{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e5d666aea7c30316", "name": "Possibly dead Python function: natural_key", "shortDescription": {"text": "Possibly dead Python function: natural_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-694ed338a881232b", "name": "Stray `console.log` in TS/JS \u2014 qvac-app/src/build-index.js:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/build-index.js:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4ffa195caec5329", "name": "Stray `console.log` in TS/JS \u2014 qvac-app/src/cli.js:54", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/cli.js:54"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3798169ae0f99f5c", "name": "Stray `console.log` in TS/JS \u2014 qvac-app/src/server.js:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/server.js:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f8af82f9c5cd55b", "name": "Stray `console.log` in TS/JS \u2014 qvac-app/src/cli-commands.js:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/cli-commands.js:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35bb268ea2b6dcea", "name": "Stray `console.log` in TS/JS \u2014 qvac-app/src/speech.js:422", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/speech.js:422"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d428aa009cc01a9d", "name": "Insecure pattern 'eval_used' in qvac-app/README.md:162", "shortDescription": {"text": "Insecure pattern 'eval_used' in qvac-app/README.md:162"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d7369339ff163b5", "name": "Insecure pattern 'node_child_process' in qvac-app/scripts/p2p_test.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/p2p_test.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08b2be3f140fab2a", "name": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_client_jury_smoke.mjs:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_client_jury_smoke.mjs:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-972a4672596bfb20", "name": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_client_smoke.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_client_smoke.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55df21f6037f6c05", "name": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_jury_smoke.mjs:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_jury_smoke.mjs:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c91ef124e6e5987", "name": "Insecure pattern 'node_child_process' in qvac-app/scripts/preflight.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/preflight.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af132d41ef88f6d4", "name": "Insecure pattern 'cors_wildcard' in qvac-app/src/server.js:203", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in qvac-app/src/server.js:203"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2eb3d77e9770b4a2", "name": "Insecure pattern 'node_child_process' in qvac-app/src/speech.js:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in qvac-app/src/speech.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37a086b1619b6cbf", "name": "Insecure pattern 'eval_used' in questions_adversarial_i18n/README.md:5", "shortDescription": {"text": "Insecure pattern 'eval_used' in questions_adversarial_i18n/README.md:5"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c113096db6aee68d", "name": "Very large file: qvac-app/src/server.js (910 lines)", "shortDescription": {"text": "Very large file: qvac-app/src/server.js (910 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "4 test file(s) for 107 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 208 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 25 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e54cd45b39948f9b", "name": "Commented-code block (6 lines) in qvac-app/scripts/autonomous_triage_smoke.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/scripts/autonomous_triage_smoke.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-485c016acd09377e", "name": "Commented-code block (6 lines) in qvac-app/scripts/agent_eval.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/scripts/agent_eval.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa957155278ebaf4", "name": "Commented-code block (6 lines) in qvac-app/scripts/federated_learning_smoke.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/scripts/federated_learning_smoke.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0568e2f3f5319b1c", "name": "Commented-code block (5 lines) in qvac-app/scripts/consult_responder.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/scripts/consult_responder.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-14b24af660fc1a13", "name": "Commented-code block (5 lines) in qvac-app/scripts/edge_learning_smoke.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/scripts/edge_learning_smoke.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06663d391ee55109", "name": "Commented-code block (8 lines) in qvac-app/scripts/federated_signals_smoke.mjs:1", "shortDescription": {"text": "Commented-code block (8 lines) in qvac-app/scripts/federated_signals_smoke.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d89d8248b71c8ac8", "name": "Commented-code block (5 lines) in qvac-app/scripts/consult_client_jury_smoke.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/scripts/consult_client_jury_smoke.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-944e02675d8bd235", "name": "Commented-code block (7 lines) in qvac-app/scripts/doc_rag_eval.mjs:5", "shortDescription": {"text": "Commented-code block (7 lines) in qvac-app/scripts/doc_rag_eval.mjs:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a0e6bab3ecc658c", "name": "Commented-code block (8 lines) in qvac-app/packages/factstore/src/tools.js:5", "shortDescription": {"text": "Commented-code block (8 lines) in qvac-app/packages/factstore/src/tools.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-195cb8340819fb6d", "name": "Commented-code block (7 lines) in qvac-app/packages/factstore/src/okf.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in qvac-app/packages/factstore/src/okf.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce423744bd485b6f", "name": "Commented-code block (5 lines) in qvac-app/packages/factstore/src/store.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/packages/factstore/src/store.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d82cea8a68f1fba", "name": "Commented-code block (7 lines) in qvac-app/packages/factstore/src/adapters/hypercore.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in qvac-app/packages/factstore/src/adapters/hypercore.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4847407dd8982b41", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/okf.ts:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/okf.ts:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33b93d838e4a7f6d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/openai.ts:14", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/openai.ts:14"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a009d2e53f893071", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/mockEhr.ts:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/mockEhr.ts:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-064e7907ef0459ca", "name": "Commented-code block (5 lines) in qvac-app/web/src/lib/speech.ts:215", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/web/src/lib/speech.ts:215"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31626cf7b77df462", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/speech.ts:193", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/speech.ts:193"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-301d121864883172", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/audit.ts:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/audit.ts:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53bb8701409c424", "name": "Commented-code block (6 lines) in qvac-app/web/src/lib/translate.ts:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/web/src/lib/translate.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d742c973dd247d4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/ui.tsx:110", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/ui.tsx:110"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9093a15e3dfecfa2", "name": "Commented-code block (6 lines) in qvac-app/web/src/lib/prefs.tsx:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/web/src/lib/prefs.tsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a7a88935261f7d8", "name": "Commented-code block (6 lines) in qvac-app/web/src/pages/SignalsDemo.tsx:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/web/src/pages/SignalsDemo.tsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-86df635df28dc260", "name": "Commented-code block (5 lines) in qvac-app/web/src/pages/Agent.tsx:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/web/src/pages/Agent.tsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4f7290bd15c37571", "name": "Commented-code block (5 lines) in qvac-app/src/edge-learning.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/edge-learning.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d825eac0bf954c05", "name": "Commented-code block (6 lines) in qvac-app/src/consult.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/src/consult.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-390d7f41ffa44bf1", "name": "Commented-code block (5 lines) in qvac-app/src/tools.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/tools.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-707d70cc32989b1f", "name": "Commented-code block (7 lines) in qvac-app/src/knowledge.js:4", "shortDescription": {"text": "Commented-code block (7 lines) in qvac-app/src/knowledge.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-510801cf8dce1f2c", "name": "Commented-code block (5 lines) in qvac-app/src/kb-sync.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/kb-sync.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-737c8bd1db368ff6", "name": "Commented-code block (5 lines) in qvac-app/src/agent.js:22", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/agent.js:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17f8eca7794c18e8", "name": "Commented-code block (5 lines) in qvac-app/src/prompt.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/prompt.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-05fad2be884392de", "name": "Commented-code block (5 lines) in qvac-app/src/config.js:38", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/config.js:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0a8ab0584fc8ddf", "name": "Commented-code block (5 lines) in qvac-app/src/icd.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/icd.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-963c1093627d9222", "name": "Commented-code block (9 lines) in qvac-app/src/signals.js:3", "shortDescription": {"text": "Commented-code block (9 lines) in qvac-app/src/signals.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66d0c4015684e66e", "name": "Commented-code block (5 lines) in qvac-app/src/triage-agent.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/triage-agent.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97c1886974aa6eea", "name": "Commented-code block (5 lines) in qvac-app/src/server.js:142", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/server.js:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eda99689ea63329d", "name": "Commented-code block (6 lines) in qvac-app/src/audit-okf.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/src/audit-okf.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ba82ee9fa49d31e", "name": "Commented-code block (6 lines) in qvac-app/src/audit.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/src/audit.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-497c4dc49be310e8", "name": "Commented-code block (10 lines) in qvac-app/src/speech.js:1", "shortDescription": {"text": "Commented-code block (10 lines) in qvac-app/src/speech.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dceedc1ade58d614", "name": "Commented-code block (5 lines) in qvac-app/src/icd-index.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/icd-index.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-37cef900141b3578", "name": "Commented-code block (6 lines) in qvac-app/src/medlens.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in qvac-app/src/medlens.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-68ebed57b60c69f8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/src/backends/lmstudio.js:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/src/backends/lmstudio.js:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eab617b3ad2c50cc", "name": "Commented-code block (5 lines) in qvac-app/src/backends/qvac.js:7", "shortDescription": {"text": "Commented-code block (5 lines) in qvac-app/src/backends/qvac.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-526af44b904ea9ec", "name": "54 env vars used in code but missing from .env.example", "shortDescription": {"text": "54 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `API_PORT`, `DELAY_MS`, `ICD_INDEX`, `MEDPSY_AUDIT_DIR`, `MEDPSY_AUDIT_KEY`, `MEDPSY_CANTO_LEXICON`, `MEDPSY_CANTO_ONNX`, `MEDPSY_CANTO_RULE` + 46 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nqvac-app/scripts/sherpa_tts_worker.py:write_wav, qvac-app/scripts/tts_worker.py:write_wav\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-165c58e74b23e722", "name": "Frontend route `/two-kiosk` has no Link/navigate to it \u2014 qvac-app/web/src/App.tsx", "shortDescription": {"text": "Frontend route `/two-kiosk` has no Link/navigate to it \u2014 qvac-app/web/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21033"}, "properties": {"repository": "tfius/medpsy-kent", "repoUrl": "https://github.com/tfius/medpsy-kent", "branch": "main"}, "results": [{"ruleId": "scanner-e5d666aea7c30316", "level": "note", "message": {"text": "Possibly dead Python function: natural_key"}, "properties": {"repobilityId": "4360b4c70da0ed92", "scanner": "scanner-primary", "fingerprint": "e5d666aea7c30316", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "compare_runs.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-694ed338a881232b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/build-index.js:8"}, "properties": {"repobilityId": "7bbfd88e1a82c532", "scanner": "scanner-primary", "fingerprint": "694ed338a881232b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d4ffa195caec5329", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/cli.js:54"}, "properties": {"repobilityId": "0fc68cb8626767f9", "scanner": "scanner-primary", "fingerprint": "d4ffa195caec5329", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3798169ae0f99f5c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/server.js:65"}, "properties": {"repobilityId": "4f24c7b421898c71", "scanner": "scanner-primary", "fingerprint": "3798169ae0f99f5c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2f8af82f9c5cd55b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/cli-commands.js:41"}, "properties": {"repobilityId": "0a294985db42ef3e", "scanner": "scanner-primary", "fingerprint": "2f8af82f9c5cd55b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-35bb268ea2b6dcea", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 qvac-app/src/speech.js:422"}, "properties": {"repobilityId": "04f9b8e15637636c", "scanner": "scanner-primary", "fingerprint": "35bb268ea2b6dcea", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d428aa009cc01a9d", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in qvac-app/README.md:162"}, "properties": {"repobilityId": "57ba70f18adf0a7c", "scanner": "scanner-primary", "fingerprint": "d428aa009cc01a9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/README.md"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-5d7369339ff163b5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/p2p_test.mjs:9"}, "properties": {"repobilityId": "24c32d376f24f530", "scanner": "scanner-primary", "fingerprint": "5d7369339ff163b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/scripts/p2p_test.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-08b2be3f140fab2a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_client_jury_smoke.mjs:6"}, "properties": {"repobilityId": "2f1611cd6887a6be", "scanner": "scanner-primary", "fingerprint": "08b2be3f140fab2a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/scripts/consult_client_jury_smoke.mjs"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-972a4672596bfb20", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_client_smoke.mjs:5"}, "properties": {"repobilityId": "ddcc011a13c06bef", "scanner": "scanner-primary", "fingerprint": "972a4672596bfb20", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/scripts/consult_client_smoke.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-55df21f6037f6c05", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/consult_jury_smoke.mjs:5"}, "properties": {"repobilityId": "8ce11ef3a0e73c4d", "scanner": "scanner-primary", "fingerprint": "55df21f6037f6c05", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/scripts/consult_jury_smoke.mjs"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-2c91ef124e6e5987", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in qvac-app/scripts/preflight.mjs:9"}, "properties": {"repobilityId": "21d4852645121e12", "scanner": "scanner-primary", "fingerprint": "2c91ef124e6e5987", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/scripts/preflight.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-af132d41ef88f6d4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in qvac-app/src/server.js:203"}, "properties": {"repobilityId": "1f1b60b7db01af4c", "scanner": "scanner-primary", "fingerprint": "af132d41ef88f6d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/src/server.js"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-2eb3d77e9770b4a2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in qvac-app/src/speech.js:15"}, "properties": {"repobilityId": "b50aa36797f996d1", "scanner": "scanner-primary", "fingerprint": "2eb3d77e9770b4a2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "qvac-app/src/speech.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-37a086b1619b6cbf", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in questions_adversarial_i18n/README.md:5"}, "properties": {"repobilityId": "864da806903ca2ee", "scanner": "scanner-primary", "fingerprint": "37a086b1619b6cbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "questions_adversarial_i18n/README.md"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-c113096db6aee68d", "level": "note", "message": {"text": "Very large file: qvac-app/src/server.js (910 lines)"}, "properties": {"repobilityId": "faf2759bf1591f74", "scanner": "scanner-primary", "fingerprint": "c113096db6aee68d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "97f26db319b984bd", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1021402495ddd0dd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "5a48505d1adedf95", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8ae22a2a1f95a92e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "6c5eb29d8a39a1f4", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "5d4de5ec6350a052", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2ddd2031c6fd217a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c6259faf6371f548", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e54cd45b39948f9b", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/scripts/autonomous_triage_smoke.mjs:1"}, "properties": {"repobilityId": "f68e344951802595", "scanner": "scanner-primary", "fingerprint": "e54cd45b39948f9b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-485c016acd09377e", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/scripts/agent_eval.mjs:1"}, "properties": {"repobilityId": "e4c834dba421d59d", "scanner": "scanner-primary", "fingerprint": "485c016acd09377e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa957155278ebaf4", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/scripts/federated_learning_smoke.mjs:1"}, "properties": {"repobilityId": "57012b24868e3e71", "scanner": "scanner-primary", "fingerprint": "aa957155278ebaf4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0568e2f3f5319b1c", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/scripts/consult_responder.mjs:1"}, "properties": {"repobilityId": "46d2ead6e865b3ab", "scanner": "scanner-primary", "fingerprint": "0568e2f3f5319b1c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-14b24af660fc1a13", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/scripts/edge_learning_smoke.mjs:1"}, "properties": {"repobilityId": "4b64d8d31135dc4f", "scanner": "scanner-primary", "fingerprint": "14b24af660fc1a13", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06663d391ee55109", "level": "none", "message": {"text": "Commented-code block (8 lines) in qvac-app/scripts/federated_signals_smoke.mjs:1"}, "properties": {"repobilityId": "f5c4a6ca42915f67", "scanner": "scanner-primary", "fingerprint": "06663d391ee55109", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d89d8248b71c8ac8", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/scripts/consult_client_jury_smoke.mjs:1"}, "properties": {"repobilityId": "e5ae986599b2d0c5", "scanner": "scanner-primary", "fingerprint": "d89d8248b71c8ac8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-944e02675d8bd235", "level": "none", "message": {"text": "Commented-code block (7 lines) in qvac-app/scripts/doc_rag_eval.mjs:5"}, "properties": {"repobilityId": "9f9ee4cab034d938", "scanner": "scanner-primary", "fingerprint": "944e02675d8bd235", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0a0e6bab3ecc658c", "level": "none", "message": {"text": "Commented-code block (8 lines) in qvac-app/packages/factstore/src/tools.js:5"}, "properties": {"repobilityId": "2b08ddabf8534cf5", "scanner": "scanner-primary", "fingerprint": "0a0e6bab3ecc658c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-195cb8340819fb6d", "level": "none", "message": {"text": "Commented-code block (7 lines) in qvac-app/packages/factstore/src/okf.js:1"}, "properties": {"repobilityId": "121c59c9a87d6fcb", "scanner": "scanner-primary", "fingerprint": "195cb8340819fb6d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce423744bd485b6f", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/packages/factstore/src/store.js:1"}, "properties": {"repobilityId": "f420cf6a8125b051", "scanner": "scanner-primary", "fingerprint": "ce423744bd485b6f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d82cea8a68f1fba", "level": "none", "message": {"text": "Commented-code block (7 lines) in qvac-app/packages/factstore/src/adapters/hypercore.js:1"}, "properties": {"repobilityId": "f98a42f62d38a305", "scanner": "scanner-primary", "fingerprint": "8d82cea8a68f1fba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4847407dd8982b41", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/okf.ts:17"}, "properties": {"repobilityId": "e2beba9dbc2e3ac7", "scanner": "scanner-primary", "fingerprint": "4847407dd8982b41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-33b93d838e4a7f6d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/openai.ts:14"}, "properties": {"repobilityId": "a85299e60654f580", "scanner": "scanner-primary", "fingerprint": "33b93d838e4a7f6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a009d2e53f893071", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/mockEhr.ts:1"}, "properties": {"repobilityId": "6b506ff26c6e3d84", "scanner": "scanner-primary", "fingerprint": "a009d2e53f893071", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-064e7907ef0459ca", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/web/src/lib/speech.ts:215"}, "properties": {"repobilityId": "3f1494de0fc80d8a", "scanner": "scanner-primary", "fingerprint": "064e7907ef0459ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-31626cf7b77df462", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/speech.ts:193"}, "properties": {"repobilityId": "05535f15f3458114", "scanner": "scanner-primary", "fingerprint": "31626cf7b77df462", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-301d121864883172", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/audit.ts:68"}, "properties": {"repobilityId": "d35f8e8f7d89d5dc", "scanner": "scanner-primary", "fingerprint": "301d121864883172", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a53bb8701409c424", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/web/src/lib/translate.ts:1"}, "properties": {"repobilityId": "5067217317f6881f", "scanner": "scanner-primary", "fingerprint": "a53bb8701409c424", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d742c973dd247d4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/web/src/lib/ui.tsx:110"}, "properties": {"repobilityId": "a12d49c8a8d8c709", "scanner": "scanner-primary", "fingerprint": "8d742c973dd247d4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9093a15e3dfecfa2", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/web/src/lib/prefs.tsx:1"}, "properties": {"repobilityId": "2586bcb7cba97a58", "scanner": "scanner-primary", "fingerprint": "9093a15e3dfecfa2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a7a88935261f7d8", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/web/src/pages/SignalsDemo.tsx:1"}, "properties": {"repobilityId": "a605e1b15c783cc5", "scanner": "scanner-primary", "fingerprint": "8a7a88935261f7d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-86df635df28dc260", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/web/src/pages/Agent.tsx:1"}, "properties": {"repobilityId": "6d8a7cf6ce2b6cb0", "scanner": "scanner-primary", "fingerprint": "86df635df28dc260", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4f7290bd15c37571", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/edge-learning.js:1"}, "properties": {"repobilityId": "39d180d31b7f7e64", "scanner": "scanner-primary", "fingerprint": "4f7290bd15c37571", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d825eac0bf954c05", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/src/consult.js:1"}, "properties": {"repobilityId": "a82ee45c6840f6eb", "scanner": "scanner-primary", "fingerprint": "d825eac0bf954c05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-390d7f41ffa44bf1", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/tools.js:1"}, "properties": {"repobilityId": "cec77a5121292e70", "scanner": "scanner-primary", "fingerprint": "390d7f41ffa44bf1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-707d70cc32989b1f", "level": "none", "message": {"text": "Commented-code block (7 lines) in qvac-app/src/knowledge.js:4"}, "properties": {"repobilityId": "db47ed3739cff31d", "scanner": "scanner-primary", "fingerprint": "707d70cc32989b1f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-510801cf8dce1f2c", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/kb-sync.js:1"}, "properties": {"repobilityId": "218e7023f4f72c2c", "scanner": "scanner-primary", "fingerprint": "510801cf8dce1f2c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-737c8bd1db368ff6", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/agent.js:22"}, "properties": {"repobilityId": "5b3c952f65d7d09d", "scanner": "scanner-primary", "fingerprint": "737c8bd1db368ff6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-17f8eca7794c18e8", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/prompt.js:1"}, "properties": {"repobilityId": "f08ac377a925314f", "scanner": "scanner-primary", "fingerprint": "17f8eca7794c18e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-05fad2be884392de", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/config.js:38"}, "properties": {"repobilityId": "57a3a927fd96b00c", "scanner": "scanner-primary", "fingerprint": "05fad2be884392de", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0a8ab0584fc8ddf", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/icd.js:3"}, "properties": {"repobilityId": "acf6b298d3206b8f", "scanner": "scanner-primary", "fingerprint": "c0a8ab0584fc8ddf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-963c1093627d9222", "level": "none", "message": {"text": "Commented-code block (9 lines) in qvac-app/src/signals.js:3"}, "properties": {"repobilityId": "8865de78704964f0", "scanner": "scanner-primary", "fingerprint": "963c1093627d9222", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66d0c4015684e66e", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/triage-agent.js:1"}, "properties": {"repobilityId": "96db7a4c666ad46e", "scanner": "scanner-primary", "fingerprint": "66d0c4015684e66e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-97c1886974aa6eea", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/server.js:142"}, "properties": {"repobilityId": "cdd1607788102af6", "scanner": "scanner-primary", "fingerprint": "97c1886974aa6eea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eda99689ea63329d", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/src/audit-okf.js:4"}, "properties": {"repobilityId": "25518c691b83dfd1", "scanner": "scanner-primary", "fingerprint": "eda99689ea63329d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ba82ee9fa49d31e", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/src/audit.js:3"}, "properties": {"repobilityId": "e7a75405cc663f3c", "scanner": "scanner-primary", "fingerprint": "7ba82ee9fa49d31e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-497c4dc49be310e8", "level": "none", "message": {"text": "Commented-code block (10 lines) in qvac-app/src/speech.js:1"}, "properties": {"repobilityId": "9450c71cf8959491", "scanner": "scanner-primary", "fingerprint": "497c4dc49be310e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dceedc1ade58d614", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/icd-index.js:1"}, "properties": {"repobilityId": "b385aa8eff3d44cc", "scanner": "scanner-primary", "fingerprint": "dceedc1ade58d614", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-37cef900141b3578", "level": "none", "message": {"text": "Commented-code block (6 lines) in qvac-app/src/medlens.js:1"}, "properties": {"repobilityId": "39965cb375a92af1", "scanner": "scanner-primary", "fingerprint": "37cef900141b3578", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-68ebed57b60c69f8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 qvac-app/src/backends/lmstudio.js:12"}, "properties": {"repobilityId": "fd94e1e34c5c3bb5", "scanner": "scanner-primary", "fingerprint": "68ebed57b60c69f8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-eab617b3ad2c50cc", "level": "none", "message": {"text": "Commented-code block (5 lines) in qvac-app/src/backends/qvac.js:7"}, "properties": {"repobilityId": "dba1196e3b75fe81", "scanner": "scanner-primary", "fingerprint": "eab617b3ad2c50cc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-526af44b904ea9ec", "level": "note", "message": {"text": "54 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "313b369fa3c8cca9", "scanner": "scanner-primary", "fingerprint": "526af44b904ea9ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6b58b5f06e3d5a13", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-165c58e74b23e722", "level": "warning", "message": {"text": "Frontend route `/two-kiosk` has no Link/navigate to it \u2014 qvac-app/web/src/App.tsx"}, "properties": {"repobilityId": "5a47b92881d8a6eb", "scanner": "scanner-primary", "fingerprint": "165c58e74b23e722", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}