead Python function: list_unended", "shortDescription": {"text": "Possibly dead Python function: list_unended"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0197df747c5b8449", "name": "Possibly dead Python function: list_by_partner", "shortDescription": {"text": "Possibly dead Python function: list_by_partner"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef7aa30ce6f0f61e", "name": "Possibly dead Python function: count_assistant_since", "shortDescription": {"text": "Possibly dead Python function: count_assistant_since"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de3c1f217d72a063", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99baaad1cc2c5120", "name": "Very large file: tests/test_l5_engine.py (1448 lines)", "shortDescription": {"text": "Very large file: tests/test_l5_engine.py (1448 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a8d4979a7cd46ce", "name": "Very large file: src/ruru/core/engine.py (1059 lines)", "shortDescription": {"text": "Very large file: src/ruru/core/engine.py (1059 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89eec88f436e382e", "name": "Legacy-named symbol `e_old` in tests/test_db_v4.py:272", "shortDescription": {"text": "Legacy-named symbol `e_old` in tests/test_db_v4.py:272"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bf9b35d094317c6", "name": "Legacy-named symbol `model_copy` in tests/test_l8_exploration_runner.py:65", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_l8_exploration_runner.py:65"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55c094e39e8f3165", "name": "Legacy-named symbol `model_copy` in tests/test_l8_exploration_engine.py:146", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_l8_exploration_engine.py:146"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a64087093a5e0d6", "name": "Legacy-named symbol `_task_metadata_backup` in tests/test_l3_dream_v4.py:1068", "shortDescription": {"text": "Legacy-named symbol `_task_metadata_backup` in tests/test_l3_dream_v4.py:1068"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1143c5d291d2d6fc", "name": "Legacy-named symbol `model_copy` in tests/test_l2_recall.py:74", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_l2_recall.py:74"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0dee24ef86934bd1", "name": "Legacy-named symbol `_stt_unused` in tests/test_l6_websocket_session.py:533", "shortDescription": {"text": "Legacy-named symbol `_stt_unused` in tests/test_l6_websocket_session.py:533"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40737b5779568cc4", "name": "Legacy-named symbol `007_v4_drop_legacy` in tests/test_db_migration_v4.py:167", "shortDescription": {"text": "Legacy-named symbol `007_v4_drop_legacy` in tests/test_db_migration_v4.py:167"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-beffa4fefd23176d", "name": "Legacy-named symbol `model_copy` in tests/test_l5_main.py:302", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_l5_main.py:302"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6166e3bf060aa85d", "name": "Legacy-named symbol `007_v4_drop_legacy` in tests/test_db.py:42", "shortDescription": {"text": "Legacy-named symbol `007_v4_drop_legacy` in tests/test_db.py:42"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-816415b237285e48", "name": "Legacy-named symbol `model_copy` in tests/test_l5_engine.py:342", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_l5_engine.py:342"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26b6696bf490931a", "name": "Commented-code block (5 lines) in src/ruru/adapters/websocket/config.py:67", "shortDescription": {"text": "Commented-code block (5 lines) in src/ruru/adapters/websocket/config.py:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8835d897d050b8b7", "name": "Commented-code block (5 lines) in src/ruru/adapters/websocket/adapter.py:91", "shortDescription": {"text": "Commented-code block (5 lines) in src/ruru/adapters/websocket/adapter.py:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33e0707acc402e67", "name": "Commented-code block (5 lines) in src/ruru/adapters/discord/adapter.py:446", "shortDescription": {"text": "Commented-code block (5 lines) in src/ruru/adapters/discord/adapter.py:446"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a88f1f55e52df98", "name": "Stub function `send_face` (body is just `pass`/`return`) \u2014 src/ruru/adapters/discord/adapter.py:914", "shortDescription": {"text": "Stub function `send_face` (body is just `pass`/`return`) \u2014 src/ruru/adapters/discord/adapter.py:914"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f40880bfd10fed8f", "name": "Commented-code block (6 lines) in src/ruru/core/face_tag.py:95", "shortDescription": {"text": "Commented-code block (6 lines) in src/ruru/core/face_tag.py:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d20986cc2a0aa03", "name": "Commented-code block (5 lines) in src/ruru/core/engine.py:106", "shortDescription": {"text": "Commented-code block (5 lines) in src/ruru/core/engine.py:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc6de5ec0d18d33c", "name": "Stub function `_empty_iter` (body is just `pass`/`return`) \u2014 src/ruru/core/llm/openai.py:176", "shortDescription": {"text": "Stub function `_empty_iter` (body is just `pass`/`return`) \u2014 src/ruru/core/llm/openai.py:176"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9313d9dc95a2bd8", "name": "Commented-code block (6 lines) in src/ruru/core/exploration/engine.py:191", "shortDescription": {"text": "Commented-code block (6 lines) in src/ruru/core/exploration/engine.py:191"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16e3ea9e7f1f1534", "name": "Legacy-named symbol `_task_metadata_backup` in src/ruru/core/scheduler/store.py:126", "shortDescription": {"text": "Legacy-named symbol `_task_metadata_backup` in src/ruru/core/scheduler/store.py:126"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8023ef41f643b97a", "name": "Commented-code block (5 lines) in src/ruru/core/scheduler/store.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in src/ruru/core/scheduler/store.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/ruru/adapters/websocket/protocol.py:to_dict, src/ruru/adapters/websocket/protocol.py:to_dict, src/ruru/adapters/websocket/protocol.py:to_dict, src/ruru/adapters/websocket/protocol.py:to_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/ruru/adapters/websocket/tools.py:execute, src/ruru/adapters/websocket/tools.py:execute, src/ruru/adapters/websocket/tools.py:execute\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/ruru/adapters/websocket/output.py:send_text, src/ruru/adapters/websocket/output.py:send\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33a6b62e30ce7ab4", "name": "Near-duplicate function bodies in 6 places", "shortDescription": {"text": "Near-duplicate function bodies in 6 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/ruru/core/tools/builtin/task.py:execute, src/ruru/core/tools/builtin/task.py:execute, src/ruru/core/tools/builtin/task.py:execute, src/ruru/core/tools/builtin/task.py:execute\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c2bf47020582ca2", "name": "FastAPI POST `ota_handler` without auth dependency \u2014 src/ruru/adapters/websocket/ota.py:52", "shortDescription": {"text": "FastAPI POST `ota_handler` without auth dependency \u2014 src/ruru/adapters/websocket/ota.py:52"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24318"}, "properties": {"repository": "arrow2nd/ruru-ai", "repoUrl": "https://github.com/arrow2nd/ruru-ai", "branch": "main"}, "results": [{"ruleId": "scanner-361c650179624c28", "level": "note", "message": {"text": "Possibly dead Python function: enable_device_tools"}, "properties": {"repobilityId": "0e9766cf3e049e26", "scanner": "scanner-primary", "fingerprint": "361c650179624c28", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/adapters/websocket/adapter.py:108"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b0dc566aa1d27dd", "level": "note", "message": {"text": "Possibly dead Python function: emit"}, "properties": {"repobilityId": "fecc700ec874b669", "scanner": "scanner-primary", "fingerprint": "9b0dc566aa1d27dd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/core/error_notifier.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e0b8e7980d69653", "level": "note", "message": {"text": "Possibly dead Python function: promote_edges"}, "properties": {"repobilityId": "347aa8f84e1ff96f", "scanner": "scanner-primary", "fingerprint": "3e0b8e7980d69653", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/core/memory/promote.py:264"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f0204e39ce9aea6", "level": "note", "message": {"text": "Possibly dead Python function: save_cache"}, "properties": {"repobilityId": "75545bb4fa584afb", "scanner": "scanner-primary", "fingerprint": "4f0204e39ce9aea6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/core/tools/registry.py:269"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79e6ead867db7486", "level": "note", "message": {"text": "Possibly dead Python function: list_unended"}, "properties": {"repobilityId": "f03c47b7c886ab7a", "scanner": "scanner-primary", "fingerprint": "79e6ead867db7486", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/core/db/conversation.py:52"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0197df747c5b8449", "level": "note", "message": {"text": "Possibly dead Python function: list_by_partner"}, "properties": {"repobilityId": "5de32dc44aabd227", "scanner": "scanner-primary", "fingerprint": "0197df747c5b8449", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/core/db/conversation.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef7aa30ce6f0f61e", "level": "note", "message": {"text": "Possibly dead Python function: count_assistant_since"}, "properties": {"repobilityId": "dc95f662a118b9da", "scanner": "scanner-primary", "fingerprint": "ef7aa30ce6f0f61e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/core/db/message.py:159"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "1de0ecd007803dbd", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de3c1f217d72a063", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "4b5a8f4b177d3045", "scanner": "scanner-primary", "fingerprint": "de3c1f217d72a063", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-99baaad1cc2c5120", "level": "note", "message": {"text": "Very large file: tests/test_l5_engine.py (1448 lines)"}, "properties": {"repobilityId": "5a8990ce5766f630", "scanner": "scanner-primary", "fingerprint": "99baaad1cc2c5120", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5a8d4979a7cd46ce", "level": "note", "message": {"text": "Very large file: src/ruru/core/engine.py (1059 lines)"}, "properties": {"repobilityId": "db7616416957b90a", "scanner": "scanner-primary", "fingerprint": "5a8d4979a7cd46ce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "bda40d1c52d52348", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "19d4e1d730881b96", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89eec88f436e382e", "level": "note", "message": {"text": "Legacy-named symbol `e_old` in tests/test_db_v4.py:272"}, "properties": {"repobilityId": "70a18e53bb3f49fc", "scanner": "scanner-primary", "fingerprint": "89eec88f436e382e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5bf9b35d094317c6", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_l8_exploration_runner.py:65"}, "properties": {"repobilityId": "bd2507cf8aacec6c", "scanner": "scanner-primary", "fingerprint": "5bf9b35d094317c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-55c094e39e8f3165", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_l8_exploration_engine.py:146"}, "properties": {"repobilityId": "90acf1ceb98ad892", "scanner": "scanner-primary", "fingerprint": "55c094e39e8f3165", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a64087093a5e0d6", "level": "note", "message": {"text": "Legacy-named symbol `_task_metadata_backup` in tests/test_l3_dream_v4.py:1068"}, "properties": {"repobilityId": "a008599a6e58b87b", "scanner": "scanner-primary", "fingerprint": "7a64087093a5e0d6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1143c5d291d2d6fc", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_l2_recall.py:74"}, "properties": {"repobilityId": "83b7a66ea2a57954", "scanner": "scanner-primary", "fingerprint": "1143c5d291d2d6fc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0dee24ef86934bd1", "level": "note", "message": {"text": "Legacy-named symbol `_stt_unused` in tests/test_l6_websocket_session.py:533"}, "properties": {"repobilityId": "51f5f697a2ecc4da", "scanner": "scanner-primary", "fingerprint": "0dee24ef86934bd1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-40737b5779568cc4", "level": "note", "message": {"text": "Legacy-named symbol `007_v4_drop_legacy` in tests/test_db_migration_v4.py:167"}, "properties": {"repobilityId": "37c5ffadce822d51", "scanner": "scanner-primary", "fingerprint": "40737b5779568cc4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-beffa4fefd23176d", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_l5_main.py:302"}, "properties": {"repobilityId": "b8daa33eec8df747", "scanner": "scanner-primary", "fingerprint": "beffa4fefd23176d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6166e3bf060aa85d", "level": "note", "message": {"text": "Legacy-named symbol `007_v4_drop_legacy` in tests/test_db.py:42"}, "properties": {"repobilityId": "f3a8f8f5b01a34be", "scanner": "scanner-primary", "fingerprint": "6166e3bf060aa85d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-816415b237285e48", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_l5_engine.py:342"}, "properties": {"repobilityId": "e977c59a106a10e2", "scanner": "scanner-primary", "fingerprint": "816415b237285e48", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-26b6696bf490931a", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ruru/adapters/websocket/config.py:67"}, "properties": {"repobilityId": "890a55f02aa44bad", "scanner": "scanner-primary", "fingerprint": "26b6696bf490931a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8835d897d050b8b7", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ruru/adapters/websocket/adapter.py:91"}, "properties": {"repobilityId": "530e279a22a798e7", "scanner": "scanner-primary", "fingerprint": "8835d897d050b8b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-33e0707acc402e67", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ruru/adapters/discord/adapter.py:446"}, "properties": {"repobilityId": "44ed18102598f40d", "scanner": "scanner-primary", "fingerprint": "33e0707acc402e67", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3a88f1f55e52df98", "level": "note", "message": {"text": "Stub function `send_face` (body is just `pass`/`return`) \u2014 src/ruru/adapters/discord/adapter.py:914"}, "properties": {"repobilityId": "e95b1614ddf92abc", "scanner": "scanner-primary", "fingerprint": "3a88f1f55e52df98", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-f40880bfd10fed8f", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/ruru/core/face_tag.py:95"}, "properties": {"repobilityId": "0a137b25c457167f", "scanner": "scanner-primary", "fingerprint": "f40880bfd10fed8f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d20986cc2a0aa03", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ruru/core/engine.py:106"}, "properties": {"repobilityId": "f2c31dcaf9415639", "scanner": "scanner-primary", "fingerprint": "3d20986cc2a0aa03", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bc6de5ec0d18d33c", "level": "note", "message": {"text": "Stub function `_empty_iter` (body is just `pass`/`return`) \u2014 src/ruru/core/llm/openai.py:176"}, "properties": {"repobilityId": "00e44a73ae63798a", "scanner": "scanner-primary", "fingerprint": "bc6de5ec0d18d33c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-d9313d9dc95a2bd8", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/ruru/core/exploration/engine.py:191"}, "properties": {"repobilityId": "156e10ba5fda7ea2", "scanner": "scanner-primary", "fingerprint": "d9313d9dc95a2bd8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-16e3ea9e7f1f1534", "level": "note", "message": {"text": "Legacy-named symbol `_task_metadata_backup` in src/ruru/core/scheduler/store.py:126"}, "properties": {"repobilityId": "defd3bdab8b6205a", "scanner": "scanner-primary", "fingerprint": "16e3ea9e7f1f1534", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8023ef41f643b97a", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ruru/core/scheduler/store.py:73"}, "properties": {"repobilityId": "da57260a2f94d816", "scanner": "scanner-primary", "fingerprint": "8023ef41f643b97a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "ae300fa5276ea134", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "02f31749ab197963", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0fc35bb117b4c89d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "afedc98883cb0a8d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5f64918d8fd2b231", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "fd8c6c0cf3d7a43b", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0a8e0e01006b153a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "50b3aecb2fdfb9e0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b02e01d14bb1bdf2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "9f129c3a49182a9a", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "731b697321d17dfc", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-33a6b62e30ce7ab4", "level": "note", "message": {"text": "Near-duplicate function bodies in 6 places"}, "properties": {"repobilityId": "0309e960d3bbd1f8", "scanner": "scanner-primary", "fingerprint": "33a6b62e30ce7ab4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "212f3f0694508c7f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "681ad60e852c43aa", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3c97480a7478edb5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1a7c11aaddfe30e9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2dfb2a88766934cd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "26dd52df26d29637", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-4c2bf47020582ca2", "level": "error", "message": {"text": "FastAPI POST `ota_handler` without auth dependency \u2014 src/ruru/adapters/websocket/ota.py:52"}, "properties": {"repobilityId": "812a95d9aa10c1eb", "scanner": "scanner-primary", "fingerprint": "4c2bf47020582ca2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ruru/adapters/websocket/ota.py"}, "region": {"startLine": 52}}}]}]}]}