{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c72232e56d3bb6d1", "name": "Possibly dead Python function: check_naming_pattern", "shortDescription": {"text": "Possibly dead Python function: check_naming_pattern"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a118047f7c88c5c", "name": "Possibly dead Python function: check_front_matter_schema", "shortDescription": {"text": "Possibly dead Python function: check_front_matter_schema"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e4f2761eebdfb2e", "name": "Possibly dead Python function: check_dependency_graph", "shortDescription": {"text": "Possibly dead Python function: check_dependency_graph"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88d7a14f56f79f93", "name": "Possibly dead Python function: check_filename_id_parity", "shortDescription": {"text": "Possibly dead Python function: check_filename_id_parity"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cde3667dada1803f", "name": "Possibly dead Python function: check_status_invariants", "shortDescription": {"text": "Possibly dead Python function: check_status_invariants"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8c293b3e6fa09bf", "name": "Possibly dead Python function: check_freshness", "shortDescription": {"text": "Possibly dead Python function: check_freshness"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6cfbf222b9bf4ed", "name": "Possibly dead Python function: check_link_integrity", "shortDescription": {"text": "Possibly dead Python function: check_link_integrity"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9272ea88ab562cfb", "name": "Possibly dead Python function: check_english_only", "shortDescription": {"text": "Possibly dead Python function: check_english_only"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-911dd4fd0729abae", "name": "Possibly dead Python function: check_trivial_lane_eligibility", "shortDescription": {"text": "Possibly dead Python function: check_trivial_lane_eligibility"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8c3c0595422195b", "name": "Possibly dead Python function: check_res_eligibility", "shortDescription": {"text": "Possibly dead Python function: check_res_eligibility"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5b09dab12a4e2c0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 6 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 24 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8785031af6136961", "name": "Agent authority lacks a verifier contract: framework/templates/project/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/project/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28b0f0d7ba8f0027", "name": "Agent authority lacks a verifier contract: framework/templates/project/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/project/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52bf850a76624821", "name": "Agent authority lacks a verifier contract: framework/templates/project/.github/copilot-instructions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/project/.github/copilot-instructions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-878518a87b46846a", "name": "Agent authority lacks a verifier contract: framework/templates/system/copilot/copilot-instructions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/system/copilot/copilot-instructions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a8ae6d084a315db", "name": "Agent authority lacks a verifier contract: framework/templates/system/codex/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/system/codex/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47e94632482b452a", "name": "Agent authority lacks a verifier contract: framework/templates/system/claude/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/system/claude/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e80312f4595993e5", "name": "Agent authority lacks a verifier contract: framework/templates/workspace/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/workspace/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e7ba72edb1f5a3e", "name": "Agent authority lacks a verifier contract: framework/templates/workspace/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/workspace/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-205cf6163b18f879", "name": "Agent authority lacks a verifier contract: framework/templates/workspace/.github/copilot-instructions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/templates/workspace/.github/copilot-instructions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3231d1e6186af30f", "name": "Agent authority lacks a verifier contract: framework/skills/test-driven-development/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/test-driven-development/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fabf205c5a057df2", "name": "Agent authority lacks a verifier contract: framework/skills/k8s-security-policies/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/k8s-security-policies/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93089dc185f8947f", "name": "Agent authority lacks a verifier contract: framework/skills/postgresql/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/postgresql/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80adfc8e55cfddba", "name": "Agent instruction/config may expose a secret: framework/skills/gitops-workflow/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: framework/skills/gitops-workflow/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f9413682d463f9e8", "name": "Agent authority lacks a verifier contract: framework/skills/istio-traffic-management/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/istio-traffic-management/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00bc9729e25d1caf", "name": "Agent authority lacks a verifier contract: framework/skills/systematic-debugging/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/systematic-debugging/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-491fd5d39961461a", "name": "Agent authority lacks a verifier contract: framework/skills/using-git-worktrees/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/using-git-worktrees/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bcd94390b7d2907", "name": "Agent authority lacks a verifier contract: framework/skills/writing-specs/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: framework/skills/writing-specs/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6787fcb579ffb14a", "name": "Commented-code block (17 lines) in scripts/validate-specs.py:682", "shortDescription": {"text": "Commented-code block (17 lines) in scripts/validate-specs.py:682"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c493e9bbc495583f", "name": "Commented-code block (8 lines) in framework/skills/systematic-debugging/condition-based-waiting-example.ts:140", "shortDescription": {"text": "Commented-code block (8 lines) in framework/skills/systematic-debugging/condition-based-waiting-example.ts:140"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/lint-rules.py:find_repo_root, scripts/validate-anchors.py:find_repo_root\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24409"}, "properties": {"repository": "avolsh/ai-dotfiles", "repoUrl": "https://github.com/avolsh/ai-dotfiles", "branch": "main"}, "results": [{"ruleId": "scanner-c72232e56d3bb6d1", "level": "note", "message": {"text": "Possibly dead Python function: check_naming_pattern"}, "properties": {"repobilityId": "d3aa91c469ff912e", "scanner": "scanner-primary", "fingerprint": "c72232e56d3bb6d1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:247"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a118047f7c88c5c", "level": "note", "message": {"text": "Possibly dead Python function: check_front_matter_schema"}, "properties": {"repobilityId": "439c997472e509e6", "scanner": "scanner-primary", "fingerprint": "4a118047f7c88c5c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:263"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e4f2761eebdfb2e", "level": "note", "message": {"text": "Possibly dead Python function: check_dependency_graph"}, "properties": {"repobilityId": "0b87276e2ca88793", "scanner": "scanner-primary", "fingerprint": "3e4f2761eebdfb2e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:389"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88d7a14f56f79f93", "level": "note", "message": {"text": "Possibly dead Python function: check_filename_id_parity"}, "properties": {"repobilityId": "5352d2d955d837eb", "scanner": "scanner-primary", "fingerprint": "88d7a14f56f79f93", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:484"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cde3667dada1803f", "level": "note", "message": {"text": "Possibly dead Python function: check_status_invariants"}, "properties": {"repobilityId": "f877c30dcc67ccaf", "scanner": "scanner-primary", "fingerprint": "cde3667dada1803f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:531"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8c293b3e6fa09bf", "level": "note", "message": {"text": "Possibly dead Python function: check_freshness"}, "properties": {"repobilityId": "a78f538022657076", "scanner": "scanner-primary", "fingerprint": "a8c293b3e6fa09bf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:585"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b6cfbf222b9bf4ed", "level": "note", "message": {"text": "Possibly dead Python function: check_link_integrity"}, "properties": {"repobilityId": "6106aad66b100c62", "scanner": "scanner-primary", "fingerprint": "b6cfbf222b9bf4ed", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:648"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9272ea88ab562cfb", "level": "note", "message": {"text": "Possibly dead Python function: check_english_only"}, "properties": {"repobilityId": "77644c292c3b6a79", "scanner": "scanner-primary", "fingerprint": "9272ea88ab562cfb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:716"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-911dd4fd0729abae", "level": "note", "message": {"text": "Possibly dead Python function: check_trivial_lane_eligibility"}, "properties": {"repobilityId": "2a445980fc312533", "scanner": "scanner-primary", "fingerprint": "911dd4fd0729abae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:760"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8c3c0595422195b", "level": "note", "message": {"text": "Possibly dead Python function: check_res_eligibility"}, "properties": {"repobilityId": "1e6c80bb32fb4774", "scanner": "scanner-primary", "fingerprint": "a8c3c0595422195b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/validate-specs.py:878"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5b09dab12a4e2c0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2358fda99a16c0a0", "scanner": "scanner-primary", "fingerprint": "e5b09dab12a4e2c0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validate.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-e5b09dab12a4e2c0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b6313a095f585d32", "scanner": "scanner-primary", "fingerprint": "e5b09dab12a4e2c0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/validate.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4299ed01d32d97fd", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4866bd626b182383", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "c4aecd0c6f0b3cc8", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "c1333fe515e630d5", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-8785031af6136961", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/project/CLAUDE.md"}, "properties": {"repobilityId": "1c92debbac0b4483", "scanner": "scanner-primary", "fingerprint": "8785031af6136961", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/project/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28b0f0d7ba8f0027", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/project/AGENTS.md"}, "properties": {"repobilityId": "f1588bade286fcce", "scanner": "scanner-primary", "fingerprint": "28b0f0d7ba8f0027", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/project/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-52bf850a76624821", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/project/.github/copilot-instructions.md"}, "properties": {"repobilityId": "e5184a1a544cf87a", "scanner": "scanner-primary", "fingerprint": "52bf850a76624821", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/project/.github/copilot-instructions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-878518a87b46846a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/system/copilot/copilot-instructions.md"}, "properties": {"repobilityId": "9092c64844165fd4", "scanner": "scanner-primary", "fingerprint": "878518a87b46846a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/system/copilot/copilot-instructions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a8ae6d084a315db", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/system/codex/AGENTS.md"}, "properties": {"repobilityId": "e2c1aed593b63a96", "scanner": "scanner-primary", "fingerprint": "8a8ae6d084a315db", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/system/codex/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47e94632482b452a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/system/claude/CLAUDE.md"}, "properties": {"repobilityId": "20f1836573a2c83e", "scanner": "scanner-primary", "fingerprint": "47e94632482b452a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/system/claude/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e80312f4595993e5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/workspace/CLAUDE.md"}, "properties": {"repobilityId": "053c41dee63733c3", "scanner": "scanner-primary", "fingerprint": "e80312f4595993e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/workspace/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e7ba72edb1f5a3e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/workspace/AGENTS.md"}, "properties": {"repobilityId": "97ed74fb752cb301", "scanner": "scanner-primary", "fingerprint": "0e7ba72edb1f5a3e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/workspace/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-205cf6163b18f879", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/templates/workspace/.github/copilot-instructions.md"}, "properties": {"repobilityId": "dac025285a8531d7", "scanner": "scanner-primary", "fingerprint": "205cf6163b18f879", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/templates/workspace/.github/copilot-instructions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3231d1e6186af30f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/test-driven-development/SKILL.md"}, "properties": {"repobilityId": "5959cb17a31b8640", "scanner": "scanner-primary", "fingerprint": "3231d1e6186af30f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/test-driven-development/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fabf205c5a057df2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/k8s-security-policies/SKILL.md"}, "properties": {"repobilityId": "043a236ca39ad6ac", "scanner": "scanner-primary", "fingerprint": "fabf205c5a057df2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/k8s-security-policies/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93089dc185f8947f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/postgresql/SKILL.md"}, "properties": {"repobilityId": "b828d8171ea257d3", "scanner": "scanner-primary", "fingerprint": "93089dc185f8947f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/postgresql/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80adfc8e55cfddba", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: framework/skills/gitops-workflow/SKILL.md"}, "properties": {"repobilityId": "11507068d58be9f7", "scanner": "scanner-primary", "fingerprint": "80adfc8e55cfddba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/gitops-workflow/SKILL.md"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-f9413682d463f9e8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/istio-traffic-management/SKILL.md"}, "properties": {"repobilityId": "c3ffac80765de297", "scanner": "scanner-primary", "fingerprint": "f9413682d463f9e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/istio-traffic-management/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00bc9729e25d1caf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/systematic-debugging/SKILL.md"}, "properties": {"repobilityId": "8b24587530726841", "scanner": "scanner-primary", "fingerprint": "00bc9729e25d1caf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/systematic-debugging/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-491fd5d39961461a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/using-git-worktrees/SKILL.md"}, "properties": {"repobilityId": "0d1d31e41ae66397", "scanner": "scanner-primary", "fingerprint": "491fd5d39961461a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/using-git-worktrees/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5bcd94390b7d2907", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: framework/skills/writing-specs/SKILL.md"}, "properties": {"repobilityId": "ec513747ffe4e5b9", "scanner": "scanner-primary", "fingerprint": "5bcd94390b7d2907", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "framework/skills/writing-specs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6787fcb579ffb14a", "level": "none", "message": {"text": "Commented-code block (17 lines) in scripts/validate-specs.py:682"}, "properties": {"repobilityId": "bcdb74a0dedd89bc", "scanner": "scanner-primary", "fingerprint": "6787fcb579ffb14a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c493e9bbc495583f", "level": "none", "message": {"text": "Commented-code block (8 lines) in framework/skills/systematic-debugging/condition-based-waiting-example.ts:140"}, "properties": {"repobilityId": "cd1b753f5c90d621", "scanner": "scanner-primary", "fingerprint": "c493e9bbc495583f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cdbc00dde9d776ff", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}