{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-cb5949e435280e37", "name": "Possibly dead Python function: run_unguarded", "shortDescription": {"text": "Possibly dead Python function: run_unguarded"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b70c67bef4268438", "name": "Possibly dead Python function: deco", "shortDescription": {"text": "Possibly dead Python function: deco"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a4561b4ffbdd224", "name": "Possibly dead Python function: one", "shortDescription": {"text": "Possibly dead Python function: one"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6ddc885b480109f6", "name": "Insecure pattern 'eval_used' in validation/README.md:281", "shortDescription": {"text": "Insecure pattern 'eval_used' in validation/README.md:281"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ead27f7f5ae76cb3", "name": "Insecure pattern 'eval_used' in validation/ratchet_efficacy.py:283", "shortDescription": {"text": "Insecure pattern 'eval_used' in validation/ratchet_efficacy.py:283"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9cb6f55ab9028890", "name": "Insecure pattern 'eval_used' in harness/evals.py:290", "shortDescription": {"text": "Insecure pattern 'eval_used' in harness/evals.py:290"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-77d82f8cd9de580e", "name": "Insecure pattern 'eval_used' in harness/orchestrator.py:195", "shortDescription": {"text": "Insecure pattern 'eval_used' in harness/orchestrator.py:195"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b2b714340be742b", "name": "Insecure pattern 'subprocess_shell_true' in harness/artifacts.py:111", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in harness/artifacts.py:111"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7343dc896fa52499", "name": "Insecure pattern 'eval_used' in harness/retrospective.py:177", "shortDescription": {"text": "Insecure pattern 'eval_used' in harness/retrospective.py:177"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9491f4cce88bf015", "name": "Very large file: tests/test_orchestrator.py (1450 lines)", "shortDescription": {"text": "Very large file: tests/test_orchestrator.py (1450 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e8a76eb13fd3249", "name": "Node manifest has dependencies but no lockfile: frontend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: frontend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 125 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a306b700b9fcda7", "name": "Commented-code block (7 lines) in frontend/playwright.config.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/playwright.config.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a10bd3b93c23df4", "name": "Commented-code block (5 lines) in tests/test_orchestrator.py:904", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_orchestrator.py:904"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f190bb6020ef680e", "name": "Commented-code block (5 lines) in tests/test_isolation.py:95", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_isolation.py:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-443210e1e94bfa3b", "name": "Commented-code block (5 lines) in tests/test_gate_dedup.py:53", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_gate_dedup.py:53"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f5c5a1f31714dec", "name": "Commented-code block (6 lines) in tests/test_artifacts.py:76", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_artifacts.py:76"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ef4e2eb73e99c0ef", "name": "Legacy-named symbol `test_source_is_git_clone_not_directory_copy` in tests/test_packaging.py:29", "shortDescription": {"text": "Legacy-named symbol `test_source_is_git_clone_not_directory_copy` in tests/test_packaging.py:29"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8491e6fe6dea05dc", "name": "Commented-code block (5 lines) in validation/ab_escape.py:605", "shortDescription": {"text": "Commented-code block (5 lines) in validation/ab_escape.py:605"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e3497692145d565a", "name": "Commented-code block (6 lines) in validation/field_ab_ledger/armP_files/ledger.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in validation/field_ab_ledger/armP_files/ledger.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-664ac657526448f4", "name": "Commented-code block (7 lines) in validation/field_ab_ledger/armP_files/ledger.test.ts:1", "shortDescription": {"text": "Commented-code block (7 lines) in validation/field_ab_ledger/armP_files/ledger.test.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-58abd79dc290da37", "name": "Commented-code block (6 lines) in harness/gotchas.py:12", "shortDescription": {"text": "Commented-code block (6 lines) in harness/gotchas.py:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-648758b3db826657", "name": "Commented-code block (5 lines) in harness/gates.py:38", "shortDescription": {"text": "Commented-code block (5 lines) in harness/gates.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c89b6099f8822c68", "name": "Commented-code block (5 lines) in harness/isolation.py:26", "shortDescription": {"text": "Commented-code block (5 lines) in harness/isolation.py:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8509a56c3083a2f", "name": "Network/subprocess call without timeout or try/except \u2014 harness/isolation.py:14", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/isolation.py:14"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-222b05983909b3d2", "name": "Legacy-named symbol `too_old` in harness/checkpoint.py:126", "shortDescription": {"text": "Legacy-named symbol `too_old` in harness/checkpoint.py:126"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3f2829dfe4872ae", "name": "Commented-code block (5 lines) in harness/checkpoint.py:9", "shortDescription": {"text": "Commented-code block (5 lines) in harness/checkpoint.py:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2db10bfb67a046a", "name": "Commented-code block (5 lines) in harness/config.py:48", "shortDescription": {"text": "Commented-code block (5 lines) in harness/config.py:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e03cf15d2a1ae2ac", "name": "Commented-code block (10 lines) in harness/evals.py:15", "shortDescription": {"text": "Commented-code block (10 lines) in harness/evals.py:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-619fd33ffb639ba2", "name": "Commented-code block (6 lines) in harness/orchestrator.py:159", "shortDescription": {"text": "Commented-code block (6 lines) in harness/orchestrator.py:159"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ee04c5e38142114", "name": "Commented-code block (5 lines) in harness/artifacts.py:25", "shortDescription": {"text": "Commented-code block (5 lines) in harness/artifacts.py:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fb7ff3234200e661", "name": "Network/subprocess call without timeout or try/except \u2014 harness/artifacts.py:111", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/artifacts.py:111"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f01737fd6d06c1ae", "name": "Commented-code block (5 lines) in harness/usage.py:3", "shortDescription": {"text": "Commented-code block (5 lines) in harness/usage.py:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e6472ed64073bcd", "name": "Commented-code block (5 lines) in harness/claude_runner.py:131", "shortDescription": {"text": "Commented-code block (5 lines) in harness/claude_runner.py:131"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b412808bcd4716b1", "name": "Network/subprocess call without timeout or try/except \u2014 harness/claude_runner.py:254", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/claude_runner.py:254"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c2fcf321a2d9091", "name": "Commented-code block (8 lines) in harness/closer.py:37", "shortDescription": {"text": "Commented-code block (8 lines) in harness/closer.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1fae488359cffb2", "name": "Network/subprocess call without timeout or try/except \u2014 harness/closer.py:10", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/closer.py:10"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nharness/gotchas.py:load, harness/evals.py:load\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19103"}, "properties": {"repository": "ScrapPack/Kausi", "repoUrl": "https://github.com/ScrapPack/Kausi", "branch": "main"}, "results": [{"ruleId": "scanner-cb5949e435280e37", "level": "note", "message": {"text": "Possibly dead Python function: run_unguarded"}, "properties": {"repobilityId": "2fbecb8103eac387", "scanner": "scanner-primary", "fingerprint": "cb5949e435280e37", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "validation/ab_escape.py:373"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b70c67bef4268438", "level": "note", "message": {"text": "Possibly dead Python function: deco"}, "properties": {"repobilityId": "11da05572c448654", "scanner": "scanner-primary", "fingerprint": "b70c67bef4268438", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "validation/field_ab_zeroshot/acceptance_check.py:26"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a4561b4ffbdd224", "level": "note", "message": {"text": "Possibly dead Python function: one"}, "properties": {"repobilityId": "692200a7e4dd59b4", "scanner": "scanner-primary", "fingerprint": "5a4561b4ffbdd224", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/claude_runner.py:434"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6ddc885b480109f6", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in validation/README.md:281"}, "properties": {"repobilityId": "6de452e3a935b620", "scanner": "scanner-primary", "fingerprint": "6ddc885b480109f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "validation/README.md"}, "region": {"startLine": 281}}}]}, {"ruleId": "scanner-ead27f7f5ae76cb3", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in validation/ratchet_efficacy.py:283"}, "properties": {"repobilityId": "18d784819c1508fb", "scanner": "scanner-primary", "fingerprint": "ead27f7f5ae76cb3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "validation/ratchet_efficacy.py"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-9cb6f55ab9028890", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in harness/evals.py:290"}, "properties": {"repobilityId": "de6cd9e6d4144466", "scanner": "scanner-primary", "fingerprint": "9cb6f55ab9028890", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/evals.py"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-77d82f8cd9de580e", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in harness/orchestrator.py:195"}, "properties": {"repobilityId": "c7f09040f90ab69e", "scanner": "scanner-primary", "fingerprint": "77d82f8cd9de580e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/orchestrator.py"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-8b2b714340be742b", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in harness/artifacts.py:111"}, "properties": {"repobilityId": "a147795802d98a7d", "scanner": "scanner-primary", "fingerprint": "8b2b714340be742b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/artifacts.py"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-7343dc896fa52499", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in harness/retrospective.py:177"}, "properties": {"repobilityId": "8bb08e91212d3db6", "scanner": "scanner-primary", "fingerprint": "7343dc896fa52499", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "harness/retrospective.py"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-9491f4cce88bf015", "level": "note", "message": {"text": "Very large file: tests/test_orchestrator.py (1450 lines)"}, "properties": {"repobilityId": "a413d71fe2a576c0", "scanner": "scanner-primary", "fingerprint": "9491f4cce88bf015", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "ccf18f5e8460de05", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-0e8a76eb13fd3249", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: frontend/package.json"}, "properties": {"repobilityId": "d8c65da5b68ee95b", "scanner": "scanner-primary", "fingerprint": "0e8a76eb13fd3249", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "bbf953f9fbb7172b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3726d6ba0ea07bd5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "767a9e6d0394e8f3", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fc00c780cc732b96", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d804d4510325cf70", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "e1015500298605fe", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-5a306b700b9fcda7", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/playwright.config.mjs:1"}, "properties": {"repobilityId": "1e4db9a59f1e19c9", "scanner": "scanner-primary", "fingerprint": "5a306b700b9fcda7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5a10bd3b93c23df4", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_orchestrator.py:904"}, "properties": {"repobilityId": "f81a8c50a07ef45f", "scanner": "scanner-primary", "fingerprint": "5a10bd3b93c23df4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f190bb6020ef680e", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_isolation.py:95"}, "properties": {"repobilityId": "5eb2991ca9f57a5c", "scanner": "scanner-primary", "fingerprint": "f190bb6020ef680e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-443210e1e94bfa3b", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_gate_dedup.py:53"}, "properties": {"repobilityId": "0c83f3c6a77c54e7", "scanner": "scanner-primary", "fingerprint": "443210e1e94bfa3b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f5c5a1f31714dec", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_artifacts.py:76"}, "properties": {"repobilityId": "5be12069ca6b845d", "scanner": "scanner-primary", "fingerprint": "8f5c5a1f31714dec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ef4e2eb73e99c0ef", "level": "note", "message": {"text": "Legacy-named symbol `test_source_is_git_clone_not_directory_copy` in tests/test_packaging.py:29"}, "properties": {"repobilityId": "ce4d7a4cef755fc0", "scanner": "scanner-primary", "fingerprint": "ef4e2eb73e99c0ef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8491e6fe6dea05dc", "level": "none", "message": {"text": "Commented-code block (5 lines) in validation/ab_escape.py:605"}, "properties": {"repobilityId": "2b584a969a467165", "scanner": "scanner-primary", "fingerprint": "8491e6fe6dea05dc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e3497692145d565a", "level": "none", "message": {"text": "Commented-code block (6 lines) in validation/field_ab_ledger/armP_files/ledger.ts:3"}, "properties": {"repobilityId": "8d2b5d3146de3c09", "scanner": "scanner-primary", "fingerprint": "e3497692145d565a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-664ac657526448f4", "level": "none", "message": {"text": "Commented-code block (7 lines) in validation/field_ab_ledger/armP_files/ledger.test.ts:1"}, "properties": {"repobilityId": "0594c3affee57852", "scanner": "scanner-primary", "fingerprint": "664ac657526448f4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-58abd79dc290da37", "level": "none", "message": {"text": "Commented-code block (6 lines) in harness/gotchas.py:12"}, "properties": {"repobilityId": "1ecb443f52781cd9", "scanner": "scanner-primary", "fingerprint": "58abd79dc290da37", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-648758b3db826657", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/gates.py:38"}, "properties": {"repobilityId": "5970fe17c28a8f6c", "scanner": "scanner-primary", "fingerprint": "648758b3db826657", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c89b6099f8822c68", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/isolation.py:26"}, "properties": {"repobilityId": "a90727146f973df1", "scanner": "scanner-primary", "fingerprint": "c89b6099f8822c68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8509a56c3083a2f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/isolation.py:14"}, "properties": {"repobilityId": "72a449c990ddce52", "scanner": "scanner-primary", "fingerprint": "c8509a56c3083a2f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-222b05983909b3d2", "level": "note", "message": {"text": "Legacy-named symbol `too_old` in harness/checkpoint.py:126"}, "properties": {"repobilityId": "f68c2185a46c5567", "scanner": "scanner-primary", "fingerprint": "222b05983909b3d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e3f2829dfe4872ae", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/checkpoint.py:9"}, "properties": {"repobilityId": "c191e160fc249a17", "scanner": "scanner-primary", "fingerprint": "e3f2829dfe4872ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a2db10bfb67a046a", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/config.py:48"}, "properties": {"repobilityId": "d447b800bac25eac", "scanner": "scanner-primary", "fingerprint": "a2db10bfb67a046a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e03cf15d2a1ae2ac", "level": "none", "message": {"text": "Commented-code block (10 lines) in harness/evals.py:15"}, "properties": {"repobilityId": "9502b21f36804295", "scanner": "scanner-primary", "fingerprint": "e03cf15d2a1ae2ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-619fd33ffb639ba2", "level": "none", "message": {"text": "Commented-code block (6 lines) in harness/orchestrator.py:159"}, "properties": {"repobilityId": "038e8f71ce950c04", "scanner": "scanner-primary", "fingerprint": "619fd33ffb639ba2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ee04c5e38142114", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/artifacts.py:25"}, "properties": {"repobilityId": "1e0cab457ac313ce", "scanner": "scanner-primary", "fingerprint": "8ee04c5e38142114", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fb7ff3234200e661", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/artifacts.py:111"}, "properties": {"repobilityId": "ab9658bbe7b2c595", "scanner": "scanner-primary", "fingerprint": "fb7ff3234200e661", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f01737fd6d06c1ae", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/usage.py:3"}, "properties": {"repobilityId": "c0712481b57ea399", "scanner": "scanner-primary", "fingerprint": "f01737fd6d06c1ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e6472ed64073bcd", "level": "none", "message": {"text": "Commented-code block (5 lines) in harness/claude_runner.py:131"}, "properties": {"repobilityId": "0c7366bfe289a447", "scanner": "scanner-primary", "fingerprint": "8e6472ed64073bcd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b412808bcd4716b1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/claude_runner.py:254"}, "properties": {"repobilityId": "cbd4e95fa6485e08", "scanner": "scanner-primary", "fingerprint": "b412808bcd4716b1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6c2fcf321a2d9091", "level": "none", "message": {"text": "Commented-code block (8 lines) in harness/closer.py:37"}, "properties": {"repobilityId": "14a940a6d53719e9", "scanner": "scanner-primary", "fingerprint": "6c2fcf321a2d9091", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c1fae488359cffb2", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 harness/closer.py:10"}, "properties": {"repobilityId": "55e8bcdd692b17ca", "scanner": "scanner-primary", "fingerprint": "c1fae488359cffb2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8740ede79327266a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a153e00de958ac01", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "18cd778f418c115c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ae457765f4567cbf", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}