{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-574230dc47bf2232", "name": "Possibly dead Python function: make_per_graph", "shortDescription": {"text": "Possibly dead Python function: make_per_graph"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fff598c1e0a18325", "name": "Possibly dead Python function: plan_node", "shortDescription": {"text": "Possibly dead Python function: plan_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5416dc3286a7f3d", "name": "Possibly dead Python function: act_node", "shortDescription": {"text": "Possibly dead Python function: act_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-547d35213aef9e15", "name": "Possibly dead Python function: reflect_node", "shortDescription": {"text": "Possibly dead Python function: reflect_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf2cf44654d5ddcc", "name": "Possibly dead Python function: emit_node", "shortDescription": {"text": "Possibly dead Python function: emit_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb0bf4a765781f2e", "name": "Possibly dead Python function: run_git_check", "shortDescription": {"text": "Possibly dead Python function: run_git_check"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df6a61eaa023167e", "name": "Possibly dead Python function: fetch_top_interesting", "shortDescription": {"text": "Possibly dead Python function: fetch_top_interesting"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63fe10e4914bf67c", "name": "Possibly dead Python function: interesting_summary", "shortDescription": {"text": "Possibly dead Python function: interesting_summary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19081e421d57d5a5", "name": "Possibly dead Python function: health_summary", "shortDescription": {"text": "Possibly dead Python function: health_summary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdc9c9cd85178f86", "name": "Possibly dead Python function: require_api_key", "shortDescription": {"text": "Possibly dead Python function: require_api_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49deac84374109e7", "name": "Possibly dead Python function: rate_limit_default", "shortDescription": {"text": "Possibly dead Python function: rate_limit_default"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-296dda30c64c5e0e", "name": "Possibly dead Python function: configure_rate_limit_storage", "shortDescription": {"text": "Possibly dead Python function: configure_rate_limit_storage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d38510ba98f2042a", "name": "Possibly dead Python function: verify_request", "shortDescription": {"text": "Possibly dead Python function: verify_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55f43760d185a1cf", "name": "Possibly dead Python function: cmd_normalize", "shortDescription": {"text": "Possibly dead Python function: cmd_normalize"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-952a47fec3d80022", "name": "Possibly dead Python function: cmd_classify", "shortDescription": {"text": "Possibly dead Python function: cmd_classify"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52c60f2f4ba1f7f9", "name": "Possibly dead Python function: cmd_pipe", "shortDescription": {"text": "Possibly dead Python function: cmd_pipe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d261df29c3b02df0", "name": "Possibly dead Python function: is_secret_ref", "shortDescription": {"text": "Possibly dead Python function: is_secret_ref"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d0aea34d9005a85", "name": "Possibly dead Python function: count_for_artifact", "shortDescription": {"text": "Possibly dead Python function: count_for_artifact"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2631e5100e9aaa3", "name": "Possibly dead Python function: latest", "shortDescription": {"text": "Possibly dead Python function: latest"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e435d679bac6fc6", "name": "Possibly dead Python function: latest", "shortDescription": {"text": "Possibly dead Python function: latest"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3393879a1c1b08c", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf4546c8f786277f", "name": "Possible secret in scripts/start_full_system.sh", "shortDescription": {"text": "Possible secret in scripts/start_full_system.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a78b13487ba11616", "name": "Insecure pattern 'direct_innerhtml_assignment' in app/web/static/index.html:269", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/web/static/index.html:269"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e1bd9c3397e1949", "name": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/design_handoff/2026-06-09-system-entry-point/prototype.ht", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/design_handoff/2026-06-09-system-entry-point/prototype.html:587"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab6c353ea70d5385", "name": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/design_handoff/2026-05-11-canvas-suggestion-flow/Canvas S", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/design_handoff/2026-05-11-canvas-suggestion-flow/Canvas Suggestion Flow.html:1750"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0602cf3c78c7e2de", "name": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/companion-app/canvas_suggestion_flow.html:579", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/companion-app/canvas_suggestion_flow.html:579"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f94098e13714646e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d554c7f8c63c8dd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3044951d79a27643", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3c192c18b7973e1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab2e91ca1bbf22f6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b97f54bd2aa0f57b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dorny/paths-filter@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bd65249d38988d3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a861c9ee73ee05f8", "name": "Very large file: tests/companion_ui/test_entry_state_gallery.py (1387 lines)", "shortDescription": {"text": "Very large file: tests/companion_ui/test_entry_state_gallery.py (1387 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84012e5b71d66df5", "name": "Very large file: scripts/start_full_system.sh (2439 lines)", "shortDescription": {"text": "Very large file: scripts/start_full_system.sh (2439 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5875a2e1d91a94e8", "name": "Very large file: app/api/routes/companion.py (3815 lines)", "shortDescription": {"text": "Very large file: app/api/routes/companion.py (3815 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b86e2d976532d10", "name": "Very large file: app/cli/__init__.py (1757 lines)", "shortDescription": {"text": "Very large file: app/cli/__init__.py (1757 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0fa19b614efcb7c", "name": "Very large file: companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py (10760 lines)", "shortDescription": {"text": "Very large file: companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py (10760 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cf886fb86ce5291", "name": "Very large file: companion-ui/companion-app/companion_ui/workspace/real_note_workspace_dev_page.py (1282 lines)", "shortDescription": {"text": "Very large file: companion-ui/companion-app/companion_ui/workspace/real_note_workspace_dev_page.py (1282 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 263 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 187 placeholder/mock markers across 64 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1e4029e99dc4880", "name": "Agent authority lacks a verifier contract: .codex/skills/docs-authoring/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/docs-authoring/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e73fc738a220064c", "name": "Agent authority lacks a verifier contract: .codex/skills/automation-maintenance/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/automation-maintenance/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e84f9f2a22940058", "name": "Agent authority lacks a verifier contract: .codex/skills/backlog-reconciliation-drift-audit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/backlog-reconciliation-drift-audit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01d3b33e869959b1", "name": "Legacy-named symbol `test_pipeline_flag_off_matches_legacy` in tests/diarization/test_chunk_policy.py:26", "shortDescription": {"text": "Legacy-named symbol `test_pipeline_flag_off_matches_legacy` in tests/diarization/test_chunk_policy.py:26"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b542739915035174", "name": "Legacy-named symbol `test_orchestrator_version_env_variable_v2` in tests/orchestration/v2/test_orchestrator_flag.py:12", "shortDescription": {"text": "Legacy-named symbol `test_orchestrator_version_env_variable_v2` in tests/orchestration/v2/test_orchestrator_flag.py:12"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5de246bb8ac33018", "name": "Legacy-named symbol `model_copy` in tests/knowledge_compilation/test_runtime_artifacts.py:255", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/knowledge_compilation/test_runtime_artifacts.py:255"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6523100959f54d0", "name": "Legacy-named symbol `test_code_inventory_distinguishes_planned_from_deprecated` in tests/architecture/test_code_inventor", "shortDescription": {"text": "Legacy-named symbol `test_code_inventory_distinguishes_planned_from_deprecated` in tests/architecture/test_code_inventory.py:62"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9460e294ff643a22", "name": "Commented-code block (5 lines) in tests/uat/test_negative_safety_integrated_runtime.py:373", "shortDescription": {"text": "Commented-code block (5 lines) in tests/uat/test_negative_safety_integrated_runtime.py:373"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-37a6005c2663f304", "name": "Legacy-named symbol `model_copy` in tests/api/test_resurfacing_consumes_bundle.py:55", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/api/test_resurfacing_consumes_bundle.py:55"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-820e3905eebde19f", "name": "Commented-code block (9 lines) in tests/api/test_companion_vault_routing.py:161", "shortDescription": {"text": "Commented-code block (9 lines) in tests/api/test_companion_vault_routing.py:161"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55b50bd775e52c09", "name": "Legacy-named symbol `model_copy` in tests/api/test_orientation_consumes_bundle.py:55", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/api/test_orientation_consumes_bundle.py:55"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19a0c95c19e86b0b", "name": "Legacy-named symbol `integrated_runtime_v1` in tests/api/test_status_release_readiness.py:84", "shortDescription": {"text": "Legacy-named symbol `integrated_runtime_v1` in tests/api/test_status_release_readiness.py:84"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-630c8c7a14af69b9", "name": "Commented-code block (5 lines) in tests/companion_ui/test_receipts_history_surface.py:349", "shortDescription": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_receipts_history_surface.py:349"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7531a37dbee061f2", "name": "Legacy-named symbol `test_internal_labels_do_not_leak_to_default_copy` in tests/companion_ui/test_right_rail_compaction.", "shortDescription": {"text": "Legacy-named symbol `test_internal_labels_do_not_leak_to_default_copy` in tests/companion_ui/test_right_rail_compaction.py:185"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18d1307f0c3a9789", "name": "Commented-code block (5 lines) in tests/companion_ui/test_entry_state_gallery.py:1270", "shortDescription": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_entry_state_gallery.py:1270"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85de536182649547", "name": "Legacy-named symbol `test_rail_empty_state_carries_human_copy` in tests/companion_ui/test_workspace_shell_alignment.py:4", "shortDescription": {"text": "Legacy-named symbol `test_rail_empty_state_carries_human_copy` in tests/companion_ui/test_workspace_shell_alignment.py:492"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-037121d7e40188e4", "name": "Commented-code block (5 lines) in tests/companion_ui/test_workspace_read_only_pill.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_workspace_read_only_pill.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-690d8de65da74dec", "name": "Commented-code block (5 lines) in tests/companion_ui/test_overlay_host.py:336", "shortDescription": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_overlay_host.py:336"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3eb41c773b588970", "name": "Legacy-named symbol `model_copy` in tests/agent_memory/test_recall_surfacing.py:112", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/agent_memory/test_recall_surfacing.py:112"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef5872657c37fc9f", "name": "Legacy-named symbol `model_copy` in tests/agent_memory/test_review_queue.py:66", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/agent_memory/test_review_queue.py:66"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1853c37baaaff4d5", "name": "Legacy-named symbol `companion_agent_v1` in tests/agent_memory/test_metadata_compatibility.py:266", "shortDescription": {"text": "Legacy-named symbol `companion_agent_v1` in tests/agent_memory/test_metadata_compatibility.py:266"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb881f079889a81a", "name": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_embedding_migration.py:32", "shortDescription": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_embedding_migration.py:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0362280fa65bf275", "name": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_integration.py:18", "shortDescription": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_integration.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52997572a5a09c92", "name": "Legacy-named symbol `test_known_providers_has_legacy` in tests/components/embeddings/test_validation.py:235", "shortDescription": {"text": "Legacy-named symbol `test_known_providers_has_legacy` in tests/components/embeddings/test_validation.py:235"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a11ef6a38cdaa44", "name": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_migration.py:8", "shortDescription": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_migration.py:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edc4d6ec2d0f8eea", "name": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/run_tests.py:14", "shortDescription": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/run_tests.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcaf31c0625ad338", "name": "Legacy-named symbol `_enable_v2` in tests/orchestrator/test_multi_step_chain_traceability.py:209", "shortDescription": {"text": "Legacy-named symbol `_enable_v2` in tests/orchestrator/test_multi_step_chain_traceability.py:209"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83cd8d3b83d64908", "name": "Legacy-named symbol `test_messages_preserved_in_copy` in tests/agents/pilot_agent/test_state.py:248", "shortDescription": {"text": "Legacy-named symbol `test_messages_preserved_in_copy` in tests/agents/pilot_agent/test_state.py:248"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2b298bf429416b0", "name": "Commented-code block (7 lines) in tests/agents/panel_agent/test_panel_graph.py:489", "shortDescription": {"text": "Commented-code block (7 lines) in tests/agents/panel_agent/test_panel_graph.py:489"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ffd70e9c25eac84", "name": "Commented-code block (6 lines) in tests/agents/panel_agent/test_panel_runtime.py:526", "shortDescription": {"text": "Commented-code block (6 lines) in tests/agents/panel_agent/test_panel_runtime.py:526"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5e95a1a20c50a035", "name": "Commented-code block (6 lines) in tests/e2e/test_reality_mvp_pipeline.py:38", "shortDescription": {"text": "Commented-code block (6 lines) in tests/e2e/test_reality_mvp_pipeline.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d4c5e591c117820", "name": "Legacy-named symbol `model_copy` in tests/quality_wave/test_event_chain.py:226", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/quality_wave/test_event_chain.py:226"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c02e342e7eed753", "name": "Legacy-named symbol `model_copy` in tests/quality_wave/test_fitness_gates.py:125", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/quality_wave/test_fitness_gates.py:125"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5b2989cdcb5f004", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/tag_release.py:25", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/tag_release.py:25"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-922a7fd3498f1d15", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_ask_smoke.py:41", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_ask_smoke.py:41"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15fa281142388594", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/runtime_proof_smoke.py:68", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/runtime_proof_smoke.py:68"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c15db092d5e98c0", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/git_hygiene.py:28", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/git_hygiene.py:28"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55e45f32acabb175", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/query_ws.py:5", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/query_ws.py:5"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd0b63a355c8ff7f", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/project_status.py:55", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/project_status.py:55"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f875ed2ccfa4ebd", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_reality_smoke.py:40", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_reality_smoke.py:40"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0309869c2cefe97f", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/alpha_e2e.py:234", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/alpha_e2e.py:234"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c3b0bcaa2a14163", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/docs_guard.py:7", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/docs_guard.py:7"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-838b9571aa0a8013", "name": "Legacy-named symbol `pattern_copy` in app/settings/flow_profiles.py:82", "shortDescription": {"text": "Legacy-named symbol `pattern_copy` in app/settings/flow_profiles.py:82"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb7479879848a652", "name": "Commented-code block (7 lines) in app/vault/settings_service.py:350", "shortDescription": {"text": "Commented-code block (7 lines) in app/vault/settings_service.py:350"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab239379c8ed66eb", "name": "Commented-code block (9 lines) in app/vault/manager.py:178", "shortDescription": {"text": "Commented-code block (9 lines) in app/vault/manager.py:178"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3173ed8eb29f4f68", "name": "Commented-code block (7 lines) in app/vault/actions.py:265", "shortDescription": {"text": "Commented-code block (7 lines) in app/vault/actions.py:265"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-91a5e6eb67ea3a51", "name": "Legacy-named symbol `model_copy` in app/panel/confirmation.py:628", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/panel/confirmation.py:628"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9474c60662364cc1", "name": "Network/subprocess call without timeout or try/except \u2014 app/sync/git.py:138", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 app/sync/git.py:138"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fc316000a936dbf", "name": "Commented-code block (7 lines) in app/config/__init__.py:1", "shortDescription": {"text": "Commented-code block (7 lines) in app/config/__init__.py:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cf58bb6be6cc699d", "name": "Legacy-named symbol `model_copy` in app/config/agent.py:107", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/config/agent.py:107"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b7a3fd73d19fdf5", "name": "Legacy-named symbol `model_copy` in app/knowledge_compilation/review_admission.py:154", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/knowledge_compilation/review_admission.py:154"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f61475c4e827f45", "name": "Legacy-named symbol `model_copy` in app/knowledge_compilation/runtime_artifacts.py:172", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/knowledge_compilation/runtime_artifacts.py:172"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b56f73e483db15e", "name": "Commented-code block (5 lines) in app/knowledge_compilation/runtime_artifacts.py:176", "shortDescription": {"text": "Commented-code block (5 lines) in app/knowledge_compilation/runtime_artifacts.py:176"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8ba7b7deae08413", "name": "Commented-code block (5 lines) in app/ops/test_channel_bootstrap.py:138", "shortDescription": {"text": "Commented-code block (5 lines) in app/ops/test_channel_bootstrap.py:138"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ca15735739fd447", "name": "Network/subprocess call without timeout or try/except \u2014 app/tts/providers.py:99", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 app/tts/providers.py:99"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52b1431c03a63413", "name": "Commented-code block (6 lines) in app/events/panel.py:28", "shortDescription": {"text": "Commented-code block (6 lines) in app/events/panel.py:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c2b14b836c5e970", "name": "Network/subprocess call without timeout or try/except \u2014 app/media/transcribe.py:70", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 app/media/transcribe.py:70"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abe32292a5ba8f8d", "name": "Stub function `start` (body is just `pass`/`return`) \u2014 app/api/_shim_helpers.py:11", "shortDescription": {"text": "Stub function `start` (body is just `pass`/`return`) \u2014 app/api/_shim_helpers.py:11"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-106b1e7d80b525fa", "name": "Legacy-named symbol `model_copy` in app/api/routes/companion.py:2132", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/api/routes/companion.py:2132"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96a3255f6002e640", "name": "Commented-code block (13 lines) in app/api/routes/companion.py:298", "shortDescription": {"text": "Commented-code block (13 lines) in app/api/routes/companion.py:298"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66ed53f4b0b45601", "name": "Legacy-named symbol `model_copy` in app/api/routes/context_bundles.py:27", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/api/routes/context_bundles.py:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66bbf22a2f75e438", "name": "Commented-code block (6 lines) in app/api/routes/canvas.py:512", "shortDescription": {"text": "Commented-code block (6 lines) in app/api/routes/canvas.py:512"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b509639c9d17fc34", "name": "Commented-code block (5 lines) in app/release_channels/channel_isolation_preflight.py:506", "shortDescription": {"text": "Commented-code block (5 lines) in app/release_channels/channel_isolation_preflight.py:506"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4c4019762cb6604a", "name": "Legacy-named symbol `store_stats_legacy` in app/cli/__init__.py:402", "shortDescription": {"text": "Legacy-named symbol `store_stats_legacy` in app/cli/__init__.py:402"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5efb35b234165bc3", "name": "Legacy-named symbol `strip_v1` in app/cli/llm_doctor.py:36", "shortDescription": {"text": "Legacy-named symbol `strip_v1` in app/cli/llm_doctor.py:36"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-511926625ccd82b3", "name": "Stub function `llm` (body is just `pass`/`return`) \u2014 app/cli/llm_doctor.py:102", "shortDescription": {"text": "Stub function `llm` (body is just `pass`/`return`) \u2014 app/cli/llm_doctor.py:102"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d28323589b22b9b", "name": "Legacy-named symbol `payload_copy` in app/cli/alpha_human_flows.py:86", "shortDescription": {"text": "Legacy-named symbol `payload_copy` in app/cli/alpha_human_flows.py:86"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42d8741e1f43d83a", "name": "Commented-code block (5 lines) in app/ingest/vault_alpha.py:792", "shortDescription": {"text": "Commented-code block (5 lines) in app/ingest/vault_alpha.py:792"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eff89e58ed713469", "name": "Legacy-named symbol `payload_copy` in app/ingest/vault_root.py:45", "shortDescription": {"text": "Legacy-named symbol `payload_copy` in app/ingest/vault_root.py:45"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6416b6abac0ba500", "name": "Legacy-named symbol `model_copy` in app/agent_memory/review_queue.py:251", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agent_memory/review_queue.py:251"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36384088a56009f7", "name": "Legacy-named symbol `model_copy` in app/agent_memory/recall_activation.py:86", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agent_memory/recall_activation.py:86"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-383db78331e28f55", "name": "Legacy-named symbol `model_copy` in app/agent_memory/companion_aware.py:199", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agent_memory/companion_aware.py:199"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1add7ce6f6c03b95", "name": "Legacy-named symbol `auto_tag_legacy` in app/components/embeddings/__init__.py:34", "shortDescription": {"text": "Legacy-named symbol `auto_tag_legacy` in app/components/embeddings/__init__.py:34"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb22e40e4b29016b", "name": "Legacy-named symbol `auto_tag_legacy` in app/components/embeddings/migration.py:40", "shortDescription": {"text": "Legacy-named symbol `auto_tag_legacy` in app/components/embeddings/migration.py:40"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fec6407b14af02d", "name": "Legacy-named symbol `integrated_runtime_v1` in app/observability/status_model.py:210", "shortDescription": {"text": "Legacy-named symbol `integrated_runtime_v1` in app/observability/status_model.py:210"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c7ba8480cfbe260", "name": "Legacy-named symbol `integrated_runtime_v1` in app/observability/status_service.py:1184", "shortDescription": {"text": "Legacy-named symbol `integrated_runtime_v1` in app/observability/status_service.py:1184"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-026acf41034b7c0f", "name": "Legacy-named symbol `model_copy` in app/agents/panel/agent.py:320", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/panel/agent.py:320"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbf8586740fe8729", "name": "Legacy-named symbol `model_copy` in app/agents/panel/intents.py:54", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/panel/intents.py:54"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c149e4d50307048", "name": "Legacy-named symbol `model_copy` in app/agents/panel_agent/graph.py:243", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/panel_agent/graph.py:243"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b69359495cdd0288", "name": "Commented-code block (6 lines) in app/agents/panel_agent/graph.py:34", "shortDescription": {"text": "Commented-code block (6 lines) in app/agents/panel_agent/graph.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b6a99110ad38884", "name": "Legacy-named symbol `model_copy` in app/agents/panel_agent/cognition.py:595", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/panel_agent/cognition.py:595"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6ac198ceac19815", "name": "Legacy-named symbol `model_copy` in app/agents/panel_agent/runtime.py:143", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/panel_agent/runtime.py:143"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c83f6a7c10937971", "name": "Commented-code block (5 lines) in app/agents/panel_agent/runtime.py:540", "shortDescription": {"text": "Commented-code block (5 lines) in app/agents/panel_agent/runtime.py:540"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87e9569cfc703b2b", "name": "Commented-code block (6 lines) in app/agents/ask/graph.py:207", "shortDescription": {"text": "Commented-code block (6 lines) in app/agents/ask/graph.py:207"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-196ab9a2fa57208c", "name": "Legacy-named symbol `model_copy` in app/agents/ask/utils.py:25", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/agents/ask/utils.py:25"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81dcc5e40818a29f", "name": "Stub function `fetchone` (body is just `pass`/`return`) \u2014 app/services/outbox.py:59", "shortDescription": {"text": "Stub function `fetchone` (body is just `pass`/`return`) \u2014 app/services/outbox.py:59"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9829737171583770", "name": "Commented-code block (6 lines) in app/relevance/interruptibility.py:30", "shortDescription": {"text": "Commented-code block (6 lines) in app/relevance/interruptibility.py:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83f13054a7cdc0da", "name": "Stub function `ensure_schema` (body is just `pass`/`return`) \u2014 app/db/sqlalchemy.py:17", "shortDescription": {"text": "Stub function `ensure_schema` (body is just `pass`/`return`) \u2014 app/db/sqlalchemy.py:17"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4411da0a854858bc", "name": "Commented-code block (6 lines) in app/watcher/config.py:55", "shortDescription": {"text": "Commented-code block (6 lines) in app/watcher/config.py:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-970a182c9d276397", "name": "Legacy-named symbol `model_copy` in app/context_bundles/runtime_registry.py:30", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/context_bundles/runtime_registry.py:30"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3758edf3df12fbe4", "name": "Stub function `upgrade` (body is just `pass`/`return`) \u2014 app/alembic/versions/6841f6d42913_merge_heads.py:21", "shortDescription": {"text": "Stub function `upgrade` (body is just `pass`/`return`) \u2014 app/alembic/versions/6841f6d42913_merge_heads.py:21"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4807cf2ceb1c638a", "name": "Legacy-named symbol `model_copy` in app/receipts/bundle_receipt_projection.py:62", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/receipts/bundle_receipt_projection.py:62"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d05ec8939e9c842", "name": "Legacy-named symbol `model_copy` in app/receipts/bundle_receipts.py:68", "shortDescription": {"text": "Legacy-named symbol `model_copy` in app/receipts/bundle_receipts.py:68"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-401055eb090946e6", "name": "Legacy-named symbol `strip_v1` in app/llm/embeddings.py:42", "shortDescription": {"text": "Legacy-named symbol `strip_v1` in app/llm/embeddings.py:42"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-057b87289a4b0d04", "name": "Legacy-named symbol `strip_v1` in app/llm/endpoints.py:17", "shortDescription": {"text": "Legacy-named symbol `strip_v1` in app/llm/endpoints.py:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33cb26809d196b5f", "name": "Commented-code block (6 lines) in companion-ui/design_handoff/2026-05-03-converse/design-canvas.jsx:2", "shortDescription": {"text": "Commented-code block (6 lines) in companion-ui/design_handoff/2026-05-03-converse/design-canvas.jsx:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-996a7daf59bbe0b2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 companion-ui/design_handoff/2026-05-03-converse/design-canvas.jsx:63", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 companion-ui/design_handoff/2026-05-03-converse/design-canvas.jsx:63"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e064c91b4175fd6", "name": "Commented-code block (6 lines) in companion-ui/design_handoff/2026-05-08-cognitive-temporal/design-canvas.jsx:2", "shortDescription": {"text": "Commented-code block (6 lines) in companion-ui/design_handoff/2026-05-08-cognitive-temporal/design-canvas.jsx:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e9239d46e3e963e5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 companion-ui/design_handoff/2026-05-08-cognitive-temporal/design-canvas.js", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 companion-ui/design_handoff/2026-05-08-cognitive-temporal/design-canvas.jsx:63"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91018b159057d03b", "name": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/canvas_suggestion_flow/__init__.py:1", "shortDescription": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/canvas_suggestion_flow/__init__.py:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc6f6e143fa4f4ce", "name": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/panel/proposal_row.py:75", "shortDescription": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/panel/proposal_row.py:75"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9fe1213442c1aa5c", "name": "Legacy-named symbol `rail_posture_copy` in companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py:1826", "shortDescription": {"text": "Legacy-named symbol `rail_posture_copy` in companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py:1826"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6aee4771cf4b2ef", "name": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py:765", "shortDescription": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py:765"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-832c90bf076510ed", "name": "Legacy-named symbol `_status_copy` in companion-ui/companion-app/companion_ui/workspace/vault_settings_panel.py:35", "shortDescription": {"text": "Legacy-named symbol `_status_copy` in companion-ui/companion-app/companion_ui/workspace/vault_settings_panel.py:35"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70138f6d4667385e", "name": "Commented-code block (6 lines) in companion-ui/companion-app/companion_ui/workspace/real_note_workspace_dev_page.py:253", "shortDescription": {"text": "Commented-code block (6 lines) in companion-ui/companion-app/companion_ui/workspace/real_note_workspace_dev_page.py:253"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-70f359bf42a03218", "name": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/workspace/receipts_history.py:161", "shortDescription": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/workspace/receipts_history.py:161"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-430356bdc86c2c10", "name": "Commented-code block (9 lines) in companion-ui/companion-app/companion_ui/workspace/overlay_host.py:51", "shortDescription": {"text": "Commented-code block (9 lines) in companion-ui/companion-app/companion_ui/workspace/overlay_host.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1a1921428979d7d5", "name": "164 env vars used in code but missing from .env.example", "shortDescription": {"text": "164 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENT_CONFIGS_ROOT`, `AGENT_MEMORY_REVIEW_DECISION_DB`, `AGENT_REGISTRY_PATH`, `API_BASE_URL`, `APP_ENV`, `ASK_DOMAIN_SCOPE`, `ASK_SYNTHESIS_RECEIPTS_PATH`, `ASR_DEVICE` + 156 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/git_hygiene.py:build_janitor_plan, scripts/git_hygiene.py:janitor_apply\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/reconcile_project_status.py:reconcile_issue, scripts/reconcile_project_status.py:reconcile_pr, scripts/reconcile_project_status.py:reconcile_scan\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp/diarization/hook.py:segment, app/diarization/hook.py:segment, app/diarization/hook.py:segment, app/diarization/hook.py:segment\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92bd0e9692d70562", "name": "FastAPI POST `source_understanding_p0` without auth dependency \u2014 app/api/routes/source_understanding.py:14", "shortDescription": {"text": "FastAPI POST `source_understanding_p0` without auth dependency \u2014 app/api/routes/source_understanding.py:14"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50c53e65f82b1fd7", "name": "FastAPI POST `ask` without auth dependency \u2014 app/api/routes/ask.py:122", "shortDescription": {"text": "FastAPI POST `ask` without auth dependency \u2014 app/api/routes/ask.py:122"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba304914da0ba4e8", "name": "FastAPI POST `panel_confirm` without auth dependency \u2014 app/api/routes/panel.py:33", "shortDescription": {"text": "FastAPI POST `panel_confirm` without auth dependency \u2014 app/api/routes/panel.py:33"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18d63f2c056297e7", "name": "FastAPI POST `panel_checkbox_projection` without auth dependency \u2014 app/api/routes/panel.py:48", "shortDescription": {"text": "FastAPI POST `panel_checkbox_projection` without auth dependency \u2014 app/api/routes/panel.py:48"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f229afafb9f5686", "name": "FastAPI POST `select_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:556", "shortDescription": {"text": "FastAPI POST `select_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:556"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7750fdf5f68b6d11", "name": "FastAPI POST `initialize_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:580", "shortDescription": {"text": "FastAPI POST `initialize_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:580"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-835819c47a436166", "name": "FastAPI POST `reload_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:595", "shortDescription": {"text": "FastAPI POST `reload_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:595"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38786ae7246bdedf", "name": "FastAPI POST `update_companion_vault_setting` without auth dependency \u2014 app/api/routes/companion.py:615", "shortDescription": {"text": "FastAPI POST `update_companion_vault_setting` without auth dependency \u2014 app/api/routes/companion.py:615"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b9f013c5b7558869", "name": "FastAPI POST `queue_vault_browser_review` without auth dependency \u2014 app/api/routes/companion.py:2806", "shortDescription": {"text": "FastAPI POST `queue_vault_browser_review` without auth dependency \u2014 app/api/routes/companion.py:2806"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-509a4a546ecb47bf", "name": "FastAPI POST `plan_companion_tts` without auth dependency \u2014 app/api/routes/companion.py:2969", "shortDescription": {"text": "FastAPI POST `plan_companion_tts` without auth dependency \u2014 app/api/routes/companion.py:2969"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bcbe7af8bbd970c2", "name": "FastAPI POST `synthesize_companion_tts` without auth dependency \u2014 app/api/routes/companion.py:2997", "shortDescription": {"text": "FastAPI POST `synthesize_companion_tts` without auth dependency \u2014 app/api/routes/companion.py:2997"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-881d3658e88e99e5", "name": "FastAPI POST `update_companion_workspace_note_body` without auth dependency \u2014 app/api/routes/companion.py:3141", "shortDescription": {"text": "FastAPI POST `update_companion_workspace_note_body` without auth dependency \u2014 app/api/routes/companion.py:3141"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b4f85b46cd0118d2", "name": "FastAPI POST `update_workspace_body` without auth dependency \u2014 app/api/routes/companion.py:3252", "shortDescription": {"text": "FastAPI POST `update_workspace_body` without auth dependency \u2014 app/api/routes/companion.py:3252"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2790e98fa50c33e", "name": "FastAPI POST `save_note_body` without auth dependency \u2014 app/api/routes/companion.py:3317", "shortDescription": {"text": "FastAPI POST `save_note_body` without auth dependency \u2014 app/api/routes/companion.py:3317"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35f79db406cd628d", "name": "FastAPI POST `post_memory_review_decision` without auth dependency \u2014 app/api/routes/companion.py:3654", "shortDescription": {"text": "FastAPI POST `post_memory_review_decision` without auth dependency \u2014 app/api/routes/companion.py:3654"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5523dfe123cea518", "name": "FastAPI POST `capture_to_inbox` without auth dependency \u2014 app/api/routes/capture.py:185", "shortDescription": {"text": "FastAPI POST `capture_to_inbox` without auth dependency \u2014 app/api/routes/capture.py:185"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d05542e42657446", "name": "FastAPI POST `create_worklog` without auth dependency \u2014 app/api/routes/builderops.py:91", "shortDescription": {"text": "FastAPI POST `create_worklog` without auth dependency \u2014 app/api/routes/builderops.py:91"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-180d6c535013a6e8", "name": "FastAPI POST `create_learning_signal` without auth dependency \u2014 app/api/routes/builderops.py:99", "shortDescription": {"text": "FastAPI POST `create_learning_signal` without auth dependency \u2014 app/api/routes/builderops.py:99"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01c61c07430db478", "name": "FastAPI POST `create_promotion_intent` without auth dependency \u2014 app/api/routes/builderops.py:107", "shortDescription": {"text": "FastAPI POST `create_promotion_intent` without auth dependency \u2014 app/api/routes/builderops.py:107"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1519178bb16883d3", "name": "FastAPI POST `append_receipt` without auth dependency \u2014 app/api/routes/builderops.py:115", "shortDescription": {"text": "FastAPI POST `append_receipt` without auth dependency \u2014 app/api/routes/builderops.py:115"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a6ac2369c558d83", "name": "FastAPI POST `ingest` without auth dependency \u2014 app/api/routes/ingest.py:21", "shortDescription": {"text": "FastAPI POST `ingest` without auth dependency \u2014 app/api/routes/ingest.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38bdcc211afa8952", "name": "FastAPI POST `open_session` without auth dependency \u2014 app/api/routes/canvas.py:273", "shortDescription": {"text": "FastAPI POST `open_session` without auth dependency \u2014 app/api/routes/canvas.py:273"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18348d86ad2f0961", "name": "FastAPI POST `apply_edit` without auth dependency \u2014 app/api/routes/canvas.py:298", "shortDescription": {"text": "FastAPI POST `apply_edit` without auth dependency \u2014 app/api/routes/canvas.py:298"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a0db19bf4e4783a2", "name": "FastAPI POST `coauthor` without auth dependency \u2014 app/api/routes/canvas.py:458", "shortDescription": {"text": "FastAPI POST `coauthor` without auth dependency \u2014 app/api/routes/canvas.py:458"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-71764af2fb080cb3", "name": "FastAPI DELETE `undo_last_edit` without auth dependency \u2014 app/api/routes/canvas.py:573", "shortDescription": {"text": "FastAPI DELETE `undo_last_edit` without auth dependency \u2014 app/api/routes/canvas.py:573"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cad68678a1484d16", "name": "FastAPI POST `governance_action` without auth dependency \u2014 app/api/routes/canvas.py:620", "shortDescription": {"text": "FastAPI POST `governance_action` without auth dependency \u2014 app/api/routes/canvas.py:620"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-037744a1149c19ab", "name": "FastAPI DELETE `close_session` without auth dependency \u2014 app/api/routes/canvas.py:656", "shortDescription": {"text": "FastAPI DELETE `close_session` without auth dependency \u2014 app/api/routes/canvas.py:656"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59f45351017a2161", "name": "Unused endpoint: GET /query", "shortDescription": {"text": "Unused endpoint: GET /query"}, "fullDescription": {"text": "`api/app.py` declares `GET /query` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`app/api/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc803b21c370d227", "name": "Unused endpoint: GET /resurfacing/bundle/{bundle_id}", "shortDescription": {"text": "Unused endpoint: GET /resurfacing/bundle/{bundle_id}"}, "fullDescription": {"text": "`app/api/routes/resurfacing.py` declares `GET /resurfacing/bundle/{bundle_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5aaa0593b4a16270", "name": "Unused endpoint: GET /settings/validate", "shortDescription": {"text": "Unused endpoint: GET /settings/validate"}, "fullDescription": {"text": "`app/api/routes/settings_validate.py` declares `GET /settings/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0f1c8067b4638eb", "name": "Unused endpoint: POST /p0", "shortDescription": {"text": "Unused endpoint: POST /p0"}, "fullDescription": {"text": "`app/api/routes/source_understanding.py` declares `POST /p0` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e1fadad2500f063", "name": "Unused endpoint: POST /ask", "shortDescription": {"text": "Unused endpoint: POST /ask"}, "fullDescription": {"text": "`app/api/routes/ask.py` declares `POST /ask` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e26074453f93d403", "name": "Unused endpoint: POST /confirm", "shortDescription": {"text": "Unused endpoint: POST /confirm"}, "fullDescription": {"text": "`app/api/routes/panel.py` declares `POST /confirm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c22b5267aff4cb8", "name": "Unused endpoint: POST /checkbox-projection", "shortDescription": {"text": "Unused endpoint: POST /checkbox-projection"}, "fullDescription": {"text": "`app/api/routes/panel.py` declares `POST /checkbox-projection` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f1ea12f4f4d7510", "name": "Unused endpoint: GET /panel", "shortDescription": {"text": "Unused endpoint: GET /panel"}, "fullDescription": {"text": "`app/api/routes/debug.py` declares `GET /panel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00c3b9f3a634611f", "name": "Unused endpoint: GET /vault/context", "shortDescription": {"text": "Unused endpoint: GET /vault/context"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /vault/context` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-279a13bcc90f633e", "name": "Unused endpoint: POST /vault/select", "shortDescription": {"text": "Unused endpoint: POST /vault/select"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /vault/select` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fd4a55447cbf3f7", "name": "Unused endpoint: GET /now", "shortDescription": {"text": "Unused endpoint: GET /now"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /now` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e70f1d3cd16bb23", "name": "Unused endpoint: POST /vault/initialize", "shortDescription": {"text": "Unused endpoint: POST /vault/initialize"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /vault/initialize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09528ebc35527a89", "name": "Unused endpoint: POST /vault/reload", "shortDescription": {"text": "Unused endpoint: POST /vault/reload"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /vault/reload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07611596220e09f2", "name": "Unused endpoint: GET /vault/settings", "shortDescription": {"text": "Unused endpoint: GET /vault/settings"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /vault/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25171c4184dda9cc", "name": "Unused endpoint: POST /vault/settings", "shortDescription": {"text": "Unused endpoint: POST /vault/settings"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /vault/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4415534a91e68b3", "name": "Unused endpoint: GET /vault/notes", "shortDescription": {"text": "Unused endpoint: GET /vault/notes"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /vault/notes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8082f16456379e87", "name": "Unused endpoint: GET /vault-browser", "shortDescription": {"text": "Unused endpoint: GET /vault-browser"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /vault-browser` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-665f98f7daa59364", "name": "Unused endpoint: GET /vault-link-index", "shortDescription": {"text": "Unused endpoint: GET /vault-link-index"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /vault-link-index` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ba6e3ba6de695ac", "name": "Unused endpoint: GET /vault-related", "shortDescription": {"text": "Unused endpoint: GET /vault-related"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /vault-related` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e89a0451b653dca", "name": "Unused endpoint: POST /vault-browser/actions/queue-review", "shortDescription": {"text": "Unused endpoint: POST /vault-browser/actions/queue-review"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /vault-browser/actions/queue-review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c6affd4e4fba8b6", "name": "Unused endpoint: GET /orientation", "shortDescription": {"text": "Unused endpoint: GET /orientation"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /orientation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0538d5f571390c7e", "name": "Unused endpoint: POST /tts/plan", "shortDescription": {"text": "Unused endpoint: POST /tts/plan"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /tts/plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-232d1ce5ec5453d2", "name": "Unused endpoint: POST /tts/synthesize", "shortDescription": {"text": "Unused endpoint: POST /tts/synthesize"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /tts/synthesize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f27f82397fbd7a1", "name": "Unused endpoint: GET /tts/status", "shortDescription": {"text": "Unused endpoint: GET /tts/status"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /tts/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-663607a0de8ee3fc", "name": "Unused endpoint: GET /tts/audio/{cache_key}.wav", "shortDescription": {"text": "Unused endpoint: GET /tts/audio/{cache_key}.wav"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /tts/audio/{cache_key}.wav` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9faede0f90ece4bf", "name": "Unused endpoint: GET /workspace", "shortDescription": {"text": "Unused endpoint: GET /workspace"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /workspace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b6c2749390a86c7", "name": "Unused endpoint: POST /workspace/update", "shortDescription": {"text": "Unused endpoint: POST /workspace/update"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /workspace/update` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8da65e25f3c62634", "name": "Unused endpoint: POST /workspace/body", "shortDescription": {"text": "Unused endpoint: POST /workspace/body"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /workspace/body` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eac41963b8323533", "name": "Unused endpoint: POST /note/save", "shortDescription": {"text": "Unused endpoint: POST /note/save"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /note/save` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9db4d222c78f7266", "name": "Unused endpoint: GET /memory/review-queue", "shortDescription": {"text": "Unused endpoint: GET /memory/review-queue"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `GET /memory/review-queue` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88872555d37ad4bb", "name": "Unused endpoint: POST /memory/review-queue/{candidate_id}/decision", "shortDescription": {"text": "Unused endpoint: POST /memory/review-queue/{candidate_id}/decision"}, "fullDescription": {"text": "`app/api/routes/companion.py` declares `POST /memory/review-queue/{candidate_id}/decision` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70b45ca07e062a93", "name": "Unused endpoint: POST /capture", "shortDescription": {"text": "Unused endpoint: POST /capture"}, "fullDescription": {"text": "`app/api/routes/capture.py` declares `POST /capture` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a300923b068adcba", "name": "Unused endpoint: GET /records", "shortDescription": {"text": "Unused endpoint: GET /records"}, "fullDescription": {"text": "`app/api/routes/builderops.py` declares `GET /records` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d546e4c0bfaf0c7", "name": "Unused endpoint: GET /records/{record_id}", "shortDescription": {"text": "Unused endpoint: GET /records/{record_id}"}, "fullDescription": {"text": "`app/api/routes/builderops.py` declares `GET /records/{record_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b3c3f1b1bd941a5", "name": "Unused endpoint: POST /worklogs", "shortDescription": {"text": "Unused endpoint: POST /worklogs"}, "fullDescription": {"text": "`app/api/routes/builderops.py` declares `POST /worklogs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94e24475cf0f3122", "name": "Unused endpoint: POST /learning-signals", "shortDescription": {"text": "Unused endpoint: POST /learning-signals"}, "fullDescription": {"text": "`app/api/routes/builderops.py` declares `POST /learning-signals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7cafb1e50bf66210", "name": "Unused endpoint: POST /promotion-intents", "shortDescription": {"text": "Unused endpoint: POST /promotion-intents"}, "fullDescription": {"text": "`app/api/routes/builderops.py` declares `POST /promotion-intents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c121531c6b576fa", "name": "Unused endpoint: POST /receipts", "shortDescription": {"text": "Unused endpoint: POST /receipts"}, "fullDescription": {"text": "`app/api/routes/builderops.py` declares `POST /receipts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-645141061095ac6a", "name": "Unused endpoint: GET /note", "shortDescription": {"text": "Unused endpoint: GET /note"}, "fullDescription": {"text": "`app/api/routes/artifacts.py` declares `GET /note` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70ac484210c98514", "name": "Unused endpoint: GET /context-bundles/{bundle_id}", "shortDescription": {"text": "Unused endpoint: GET /context-bundles/{bundle_id}"}, "fullDescription": {"text": "`app/api/routes/context_bundles.py` declares `GET /context-bundles/{bundle_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1aece0f30392555d", "name": "Unused endpoint: GET /events/tail", "shortDescription": {"text": "Unused endpoint: GET /events/tail"}, "fullDescription": {"text": "`app/api/routes/events_tail.py` declares `GET /events/tail` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65a667bcc38fb792", "name": "Unused endpoint: POST /ingest", "shortDescription": {"text": "Unused endpoint: POST /ingest"}, "fullDescription": {"text": "`app/api/routes/ingest.py` declares `POST /ingest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d16e4fa529c520e9", "name": "Unused endpoint: GET /search", "shortDescription": {"text": "Unused endpoint: GET /search"}, "fullDescription": {"text": "`app/api/routes/search.py` declares `GET /search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d08923791ca241cd", "name": "Unused endpoint: GET /orientation/bundle/{bundle_id}", "shortDescription": {"text": "Unused endpoint: GET /orientation/bundle/{bundle_id}"}, "fullDescription": {"text": "`app/api/routes/orientation.py` declares `GET /orientation/bundle/{bundle_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92efb2dc9205e7a4", "name": "Unused endpoint: POST /sessions", "shortDescription": {"text": "Unused endpoint: POST /sessions"}, "fullDescription": {"text": "`app/api/routes/canvas.py` declares `POST /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb27932e560a9918", "name": "Unused endpoint: POST /sessions/{session_id}/edits", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/edits"}, "fullDescription": {"text": "`app/api/routes/canvas.py` declares `POST /sessions/{session_id}/edits` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb0cf01d7d3c2a5f", "name": "Unused endpoint: POST /sessions/{session_id}/coauthor", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/coauthor"}, "fullDescription": {"text": "`app/api/routes/canvas.py` declares `POST /sessions/{session_id}/coauthor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7cfb4a057b6e4a46", "name": "Unused endpoint: DELETE /sessions/{session_id}/edits/last", "shortDescription": {"text": "Unused endpoint: DELETE /sessions/{session_id}/edits/last"}, "fullDescription": {"text": "`app/api/routes/canvas.py` declares `DELETE /sessions/{session_id}/edits/last` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5826ae6bc5d9c7f", "name": "Unused endpoint: POST /sessions/{session_id}/governance", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/governance"}, "fullDescription": {"text": "`app/api/routes/canvas.py` declares `POST /sessions/{session_id}/governance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17862"}, "properties": {"repository": "RasmusTho/agentic-pkm-mvp", "repoUrl": "https://github.com/RasmusTho/agentic-pkm-mvp", "branch": "main"}, "results": [{"ruleId": "scanner-574230dc47bf2232", "level": "note", "message": {"text": "Possibly dead Python function: make_per_graph"}, "properties": {"repobilityId": "bf7d954338361afc", "scanner": "scanner-primary", "fingerprint": "574230dc47bf2232", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/templates/per_agent_graph.py:13"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fff598c1e0a18325", "level": "note", "message": {"text": "Possibly dead Python function: plan_node"}, "properties": {"repobilityId": "02e0060d1902f8aa", "scanner": "scanner-primary", "fingerprint": "fff598c1e0a18325", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/templates/per_agent_graph.py:23"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5416dc3286a7f3d", "level": "note", "message": {"text": "Possibly dead Python function: act_node"}, "properties": {"repobilityId": "a5476935efdaf231", "scanner": "scanner-primary", "fingerprint": "a5416dc3286a7f3d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/templates/per_agent_graph.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-547d35213aef9e15", "level": "note", "message": {"text": "Possibly dead Python function: reflect_node"}, "properties": {"repobilityId": "26f9e39e3f4c6026", "scanner": "scanner-primary", "fingerprint": "547d35213aef9e15", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/templates/per_agent_graph.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf2cf44654d5ddcc", "level": "note", "message": {"text": "Possibly dead Python function: emit_node"}, "properties": {"repobilityId": "49bf6aa969396f77", "scanner": "scanner-primary", "fingerprint": "cf2cf44654d5ddcc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/templates/per_agent_graph.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb0bf4a765781f2e", "level": "note", "message": {"text": "Possibly dead Python function: run_git_check"}, "properties": {"repobilityId": "2556fdfd6f1c4cac", "scanner": "scanner-primary", "fingerprint": "fb0bf4a765781f2e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/git_hygiene.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df6a61eaa023167e", "level": "note", "message": {"text": "Possibly dead Python function: fetch_top_interesting"}, "properties": {"repobilityId": "c94f429ff0738408", "scanner": "scanner-primary", "fingerprint": "df6a61eaa023167e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/deps.py:9"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63fe10e4914bf67c", "level": "note", "message": {"text": "Possibly dead Python function: interesting_summary"}, "properties": {"repobilityId": "bc52ae095f25caa2", "scanner": "scanner-primary", "fingerprint": "63fe10e4914bf67c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/deps.py:11"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-19081e421d57d5a5", "level": "note", "message": {"text": "Possibly dead Python function: health_summary"}, "properties": {"repobilityId": "14cc059254e3ca21", "scanner": "scanner-primary", "fingerprint": "19081e421d57d5a5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/health.py:52"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdc9c9cd85178f86", "level": "note", "message": {"text": "Possibly dead Python function: require_api_key"}, "properties": {"repobilityId": "44e8e9840fc57179", "scanner": "scanner-primary", "fingerprint": "fdc9c9cd85178f86", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/auth.py:15"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49deac84374109e7", "level": "note", "message": {"text": "Possibly dead Python function: rate_limit_default"}, "properties": {"repobilityId": "ae2b46d030fc6693", "scanner": "scanner-primary", "fingerprint": "49deac84374109e7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/auth.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-296dda30c64c5e0e", "level": "note", "message": {"text": "Possibly dead Python function: configure_rate_limit_storage"}, "properties": {"repobilityId": "cf439c9aa0afb036", "scanner": "scanner-primary", "fingerprint": "296dda30c64c5e0e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/auth.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d38510ba98f2042a", "level": "note", "message": {"text": "Possibly dead Python function: verify_request"}, "properties": {"repobilityId": "73fa126dffcff9f3", "scanner": "scanner-primary", "fingerprint": "d38510ba98f2042a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/auth.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55f43760d185a1cf", "level": "note", "message": {"text": "Possibly dead Python function: cmd_normalize"}, "properties": {"repobilityId": "ca61a2eb12589a60", "scanner": "scanner-primary", "fingerprint": "55f43760d185a1cf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/cli.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-952a47fec3d80022", "level": "note", "message": {"text": "Possibly dead Python function: cmd_classify"}, "properties": {"repobilityId": "a1b1afdc70aaa7b2", "scanner": "scanner-primary", "fingerprint": "952a47fec3d80022", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/cli.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-52c60f2f4ba1f7f9", "level": "note", "message": {"text": "Possibly dead Python function: cmd_pipe"}, "properties": {"repobilityId": "125a8b1c0a651f6d", "scanner": "scanner-primary", "fingerprint": "52c60f2f4ba1f7f9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/cli.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d261df29c3b02df0", "level": "note", "message": {"text": "Possibly dead Python function: is_secret_ref"}, "properties": {"repobilityId": "f70f034802b797f0", "scanner": "scanner-primary", "fingerprint": "d261df29c3b02df0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/settings/constraints.py:34"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d0aea34d9005a85", "level": "note", "message": {"text": "Possibly dead Python function: count_for_artifact"}, "properties": {"repobilityId": "e427e49251374ec1", "scanner": "scanner-primary", "fingerprint": "1d0aea34d9005a85", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/panel/confirmation.py:361"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2631e5100e9aaa3", "level": "note", "message": {"text": "Possibly dead Python function: latest"}, "properties": {"repobilityId": "294001e0bb39db61", "scanner": "scanner-primary", "fingerprint": "c2631e5100e9aaa3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/stores/memory.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e435d679bac6fc6", "level": "note", "message": {"text": "Possibly dead Python function: latest"}, "properties": {"repobilityId": "294001e0bb39db61", "scanner": "scanner-primary", "fingerprint": "6e435d679bac6fc6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/stores/base.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3393879a1c1b08c", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "d3393879a1c1b08c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/obs/log.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "f391052c9bfd7e8b", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-bf4546c8f786277f", "level": "error", "message": {"text": "Possible secret in scripts/start_full_system.sh"}, "properties": {"repobilityId": "17cc1b0b59f0dda4", "scanner": "scanner-primary", "fingerprint": "bf4546c8f786277f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/start_full_system.sh"}, "region": {"startLine": 1204}}}]}, {"ruleId": "scanner-a78b13487ba11616", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in app/web/static/index.html:269"}, "properties": {"repobilityId": "c6049266c63e6fe5", "scanner": "scanner-primary", "fingerprint": "a78b13487ba11616", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/web/static/index.html"}, "region": {"startLine": 269}}}]}, {"ruleId": "scanner-8e1bd9c3397e1949", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/design_handoff/2026-06-09-system-entry-point/prototype.html:587"}, "properties": {"repobilityId": "893577f6f1b02d56", "scanner": "scanner-primary", "fingerprint": "8e1bd9c3397e1949", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "companion-ui/design_handoff/2026-06-09-system-entry-point/prototype.html"}, "region": {"startLine": 587}}}]}, {"ruleId": "scanner-ab6c353ea70d5385", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/design_handoff/2026-05-11-canvas-suggestion-flow/Canvas Suggestion Flow.html:1750"}, "properties": {"repobilityId": "f3fc471e9f33f1f5", "scanner": "scanner-primary", "fingerprint": "ab6c353ea70d5385", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "companion-ui/design_handoff/2026-05-11-canvas-suggestion-flow/Canvas Suggestion Flow.html"}, "region": {"startLine": 1750}}}]}, {"ruleId": "scanner-0602cf3c78c7e2de", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in companion-ui/companion-app/canvas_suggestion_flow.html:579"}, "properties": {"repobilityId": "d48761c07b6c3dcb", "scanner": "scanner-primary", "fingerprint": "0602cf3c78c7e2de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "companion-ui/companion-app/canvas_suggestion_flow.html"}, "region": {"startLine": 579}}}]}, {"ruleId": "scanner-f94098e13714646e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c9437bbb069efae7", "scanner": "scanner-primary", "fingerprint": "f94098e13714646e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-uat.yaml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-f94098e13714646e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c9a2882198f01eb7", "scanner": "scanner-primary", "fingerprint": "f94098e13714646e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-uat.yaml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-f94098e13714646e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "31fc3e24eaead2aa", "scanner": "scanner-primary", "fingerprint": "f94098e13714646e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-uat.yaml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-3d554c7f8c63c8dd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "863252fc237b8880", "scanner": "scanner-primary", "fingerprint": "3d554c7f8c63c8dd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/browser-runtime.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-3d554c7f8c63c8dd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ec178c01780b82d9", "scanner": "scanner-primary", "fingerprint": "3d554c7f8c63c8dd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/browser-runtime.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-3044951d79a27643", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "11b16f89879a9a31", "scanner": "scanner-primary", "fingerprint": "3044951d79a27643", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/architecture-ci.yaml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-3044951d79a27643", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "11b16f89879a9a31", "scanner": "scanner-primary", "fingerprint": "3044951d79a27643", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/architecture-ci.yaml"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-b3c192c18b7973e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "085e2ba6fd236c63", "scanner": "scanner-primary", "fingerprint": "b3c192c18b7973e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-lite.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be94c419ea0df645", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cc731be9b7f83ba3", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cf5e4115a49ad5d0", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be94c419ea0df645", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cc731be9b7f83ba3", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cf5e4115a49ad5d0", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be94c419ea0df645", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cc731be9b7f83ba3", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-ab2e91ca1bbf22f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cf5e4115a49ad5d0", "scanner": "scanner-primary", "fingerprint": "ab2e91ca1bbf22f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/integration-nightly.yaml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-b97f54bd2aa0f57b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a368019fac43a19", "scanner": "scanner-primary", "fingerprint": "b97f54bd2aa0f57b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-b97f54bd2aa0f57b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "083b29449111b38b", "scanner": "scanner-primary", "fingerprint": "b97f54bd2aa0f57b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa8caa630eab5d02", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38af1cf3d82f3a3a", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a9856bfd90ff82d", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa8caa630eab5d02", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1a9856bfd90ff82d", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa8caa630eab5d02", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 420}}}]}, {"ruleId": "scanner-5bd65249d38988d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38af1cf3d82f3a3a", "scanner": "scanner-primary", "fingerprint": "5bd65249d38988d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-smoke.yaml"}, "region": {"startLine": 423}}}]}, {"ruleId": "scanner-a861c9ee73ee05f8", "level": "note", "message": {"text": "Very large file: tests/companion_ui/test_entry_state_gallery.py (1387 lines)"}, "properties": {"repobilityId": "296443a16931923c", "scanner": "scanner-primary", "fingerprint": "a861c9ee73ee05f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-84012e5b71d66df5", "level": "note", "message": {"text": "Very large file: scripts/start_full_system.sh (2439 lines)"}, "properties": {"repobilityId": "80baf5873ae66b8e", "scanner": "scanner-primary", "fingerprint": "84012e5b71d66df5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5875a2e1d91a94e8", "level": "note", "message": {"text": "Very large file: app/api/routes/companion.py (3815 lines)"}, "properties": {"repobilityId": "e8caa681ef172c1c", "scanner": "scanner-primary", "fingerprint": "5875a2e1d91a94e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9b86e2d976532d10", "level": "note", "message": {"text": "Very large file: app/cli/__init__.py (1757 lines)"}, "properties": {"repobilityId": "6a2081e3744b9efc", "scanner": "scanner-primary", "fingerprint": "9b86e2d976532d10", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d0fa19b614efcb7c", "level": "note", "message": {"text": "Very large file: companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py (10760 lines)"}, "properties": {"repobilityId": "798e17570cb9816e", "scanner": "scanner-primary", "fingerprint": "d0fa19b614efcb7c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8cf886fb86ce5291", "level": "note", "message": {"text": "Very large file: companion-ui/companion-app/companion_ui/workspace/real_note_workspace_dev_page.py (1282 lines)"}, "properties": {"repobilityId": "0a0714e155a93260", "scanner": "scanner-primary", "fingerprint": "8cf886fb86ce5291", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4067e6de87b9f93a", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b29d37b4e1ce5bdb", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "6bf3ee324355222e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "24c90145d3cf6125", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fd86c1fd82d2a8b7", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c1e4029e99dc4880", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/docs-authoring/SKILL.md"}, "properties": {"repobilityId": "cfbd013a8136051e", "scanner": "scanner-primary", "fingerprint": "c1e4029e99dc4880", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/docs-authoring/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e73fc738a220064c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/automation-maintenance/SKILL.md"}, "properties": {"repobilityId": "a453b1352d864c6c", "scanner": "scanner-primary", "fingerprint": "e73fc738a220064c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/automation-maintenance/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e84f9f2a22940058", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/backlog-reconciliation-drift-audit/SKILL.md"}, "properties": {"repobilityId": "8f97a1aca3ca7a23", "scanner": "scanner-primary", "fingerprint": "e84f9f2a22940058", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/backlog-reconciliation-drift-audit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-01d3b33e869959b1", "level": "note", "message": {"text": "Legacy-named symbol `test_pipeline_flag_off_matches_legacy` in tests/diarization/test_chunk_policy.py:26"}, "properties": {"repobilityId": "ff4c03ad68f61ba1", "scanner": "scanner-primary", "fingerprint": "01d3b33e869959b1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b542739915035174", "level": "note", "message": {"text": "Legacy-named symbol `test_orchestrator_version_env_variable_v2` in tests/orchestration/v2/test_orchestrator_flag.py:12"}, "properties": {"repobilityId": "2cbb011f675777ff", "scanner": "scanner-primary", "fingerprint": "b542739915035174", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5de246bb8ac33018", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/knowledge_compilation/test_runtime_artifacts.py:255"}, "properties": {"repobilityId": "32a027c8b3fbfe43", "scanner": "scanner-primary", "fingerprint": "5de246bb8ac33018", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d6523100959f54d0", "level": "note", "message": {"text": "Legacy-named symbol `test_code_inventory_distinguishes_planned_from_deprecated` in tests/architecture/test_code_inventory.py:62"}, "properties": {"repobilityId": "c28b0a32f5208035", "scanner": "scanner-primary", "fingerprint": "d6523100959f54d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9460e294ff643a22", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/uat/test_negative_safety_integrated_runtime.py:373"}, "properties": {"repobilityId": "a11dcff9571f9676", "scanner": "scanner-primary", "fingerprint": "9460e294ff643a22", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-37a6005c2663f304", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/api/test_resurfacing_consumes_bundle.py:55"}, "properties": {"repobilityId": "90dcf51bbbdc574a", "scanner": "scanner-primary", "fingerprint": "37a6005c2663f304", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-820e3905eebde19f", "level": "none", "message": {"text": "Commented-code block (9 lines) in tests/api/test_companion_vault_routing.py:161"}, "properties": {"repobilityId": "c16bc78d8bd6734b", "scanner": "scanner-primary", "fingerprint": "820e3905eebde19f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-55b50bd775e52c09", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/api/test_orientation_consumes_bundle.py:55"}, "properties": {"repobilityId": "33200c00e49f8a80", "scanner": "scanner-primary", "fingerprint": "55b50bd775e52c09", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-19a0c95c19e86b0b", "level": "note", "message": {"text": "Legacy-named symbol `integrated_runtime_v1` in tests/api/test_status_release_readiness.py:84"}, "properties": {"repobilityId": "afcbab81210b66b6", "scanner": "scanner-primary", "fingerprint": "19a0c95c19e86b0b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-630c8c7a14af69b9", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_receipts_history_surface.py:349"}, "properties": {"repobilityId": "967d2b836404dfff", "scanner": "scanner-primary", "fingerprint": "630c8c7a14af69b9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7531a37dbee061f2", "level": "note", "message": {"text": "Legacy-named symbol `test_internal_labels_do_not_leak_to_default_copy` in tests/companion_ui/test_right_rail_compaction.py:185"}, "properties": {"repobilityId": "79c622e581788027", "scanner": "scanner-primary", "fingerprint": "7531a37dbee061f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-18d1307f0c3a9789", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_entry_state_gallery.py:1270"}, "properties": {"repobilityId": "8f5c059ec45d889c", "scanner": "scanner-primary", "fingerprint": "18d1307f0c3a9789", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85de536182649547", "level": "note", "message": {"text": "Legacy-named symbol `test_rail_empty_state_carries_human_copy` in tests/companion_ui/test_workspace_shell_alignment.py:492"}, "properties": {"repobilityId": "d6a47f9beb7a3baf", "scanner": "scanner-primary", "fingerprint": "85de536182649547", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-037121d7e40188e4", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_workspace_read_only_pill.py:73"}, "properties": {"repobilityId": "5d64170ca651fad8", "scanner": "scanner-primary", "fingerprint": "037121d7e40188e4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-690d8de65da74dec", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/companion_ui/test_overlay_host.py:336"}, "properties": {"repobilityId": "6f7c3d8de9256772", "scanner": "scanner-primary", "fingerprint": "690d8de65da74dec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3eb41c773b588970", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/agent_memory/test_recall_surfacing.py:112"}, "properties": {"repobilityId": "fb3b07038b8039e8", "scanner": "scanner-primary", "fingerprint": "3eb41c773b588970", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ef5872657c37fc9f", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/agent_memory/test_review_queue.py:66"}, "properties": {"repobilityId": "5a0ae2521451db9b", "scanner": "scanner-primary", "fingerprint": "ef5872657c37fc9f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1853c37baaaff4d5", "level": "note", "message": {"text": "Legacy-named symbol `companion_agent_v1` in tests/agent_memory/test_metadata_compatibility.py:266"}, "properties": {"repobilityId": "33927e8d94d7fdcb", "scanner": "scanner-primary", "fingerprint": "1853c37baaaff4d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fb881f079889a81a", "level": "note", "message": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_embedding_migration.py:32"}, "properties": {"repobilityId": "988483f63863d240", "scanner": "scanner-primary", "fingerprint": "fb881f079889a81a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0362280fa65bf275", "level": "note", "message": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_integration.py:18"}, "properties": {"repobilityId": "a36f343090a89ec9", "scanner": "scanner-primary", "fingerprint": "0362280fa65bf275", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-52997572a5a09c92", "level": "note", "message": {"text": "Legacy-named symbol `test_known_providers_has_legacy` in tests/components/embeddings/test_validation.py:235"}, "properties": {"repobilityId": "c4aa79fe9c856462", "scanner": "scanner-primary", "fingerprint": "52997572a5a09c92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1a11ef6a38cdaa44", "level": "note", "message": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/test_migration.py:8"}, "properties": {"repobilityId": "1adcf9275d6e955f", "scanner": "scanner-primary", "fingerprint": "1a11ef6a38cdaa44", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-edc4d6ec2d0f8eea", "level": "note", "message": {"text": "Legacy-named symbol `auto_tag_legacy` in tests/components/embeddings/run_tests.py:14"}, "properties": {"repobilityId": "be8209d19064030b", "scanner": "scanner-primary", "fingerprint": "edc4d6ec2d0f8eea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dcaf31c0625ad338", "level": "note", "message": {"text": "Legacy-named symbol `_enable_v2` in tests/orchestrator/test_multi_step_chain_traceability.py:209"}, "properties": {"repobilityId": "a083317938d25171", "scanner": "scanner-primary", "fingerprint": "dcaf31c0625ad338", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-83cd8d3b83d64908", "level": "note", "message": {"text": "Legacy-named symbol `test_messages_preserved_in_copy` in tests/agents/pilot_agent/test_state.py:248"}, "properties": {"repobilityId": "8556df49b9d6e50e", "scanner": "scanner-primary", "fingerprint": "83cd8d3b83d64908", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d2b298bf429416b0", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/agents/panel_agent/test_panel_graph.py:489"}, "properties": {"repobilityId": "e2c8fdd4b343848c", "scanner": "scanner-primary", "fingerprint": "d2b298bf429416b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ffd70e9c25eac84", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/agents/panel_agent/test_panel_runtime.py:526"}, "properties": {"repobilityId": "5bf9d8447a4afc10", "scanner": "scanner-primary", "fingerprint": "8ffd70e9c25eac84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5e95a1a20c50a035", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/e2e/test_reality_mvp_pipeline.py:38"}, "properties": {"repobilityId": "4fb4509bc35d749e", "scanner": "scanner-primary", "fingerprint": "5e95a1a20c50a035", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d4c5e591c117820", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/quality_wave/test_event_chain.py:226"}, "properties": {"repobilityId": "5c10731ff1278990", "scanner": "scanner-primary", "fingerprint": "5d4c5e591c117820", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7c02e342e7eed753", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/quality_wave/test_fitness_gates.py:125"}, "properties": {"repobilityId": "562e5eefbea18cc0", "scanner": "scanner-primary", "fingerprint": "7c02e342e7eed753", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d5b2989cdcb5f004", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/tag_release.py:25"}, "properties": {"repobilityId": "0f5ebacd73e883cb", "scanner": "scanner-primary", "fingerprint": "d5b2989cdcb5f004", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-922a7fd3498f1d15", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_ask_smoke.py:41"}, "properties": {"repobilityId": "258c85f7be990b7f", "scanner": "scanner-primary", "fingerprint": "922a7fd3498f1d15", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-15fa281142388594", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/runtime_proof_smoke.py:68"}, "properties": {"repobilityId": "088c12965c0030e9", "scanner": "scanner-primary", "fingerprint": "15fa281142388594", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c15db092d5e98c0", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/git_hygiene.py:28"}, "properties": {"repobilityId": "6532c26dec46f919", "scanner": "scanner-primary", "fingerprint": "2c15db092d5e98c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-55e45f32acabb175", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/query_ws.py:5"}, "properties": {"repobilityId": "689dd2f0f0ddeba4", "scanner": "scanner-primary", "fingerprint": "55e45f32acabb175", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cd0b63a355c8ff7f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/project_status.py:55"}, "properties": {"repobilityId": "5da34ea12b507ec7", "scanner": "scanner-primary", "fingerprint": "cd0b63a355c8ff7f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7f875ed2ccfa4ebd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_reality_smoke.py:40"}, "properties": {"repobilityId": "bd0873ce5d44b884", "scanner": "scanner-primary", "fingerprint": "7f875ed2ccfa4ebd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0309869c2cefe97f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/alpha_e2e.py:234"}, "properties": {"repobilityId": "394a33a488b3a813", "scanner": "scanner-primary", "fingerprint": "0309869c2cefe97f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7c3b0bcaa2a14163", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/docs_guard.py:7"}, "properties": {"repobilityId": "896687946fb80f38", "scanner": "scanner-primary", "fingerprint": "7c3b0bcaa2a14163", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-838b9571aa0a8013", "level": "note", "message": {"text": "Legacy-named symbol `pattern_copy` in app/settings/flow_profiles.py:82"}, "properties": {"repobilityId": "4cd3be5a1cc4a3a2", "scanner": "scanner-primary", "fingerprint": "838b9571aa0a8013", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-eb7479879848a652", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/vault/settings_service.py:350"}, "properties": {"repobilityId": "a7048db4773ae053", "scanner": "scanner-primary", "fingerprint": "eb7479879848a652", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab239379c8ed66eb", "level": "none", "message": {"text": "Commented-code block (9 lines) in app/vault/manager.py:178"}, "properties": {"repobilityId": "05975bbd16e0ec4d", "scanner": "scanner-primary", "fingerprint": "ab239379c8ed66eb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3173ed8eb29f4f68", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/vault/actions.py:265"}, "properties": {"repobilityId": "bd5203ac32f86f64", "scanner": "scanner-primary", "fingerprint": "3173ed8eb29f4f68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-91a5e6eb67ea3a51", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/panel/confirmation.py:628"}, "properties": {"repobilityId": "ee66850db8e9ed83", "scanner": "scanner-primary", "fingerprint": "91a5e6eb67ea3a51", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9474c60662364cc1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 app/sync/git.py:138"}, "properties": {"repobilityId": "1bfe4cf4bbdbe940", "scanner": "scanner-primary", "fingerprint": "9474c60662364cc1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5fc316000a936dbf", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/config/__init__.py:1"}, "properties": {"repobilityId": "9734c9822e8af6a5", "scanner": "scanner-primary", "fingerprint": "5fc316000a936dbf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cf58bb6be6cc699d", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/config/agent.py:107"}, "properties": {"repobilityId": "11260c3f04e8f918", "scanner": "scanner-primary", "fingerprint": "cf58bb6be6cc699d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4b7a3fd73d19fdf5", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/knowledge_compilation/review_admission.py:154"}, "properties": {"repobilityId": "73eb2ca0a80d27da", "scanner": "scanner-primary", "fingerprint": "4b7a3fd73d19fdf5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8f61475c4e827f45", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/knowledge_compilation/runtime_artifacts.py:172"}, "properties": {"repobilityId": "c112513ccc49c472", "scanner": "scanner-primary", "fingerprint": "8f61475c4e827f45", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5b56f73e483db15e", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/knowledge_compilation/runtime_artifacts.py:176"}, "properties": {"repobilityId": "e12a59dc04e123d8", "scanner": "scanner-primary", "fingerprint": "5b56f73e483db15e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8ba7b7deae08413", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/ops/test_channel_bootstrap.py:138"}, "properties": {"repobilityId": "c5f276806149996f", "scanner": "scanner-primary", "fingerprint": "e8ba7b7deae08413", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ca15735739fd447", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 app/tts/providers.py:99"}, "properties": {"repobilityId": "400ee2ec74915ea0", "scanner": "scanner-primary", "fingerprint": "0ca15735739fd447", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-52b1431c03a63413", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/events/panel.py:28"}, "properties": {"repobilityId": "94fff5cdae0dc642", "scanner": "scanner-primary", "fingerprint": "52b1431c03a63413", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7c2b14b836c5e970", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 app/media/transcribe.py:70"}, "properties": {"repobilityId": "33b9688fc6192690", "scanner": "scanner-primary", "fingerprint": "7c2b14b836c5e970", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-abe32292a5ba8f8d", "level": "note", "message": {"text": "Stub function `start` (body is just `pass`/`return`) \u2014 app/api/_shim_helpers.py:11"}, "properties": {"repobilityId": "19a3cd7248358e9a", "scanner": "scanner-primary", "fingerprint": "abe32292a5ba8f8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-106b1e7d80b525fa", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/api/routes/companion.py:2132"}, "properties": {"repobilityId": "2bda78cb05b9f257", "scanner": "scanner-primary", "fingerprint": "106b1e7d80b525fa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-96a3255f6002e640", "level": "none", "message": {"text": "Commented-code block (13 lines) in app/api/routes/companion.py:298"}, "properties": {"repobilityId": "18d3038b4e56afaa", "scanner": "scanner-primary", "fingerprint": "96a3255f6002e640", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66ed53f4b0b45601", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/api/routes/context_bundles.py:27"}, "properties": {"repobilityId": "40a0e385ad608b1d", "scanner": "scanner-primary", "fingerprint": "66ed53f4b0b45601", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-66bbf22a2f75e438", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/api/routes/canvas.py:512"}, "properties": {"repobilityId": "8fd5c3cf6d1a7c35", "scanner": "scanner-primary", "fingerprint": "66bbf22a2f75e438", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b509639c9d17fc34", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/release_channels/channel_isolation_preflight.py:506"}, "properties": {"repobilityId": "07d7e5140f894970", "scanner": "scanner-primary", "fingerprint": "b509639c9d17fc34", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4c4019762cb6604a", "level": "note", "message": {"text": "Legacy-named symbol `store_stats_legacy` in app/cli/__init__.py:402"}, "properties": {"repobilityId": "d2122c2f9b4d0860", "scanner": "scanner-primary", "fingerprint": "4c4019762cb6604a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5efb35b234165bc3", "level": "note", "message": {"text": "Legacy-named symbol `strip_v1` in app/cli/llm_doctor.py:36"}, "properties": {"repobilityId": "5898347d08823538", "scanner": "scanner-primary", "fingerprint": "5efb35b234165bc3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-511926625ccd82b3", "level": "note", "message": {"text": "Stub function `llm` (body is just `pass`/`return`) \u2014 app/cli/llm_doctor.py:102"}, "properties": {"repobilityId": "1b3372846a8d66a5", "scanner": "scanner-primary", "fingerprint": "511926625ccd82b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-4d28323589b22b9b", "level": "note", "message": {"text": "Legacy-named symbol `payload_copy` in app/cli/alpha_human_flows.py:86"}, "properties": {"repobilityId": "a4217cc8f1fa95a2", "scanner": "scanner-primary", "fingerprint": "4d28323589b22b9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-42d8741e1f43d83a", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/ingest/vault_alpha.py:792"}, "properties": {"repobilityId": "7e089e3341e37bf1", "scanner": "scanner-primary", "fingerprint": "42d8741e1f43d83a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eff89e58ed713469", "level": "note", "message": {"text": "Legacy-named symbol `payload_copy` in app/ingest/vault_root.py:45"}, "properties": {"repobilityId": "cf88f8e0d7654aa7", "scanner": "scanner-primary", "fingerprint": "eff89e58ed713469", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6416b6abac0ba500", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agent_memory/review_queue.py:251"}, "properties": {"repobilityId": "0c3c65e230ed4862", "scanner": "scanner-primary", "fingerprint": "6416b6abac0ba500", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-36384088a56009f7", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agent_memory/recall_activation.py:86"}, "properties": {"repobilityId": "8622ce0abcb22e22", "scanner": "scanner-primary", "fingerprint": "36384088a56009f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-383db78331e28f55", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agent_memory/companion_aware.py:199"}, "properties": {"repobilityId": "c19bbdf465fc4127", "scanner": "scanner-primary", "fingerprint": "383db78331e28f55", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1add7ce6f6c03b95", "level": "note", "message": {"text": "Legacy-named symbol `auto_tag_legacy` in app/components/embeddings/__init__.py:34"}, "properties": {"repobilityId": "93bd3527272abf92", "scanner": "scanner-primary", "fingerprint": "1add7ce6f6c03b95", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cb22e40e4b29016b", "level": "note", "message": {"text": "Legacy-named symbol `auto_tag_legacy` in app/components/embeddings/migration.py:40"}, "properties": {"repobilityId": "7cf4cfb47614d98c", "scanner": "scanner-primary", "fingerprint": "cb22e40e4b29016b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9fec6407b14af02d", "level": "note", "message": {"text": "Legacy-named symbol `integrated_runtime_v1` in app/observability/status_model.py:210"}, "properties": {"repobilityId": "62d94f3a5b0c3576", "scanner": "scanner-primary", "fingerprint": "9fec6407b14af02d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0c7ba8480cfbe260", "level": "note", "message": {"text": "Legacy-named symbol `integrated_runtime_v1` in app/observability/status_service.py:1184"}, "properties": {"repobilityId": "d0a4d2bf164d87cf", "scanner": "scanner-primary", "fingerprint": "0c7ba8480cfbe260", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-026acf41034b7c0f", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/panel/agent.py:320"}, "properties": {"repobilityId": "281c4e14d37976b8", "scanner": "scanner-primary", "fingerprint": "026acf41034b7c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cbf8586740fe8729", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/panel/intents.py:54"}, "properties": {"repobilityId": "4ebb4bec7de0a31f", "scanner": "scanner-primary", "fingerprint": "cbf8586740fe8729", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8c149e4d50307048", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/panel_agent/graph.py:243"}, "properties": {"repobilityId": "79e272f7d2938169", "scanner": "scanner-primary", "fingerprint": "8c149e4d50307048", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b69359495cdd0288", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/agents/panel_agent/graph.py:34"}, "properties": {"repobilityId": "d8064263194c710f", "scanner": "scanner-primary", "fingerprint": "b69359495cdd0288", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2b6a99110ad38884", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/panel_agent/cognition.py:595"}, "properties": {"repobilityId": "7c2a7d9ca86721e4", "scanner": "scanner-primary", "fingerprint": "2b6a99110ad38884", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c6ac198ceac19815", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/panel_agent/runtime.py:143"}, "properties": {"repobilityId": "5bff627003e37740", "scanner": "scanner-primary", "fingerprint": "c6ac198ceac19815", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c83f6a7c10937971", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/agents/panel_agent/runtime.py:540"}, "properties": {"repobilityId": "e285b077554ffeea", "scanner": "scanner-primary", "fingerprint": "c83f6a7c10937971", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87e9569cfc703b2b", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/agents/ask/graph.py:207"}, "properties": {"repobilityId": "a0f83fb2c54656c9", "scanner": "scanner-primary", "fingerprint": "87e9569cfc703b2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-196ab9a2fa57208c", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/agents/ask/utils.py:25"}, "properties": {"repobilityId": "904a6c9fc8c8c830", "scanner": "scanner-primary", "fingerprint": "196ab9a2fa57208c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-81dcc5e40818a29f", "level": "note", "message": {"text": "Stub function `fetchone` (body is just `pass`/`return`) \u2014 app/services/outbox.py:59"}, "properties": {"repobilityId": "e08508e1f0516270", "scanner": "scanner-primary", "fingerprint": "81dcc5e40818a29f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-9829737171583770", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/relevance/interruptibility.py:30"}, "properties": {"repobilityId": "cbe7d05144d431e0", "scanner": "scanner-primary", "fingerprint": "9829737171583770", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83f13054a7cdc0da", "level": "note", "message": {"text": "Stub function `ensure_schema` (body is just `pass`/`return`) \u2014 app/db/sqlalchemy.py:17"}, "properties": {"repobilityId": "1dca6f97022c635e", "scanner": "scanner-primary", "fingerprint": "83f13054a7cdc0da", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-4411da0a854858bc", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/watcher/config.py:55"}, "properties": {"repobilityId": "03262a63405ff87d", "scanner": "scanner-primary", "fingerprint": "4411da0a854858bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-970a182c9d276397", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/context_bundles/runtime_registry.py:30"}, "properties": {"repobilityId": "2c265535292a142c", "scanner": "scanner-primary", "fingerprint": "970a182c9d276397", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3758edf3df12fbe4", "level": "note", "message": {"text": "Stub function `upgrade` (body is just `pass`/`return`) \u2014 app/alembic/versions/6841f6d42913_merge_heads.py:21"}, "properties": {"repobilityId": "b5c7a18405d0be16", "scanner": "scanner-primary", "fingerprint": "3758edf3df12fbe4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-4807cf2ceb1c638a", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/receipts/bundle_receipt_projection.py:62"}, "properties": {"repobilityId": "cdb5866848654284", "scanner": "scanner-primary", "fingerprint": "4807cf2ceb1c638a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6d05ec8939e9c842", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in app/receipts/bundle_receipts.py:68"}, "properties": {"repobilityId": "ffc7721c644d5d09", "scanner": "scanner-primary", "fingerprint": "6d05ec8939e9c842", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-401055eb090946e6", "level": "note", "message": {"text": "Legacy-named symbol `strip_v1` in app/llm/embeddings.py:42"}, "properties": {"repobilityId": "172b5d0fdf8633bb", "scanner": "scanner-primary", "fingerprint": "401055eb090946e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-057b87289a4b0d04", "level": "note", "message": {"text": "Legacy-named symbol `strip_v1` in app/llm/endpoints.py:17"}, "properties": {"repobilityId": "3d971ce562b824a7", "scanner": "scanner-primary", "fingerprint": "057b87289a4b0d04", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-33cb26809d196b5f", "level": "none", "message": {"text": "Commented-code block (6 lines) in companion-ui/design_handoff/2026-05-03-converse/design-canvas.jsx:2"}, "properties": {"repobilityId": "17d4d02e24c04f08", "scanner": "scanner-primary", "fingerprint": "33cb26809d196b5f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-996a7daf59bbe0b2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 companion-ui/design_handoff/2026-05-03-converse/design-canvas.jsx:63"}, "properties": {"repobilityId": "68d8f01b6cd28d58", "scanner": "scanner-primary", "fingerprint": "996a7daf59bbe0b2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6e064c91b4175fd6", "level": "none", "message": {"text": "Commented-code block (6 lines) in companion-ui/design_handoff/2026-05-08-cognitive-temporal/design-canvas.jsx:2"}, "properties": {"repobilityId": "70966ddf36a5dd7b", "scanner": "scanner-primary", "fingerprint": "6e064c91b4175fd6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e9239d46e3e963e5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 companion-ui/design_handoff/2026-05-08-cognitive-temporal/design-canvas.jsx:63"}, "properties": {"repobilityId": "31a99001bb0fc47c", "scanner": "scanner-primary", "fingerprint": "e9239d46e3e963e5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-91018b159057d03b", "level": "none", "message": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/canvas_suggestion_flow/__init__.py:1"}, "properties": {"repobilityId": "6f5920741f251003", "scanner": "scanner-primary", "fingerprint": "91018b159057d03b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc6f6e143fa4f4ce", "level": "none", "message": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/panel/proposal_row.py:75"}, "properties": {"repobilityId": "f060836ec68fed99", "scanner": "scanner-primary", "fingerprint": "cc6f6e143fa4f4ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9fe1213442c1aa5c", "level": "note", "message": {"text": "Legacy-named symbol `rail_posture_copy` in companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py:1826"}, "properties": {"repobilityId": "98a2d04944bd1e3c", "scanner": "scanner-primary", "fingerprint": "9fe1213442c1aa5c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d6aee4771cf4b2ef", "level": "none", "message": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/workspace/serve_dev_page.py:765"}, "properties": {"repobilityId": "bf699512e207a13b", "scanner": "scanner-primary", "fingerprint": "d6aee4771cf4b2ef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-832c90bf076510ed", "level": "note", "message": {"text": "Legacy-named symbol `_status_copy` in companion-ui/companion-app/companion_ui/workspace/vault_settings_panel.py:35"}, "properties": {"repobilityId": "5b8a95213c5cd9b2", "scanner": "scanner-primary", "fingerprint": "832c90bf076510ed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-70138f6d4667385e", "level": "none", "message": {"text": "Commented-code block (6 lines) in companion-ui/companion-app/companion_ui/workspace/real_note_workspace_dev_page.py:253"}, "properties": {"repobilityId": "88f72c05eca7ef59", "scanner": "scanner-primary", "fingerprint": "70138f6d4667385e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-70f359bf42a03218", "level": "none", "message": {"text": "Commented-code block (5 lines) in companion-ui/companion-app/companion_ui/workspace/receipts_history.py:161"}, "properties": {"repobilityId": "1b42d76b29e7c49b", "scanner": "scanner-primary", "fingerprint": "70f359bf42a03218", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-430356bdc86c2c10", "level": "none", "message": {"text": "Commented-code block (9 lines) in companion-ui/companion-app/companion_ui/workspace/overlay_host.py:51"}, "properties": {"repobilityId": "de973bda502ffcb7", "scanner": "scanner-primary", "fingerprint": "430356bdc86c2c10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1a1921428979d7d5", "level": "note", "message": {"text": "164 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "c9db953d7facd296", "scanner": "scanner-primary", "fingerprint": "1a1921428979d7d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "953aad4b1c6e8cbd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1c790fa7bedbb1f6", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "db21fccdd58edc91", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "34733e0f519c0616", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e6e821f434303450", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f2a295246e50d848", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "db808ecfb508bcef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "50cd97e49ea189fd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "704ee401d1690db9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d1fd21b37f99b05a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ebd07300263692e2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ada0d3925f6bfda7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "df596a8b993b26a3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a6a6b58e5c93d763", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dc5e986c1473d3c1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ff92be16f977bb93", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "50d0fc99fd627312", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0a48bfcd8092bd08", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c521aedc0ff6781b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a5f67f515ffb69ec", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-92bd0e9692d70562", "level": "error", "message": {"text": "FastAPI POST `source_understanding_p0` without auth dependency \u2014 app/api/routes/source_understanding.py:14"}, "properties": {"repobilityId": "2d34d907f5545ba8", "scanner": "scanner-primary", "fingerprint": "92bd0e9692d70562", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/source_understanding.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-50c53e65f82b1fd7", "level": "error", "message": {"text": "FastAPI POST `ask` without auth dependency \u2014 app/api/routes/ask.py:122"}, "properties": {"repobilityId": "79b3ff658d74203b", "scanner": "scanner-primary", "fingerprint": "50c53e65f82b1fd7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/ask.py"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-ba304914da0ba4e8", "level": "error", "message": {"text": "FastAPI POST `panel_confirm` without auth dependency \u2014 app/api/routes/panel.py:33"}, "properties": {"repobilityId": "e609c58a2e71b625", "scanner": "scanner-primary", "fingerprint": "ba304914da0ba4e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/panel.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-18d63f2c056297e7", "level": "error", "message": {"text": "FastAPI POST `panel_checkbox_projection` without auth dependency \u2014 app/api/routes/panel.py:48"}, "properties": {"repobilityId": "908b756bbf24ff90", "scanner": "scanner-primary", "fingerprint": "18d63f2c056297e7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/panel.py"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-0f229afafb9f5686", "level": "error", "message": {"text": "FastAPI POST `select_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:556"}, "properties": {"repobilityId": "fa0b428ac1912955", "scanner": "scanner-primary", "fingerprint": "0f229afafb9f5686", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 556}}}]}, {"ruleId": "scanner-7750fdf5f68b6d11", "level": "error", "message": {"text": "FastAPI POST `initialize_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:580"}, "properties": {"repobilityId": "1398562993ff3bc6", "scanner": "scanner-primary", "fingerprint": "7750fdf5f68b6d11", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 580}}}]}, {"ruleId": "scanner-835819c47a436166", "level": "error", "message": {"text": "FastAPI POST `reload_companion_vault` without auth dependency \u2014 app/api/routes/companion.py:595"}, "properties": {"repobilityId": "2f87b3b5fe450dd5", "scanner": "scanner-primary", "fingerprint": "835819c47a436166", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 595}}}]}, {"ruleId": "scanner-38786ae7246bdedf", "level": "error", "message": {"text": "FastAPI POST `update_companion_vault_setting` without auth dependency \u2014 app/api/routes/companion.py:615"}, "properties": {"repobilityId": "206e8c90e4aec153", "scanner": "scanner-primary", "fingerprint": "38786ae7246bdedf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 615}}}]}, {"ruleId": "scanner-b9f013c5b7558869", "level": "error", "message": {"text": "FastAPI POST `queue_vault_browser_review` without auth dependency \u2014 app/api/routes/companion.py:2806"}, "properties": {"repobilityId": "0ed26beb520e3219", "scanner": "scanner-primary", "fingerprint": "b9f013c5b7558869", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 2806}}}]}, {"ruleId": "scanner-509a4a546ecb47bf", "level": "error", "message": {"text": "FastAPI POST `plan_companion_tts` without auth dependency \u2014 app/api/routes/companion.py:2969"}, "properties": {"repobilityId": "20b4f89f647a7926", "scanner": "scanner-primary", "fingerprint": "509a4a546ecb47bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 2969}}}]}, {"ruleId": "scanner-bcbe7af8bbd970c2", "level": "error", "message": {"text": "FastAPI POST `synthesize_companion_tts` without auth dependency \u2014 app/api/routes/companion.py:2997"}, "properties": {"repobilityId": "3387dca36cf74360", "scanner": "scanner-primary", "fingerprint": "bcbe7af8bbd970c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 2997}}}]}, {"ruleId": "scanner-881d3658e88e99e5", "level": "error", "message": {"text": "FastAPI POST `update_companion_workspace_note_body` without auth dependency \u2014 app/api/routes/companion.py:3141"}, "properties": {"repobilityId": "4e3f969fc4e98a97", "scanner": "scanner-primary", "fingerprint": "881d3658e88e99e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 3141}}}]}, {"ruleId": "scanner-b4f85b46cd0118d2", "level": "error", "message": {"text": "FastAPI POST `update_workspace_body` without auth dependency \u2014 app/api/routes/companion.py:3252"}, "properties": {"repobilityId": "a82ccc21112773bb", "scanner": "scanner-primary", "fingerprint": "b4f85b46cd0118d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 3252}}}]}, {"ruleId": "scanner-a2790e98fa50c33e", "level": "error", "message": {"text": "FastAPI POST `save_note_body` without auth dependency \u2014 app/api/routes/companion.py:3317"}, "properties": {"repobilityId": "aa7e8eb10ebb74e9", "scanner": "scanner-primary", "fingerprint": "a2790e98fa50c33e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 3317}}}]}, {"ruleId": "scanner-35f79db406cd628d", "level": "error", "message": {"text": "FastAPI POST `post_memory_review_decision` without auth dependency \u2014 app/api/routes/companion.py:3654"}, "properties": {"repobilityId": "89cebbf224a4d7c4", "scanner": "scanner-primary", "fingerprint": "35f79db406cd628d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/companion.py"}, "region": {"startLine": 3654}}}]}, {"ruleId": "scanner-5523dfe123cea518", "level": "error", "message": {"text": "FastAPI POST `capture_to_inbox` without auth dependency \u2014 app/api/routes/capture.py:185"}, "properties": {"repobilityId": "7a1920c77bb23170", "scanner": "scanner-primary", "fingerprint": "5523dfe123cea518", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/capture.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-9d05542e42657446", "level": "error", "message": {"text": "FastAPI POST `create_worklog` without auth dependency \u2014 app/api/routes/builderops.py:91"}, "properties": {"repobilityId": "3eb57727423085cd", "scanner": "scanner-primary", "fingerprint": "9d05542e42657446", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/builderops.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-180d6c535013a6e8", "level": "error", "message": {"text": "FastAPI POST `create_learning_signal` without auth dependency \u2014 app/api/routes/builderops.py:99"}, "properties": {"repobilityId": "1c625b6c16ce2f7a", "scanner": "scanner-primary", "fingerprint": "180d6c535013a6e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/builderops.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-01c61c07430db478", "level": "error", "message": {"text": "FastAPI POST `create_promotion_intent` without auth dependency \u2014 app/api/routes/builderops.py:107"}, "properties": {"repobilityId": "34b7556ec2ec3870", "scanner": "scanner-primary", "fingerprint": "01c61c07430db478", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/builderops.py"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-1519178bb16883d3", "level": "error", "message": {"text": "FastAPI POST `append_receipt` without auth dependency \u2014 app/api/routes/builderops.py:115"}, "properties": {"repobilityId": "b9029ad11da5f736", "scanner": "scanner-primary", "fingerprint": "1519178bb16883d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/builderops.py"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-9a6ac2369c558d83", "level": "error", "message": {"text": "FastAPI POST `ingest` without auth dependency \u2014 app/api/routes/ingest.py:21"}, "properties": {"repobilityId": "4cf0e3f1ad344730", "scanner": "scanner-primary", "fingerprint": "9a6ac2369c558d83", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/ingest.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-38bdcc211afa8952", "level": "error", "message": {"text": "FastAPI POST `open_session` without auth dependency \u2014 app/api/routes/canvas.py:273"}, "properties": {"repobilityId": "4b741cd2ab2a5fae", "scanner": "scanner-primary", "fingerprint": "38bdcc211afa8952", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/canvas.py"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-18348d86ad2f0961", "level": "error", "message": {"text": "FastAPI POST `apply_edit` without auth dependency \u2014 app/api/routes/canvas.py:298"}, "properties": {"repobilityId": "de30e454412fcbf5", "scanner": "scanner-primary", "fingerprint": "18348d86ad2f0961", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/canvas.py"}, "region": {"startLine": 298}}}]}, {"ruleId": "scanner-a0db19bf4e4783a2", "level": "error", "message": {"text": "FastAPI POST `coauthor` without auth dependency \u2014 app/api/routes/canvas.py:458"}, "properties": {"repobilityId": "3b809b64f60c4394", "scanner": "scanner-primary", "fingerprint": "a0db19bf4e4783a2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/canvas.py"}, "region": {"startLine": 458}}}]}, {"ruleId": "scanner-71764af2fb080cb3", "level": "error", "message": {"text": "FastAPI DELETE `undo_last_edit` without auth dependency \u2014 app/api/routes/canvas.py:573"}, "properties": {"repobilityId": "cbf71b548bda710b", "scanner": "scanner-primary", "fingerprint": "71764af2fb080cb3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/canvas.py"}, "region": {"startLine": 573}}}]}, {"ruleId": "scanner-cad68678a1484d16", "level": "error", "message": {"text": "FastAPI POST `governance_action` without auth dependency \u2014 app/api/routes/canvas.py:620"}, "properties": {"repobilityId": "e75e00711d01d75c", "scanner": "scanner-primary", "fingerprint": "cad68678a1484d16", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/canvas.py"}, "region": {"startLine": 620}}}]}, {"ruleId": "scanner-037744a1149c19ab", "level": "error", "message": {"text": "FastAPI DELETE `close_session` without auth dependency \u2014 app/api/routes/canvas.py:656"}, "properties": {"repobilityId": "2a4c1406bad083a7", "scanner": "scanner-primary", "fingerprint": "037744a1149c19ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/api/routes/canvas.py"}, "region": {"startLine": 656}}}]}, {"ruleId": "scanner-59f45351017a2161", "level": "note", "message": {"text": "Unused endpoint: GET /query"}, "properties": {"repobilityId": "4bd388fd6077a316", "scanner": "scanner-primary", "fingerprint": "59f45351017a2161", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "deeaf4417cf02de2", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dc803b21c370d227", "level": "note", "message": {"text": "Unused endpoint: GET /resurfacing/bundle/{bundle_id}"}, "properties": {"repobilityId": "e1574b5727e689b9", "scanner": "scanner-primary", "fingerprint": "dc803b21c370d227", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5aaa0593b4a16270", "level": "note", "message": {"text": "Unused endpoint: GET /settings/validate"}, "properties": {"repobilityId": "bd6f2b5eaa621603", "scanner": "scanner-primary", "fingerprint": "5aaa0593b4a16270", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0f1c8067b4638eb", "level": "note", "message": {"text": "Unused endpoint: POST /p0"}, "properties": {"repobilityId": "ef78e7c73cc0df08", "scanner": "scanner-primary", "fingerprint": "d0f1c8067b4638eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e1fadad2500f063", "level": "note", "message": {"text": "Unused endpoint: POST /ask"}, "properties": {"repobilityId": "58f1d5e708440b29", "scanner": "scanner-primary", "fingerprint": "8e1fadad2500f063", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e26074453f93d403", "level": "note", "message": {"text": "Unused endpoint: POST /confirm"}, "properties": {"repobilityId": "cb128ac521be6bc5", "scanner": "scanner-primary", "fingerprint": "e26074453f93d403", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c22b5267aff4cb8", "level": "note", "message": {"text": "Unused endpoint: POST /checkbox-projection"}, "properties": {"repobilityId": "09e2d68a1cbf62ed", "scanner": "scanner-primary", "fingerprint": "5c22b5267aff4cb8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f1ea12f4f4d7510", "level": "note", "message": {"text": "Unused endpoint: GET /panel"}, "properties": {"repobilityId": "e31029a1577d719e", "scanner": "scanner-primary", "fingerprint": "1f1ea12f4f4d7510", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00c3b9f3a634611f", "level": "note", "message": {"text": "Unused endpoint: GET /vault/context"}, "properties": {"repobilityId": "b277b84b466891b4", "scanner": "scanner-primary", "fingerprint": "00c3b9f3a634611f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-279a13bcc90f633e", "level": "note", "message": {"text": "Unused endpoint: POST /vault/select"}, "properties": {"repobilityId": "0641a28b4ab1060e", "scanner": "scanner-primary", "fingerprint": "279a13bcc90f633e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fd4a55447cbf3f7", "level": "note", "message": {"text": "Unused endpoint: GET /now"}, "properties": {"repobilityId": "b3494446054740b3", "scanner": "scanner-primary", "fingerprint": "4fd4a55447cbf3f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e70f1d3cd16bb23", "level": "note", "message": {"text": "Unused endpoint: POST /vault/initialize"}, "properties": {"repobilityId": "e1aefd374aa0f752", "scanner": "scanner-primary", "fingerprint": "3e70f1d3cd16bb23", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-09528ebc35527a89", "level": "note", "message": {"text": "Unused endpoint: POST /vault/reload"}, "properties": {"repobilityId": "97c9d8b22945532e", "scanner": "scanner-primary", "fingerprint": "09528ebc35527a89", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07611596220e09f2", "level": "note", "message": {"text": "Unused endpoint: GET /vault/settings"}, "properties": {"repobilityId": "a0dedac282e0e359", "scanner": "scanner-primary", "fingerprint": "07611596220e09f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-25171c4184dda9cc", "level": "note", "message": {"text": "Unused endpoint: POST /vault/settings"}, "properties": {"repobilityId": "fbcbe9c21a2f3908", "scanner": "scanner-primary", "fingerprint": "25171c4184dda9cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4415534a91e68b3", "level": "note", "message": {"text": "Unused endpoint: GET /vault/notes"}, "properties": {"repobilityId": "c33b542a0ed366d3", "scanner": "scanner-primary", "fingerprint": "f4415534a91e68b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8082f16456379e87", "level": "note", "message": {"text": "Unused endpoint: GET /vault-browser"}, "properties": {"repobilityId": "829b87e7b0155b8c", "scanner": "scanner-primary", "fingerprint": "8082f16456379e87", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-665f98f7daa59364", "level": "note", "message": {"text": "Unused endpoint: GET /vault-link-index"}, "properties": {"repobilityId": "44e96432a417999e", "scanner": "scanner-primary", "fingerprint": "665f98f7daa59364", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ba6e3ba6de695ac", "level": "note", "message": {"text": "Unused endpoint: GET /vault-related"}, "properties": {"repobilityId": "62e994fec715ba17", "scanner": "scanner-primary", "fingerprint": "9ba6e3ba6de695ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e89a0451b653dca", "level": "note", "message": {"text": "Unused endpoint: POST /vault-browser/actions/queue-review"}, "properties": {"repobilityId": "ad9263af1cb195b2", "scanner": "scanner-primary", "fingerprint": "0e89a0451b653dca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c6affd4e4fba8b6", "level": "note", "message": {"text": "Unused endpoint: GET /orientation"}, "properties": {"repobilityId": "472bcef2b1f51e89", "scanner": "scanner-primary", "fingerprint": "6c6affd4e4fba8b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0538d5f571390c7e", "level": "note", "message": {"text": "Unused endpoint: POST /tts/plan"}, "properties": {"repobilityId": "03e2e27f07454445", "scanner": "scanner-primary", "fingerprint": "0538d5f571390c7e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-232d1ce5ec5453d2", "level": "note", "message": {"text": "Unused endpoint: POST /tts/synthesize"}, "properties": {"repobilityId": "946a2cd92b44dcdd", "scanner": "scanner-primary", "fingerprint": "232d1ce5ec5453d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f27f82397fbd7a1", "level": "note", "message": {"text": "Unused endpoint: GET /tts/status"}, "properties": {"repobilityId": "d152249cc01d9446", "scanner": "scanner-primary", "fingerprint": "4f27f82397fbd7a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-663607a0de8ee3fc", "level": "note", "message": {"text": "Unused endpoint: GET /tts/audio/{cache_key}.wav"}, "properties": {"repobilityId": "35d9f88ac0d1d9db", "scanner": "scanner-primary", "fingerprint": "663607a0de8ee3fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9faede0f90ece4bf", "level": "note", "message": {"text": "Unused endpoint: GET /workspace"}, "properties": {"repobilityId": "38daf470607b9e4a", "scanner": "scanner-primary", "fingerprint": "9faede0f90ece4bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b6c2749390a86c7", "level": "note", "message": {"text": "Unused endpoint: POST /workspace/update"}, "properties": {"repobilityId": "1af23212747a6acd", "scanner": "scanner-primary", "fingerprint": "8b6c2749390a86c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8da65e25f3c62634", "level": "note", "message": {"text": "Unused endpoint: POST /workspace/body"}, "properties": {"repobilityId": "6fded290ca2e5168", "scanner": "scanner-primary", "fingerprint": "8da65e25f3c62634", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eac41963b8323533", "level": "note", "message": {"text": "Unused endpoint: POST /note/save"}, "properties": {"repobilityId": "63e2898131c8dde0", "scanner": "scanner-primary", "fingerprint": "eac41963b8323533", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9db4d222c78f7266", "level": "note", "message": {"text": "Unused endpoint: GET /memory/review-queue"}, "properties": {"repobilityId": "88481c91883520ef", "scanner": "scanner-primary", "fingerprint": "9db4d222c78f7266", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-88872555d37ad4bb", "level": "note", "message": {"text": "Unused endpoint: POST /memory/review-queue/{candidate_id}/decision"}, "properties": {"repobilityId": "130ae52a1d8d7156", "scanner": "scanner-primary", "fingerprint": "88872555d37ad4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-70b45ca07e062a93", "level": "note", "message": {"text": "Unused endpoint: POST /capture"}, "properties": {"repobilityId": "f5cbe27a4bebc800", "scanner": "scanner-primary", "fingerprint": "70b45ca07e062a93", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a300923b068adcba", "level": "note", "message": {"text": "Unused endpoint: GET /records"}, "properties": {"repobilityId": "7edffd50c76479e9", "scanner": "scanner-primary", "fingerprint": "a300923b068adcba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4d546e4c0bfaf0c7", "level": "note", "message": {"text": "Unused endpoint: GET /records/{record_id}"}, "properties": {"repobilityId": "7a09396c31ca03df", "scanner": "scanner-primary", "fingerprint": "4d546e4c0bfaf0c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b3c3f1b1bd941a5", "level": "note", "message": {"text": "Unused endpoint: POST /worklogs"}, "properties": {"repobilityId": "6f7080d280abf028", "scanner": "scanner-primary", "fingerprint": "8b3c3f1b1bd941a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94e24475cf0f3122", "level": "note", "message": {"text": "Unused endpoint: POST /learning-signals"}, "properties": {"repobilityId": "f60c34ebc6a331aa", "scanner": "scanner-primary", "fingerprint": "94e24475cf0f3122", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7cafb1e50bf66210", "level": "note", "message": {"text": "Unused endpoint: POST /promotion-intents"}, "properties": {"repobilityId": "f1a89defe085e093", "scanner": "scanner-primary", "fingerprint": "7cafb1e50bf66210", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c121531c6b576fa", "level": "note", "message": {"text": "Unused endpoint: POST /receipts"}, "properties": {"repobilityId": "89ec8e901b416ef6", "scanner": "scanner-primary", "fingerprint": "9c121531c6b576fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-645141061095ac6a", "level": "note", "message": {"text": "Unused endpoint: GET /note"}, "properties": {"repobilityId": "b9d50123f7263a12", "scanner": "scanner-primary", "fingerprint": "645141061095ac6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-70ac484210c98514", "level": "note", "message": {"text": "Unused endpoint: GET /context-bundles/{bundle_id}"}, "properties": {"repobilityId": "dd61edb009f6baa0", "scanner": "scanner-primary", "fingerprint": "70ac484210c98514", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1aece0f30392555d", "level": "note", "message": {"text": "Unused endpoint: GET /events/tail"}, "properties": {"repobilityId": "ab52340505c998e3", "scanner": "scanner-primary", "fingerprint": "1aece0f30392555d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65a667bcc38fb792", "level": "note", "message": {"text": "Unused endpoint: POST /ingest"}, "properties": {"repobilityId": "4ec59faf68746616", "scanner": "scanner-primary", "fingerprint": "65a667bcc38fb792", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d16e4fa529c520e9", "level": "note", "message": {"text": "Unused endpoint: GET /search"}, "properties": {"repobilityId": "be553f7aa877eaec", "scanner": "scanner-primary", "fingerprint": "d16e4fa529c520e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d08923791ca241cd", "level": "note", "message": {"text": "Unused endpoint: GET /orientation/bundle/{bundle_id}"}, "properties": {"repobilityId": "60c48d91f7ab9a47", "scanner": "scanner-primary", "fingerprint": "d08923791ca241cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92efb2dc9205e7a4", "level": "note", "message": {"text": "Unused endpoint: POST /sessions"}, "properties": {"repobilityId": "d4ca08e66b28ed44", "scanner": "scanner-primary", "fingerprint": "92efb2dc9205e7a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb27932e560a9918", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/edits"}, "properties": {"repobilityId": "6ce2ff0a601d59f2", "scanner": "scanner-primary", "fingerprint": "eb27932e560a9918", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb0cf01d7d3c2a5f", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/coauthor"}, "properties": {"repobilityId": "5a63bfa982889c5d", "scanner": "scanner-primary", "fingerprint": "cb0cf01d7d3c2a5f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7cfb4a057b6e4a46", "level": "note", "message": {"text": "Unused endpoint: DELETE /sessions/{session_id}/edits/last"}, "properties": {"repobilityId": "5dd7c6431acf5f82", "scanner": "scanner-primary", "fingerprint": "7cfb4a057b6e4a46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e5826ae6bc5d9c7f", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/governance"}, "properties": {"repobilityId": "07dd088358a7b9bc", "scanner": "scanner-primary", "fingerprint": "e5826ae6bc5d9c7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}