{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "foundry_unresolved_feedback", "name": "Foundry mined unresolved feedback: xona-labs/xpay", "shortDescription": {"text": "Foundry mined unresolved feedback: xona-labs/xpay"}, "fullDescription": {"text": "Graph query export: Human feedback without linked fix evidence\nQuery id: unresolved_feedback\nQuery type: motif_query\nIntent: Negative/unresolved examples that should not be hallucinated into fixes.\nMotif: unlinked_feedback_needs_evidence\nTraining usage: negative_or_unresolved\nGraph gold label: needs_more_evidence\nRepo: xona-labs/xpay\nThread: xona-labs/xpay#1\nEvidence:\nGraph motif: Human feedback exists without a linked fix\nMotif id: unlinked_feedback_needs_evidence\nPolarity: bad\nTraining usage: negative_or_unresolved\nSeverity: medium\nRepo: xona-labs/xpay\nThread: xona-labs/xpay#1\nGraph gold label: needs_more_evidence\nThread graph evidence:\nGitHub issue/PR evidence subgraph\nThread: xona-labs/xpay#1\nRepo: xona-labs/xpay\nIssue/PR number: 1\nGraph consistency label: needs_more_evidence\nNodes: 9\nEdges: 11\nNode types: {'link_quality': 3, 'thread': 1, 'repo': 1, 'comment': 1, 'comment_chain': 1, 'issue_chain': 1, 'fix_outcome': 1}\nEdge types: {'chain_has_link_quality': 3, 'repo_has_thread': 1, "}, "properties": {"scanner": "foundry_dataset", "category": "practices", "severity": "medium", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "foundry_bad_chain", "name": "Foundry mined bad chains: xona-labs/xpay", "shortDescription": {"text": "Foundry mined bad chains: xona-labs/xpay"}, "fullDescription": {"text": "Comment chain pattern product: bad_chains\nRepo: xona-labs/xpay\nThread: xona-labs/xpay#1\nOutcome: not_resolved_or_not_observed\nThread label: thread_has_human_issue_without_fix_context\nSource graph label: source_artifact_without_verification_graph\nReasons: source_graph_has_real_artifacts, link_quality_unresolved\nChain evidence:\nIssue/PR evidence chain: xona-labs/xpay#1\nRepo: xona-labs/xpay\nThread label: thread_has_human_issue_without_fix_context\nOutcome: not_resolved_or_not_observed\nComment count: 1\nLinked commit count: 0\nLinked CI commit count: 0\nLinked CI labels: {}\nChanged file count: 0\nLabels: {'agent_instruction_gap': 1}\nPolarities: {'bad': 1}\nChanged file labels: {}\nExamples:\n[\n  {\n    \"id\": \"github-feedback-comment-898d4a591d529625\",\n    \"kind\": \"issue_body\",\n    \"label\": \"agent_instruction_gap\",\n    \"polarity\": \"bad\",\n    \"url\": \"https://github.com/xona-labs/xpay/issues/1\",\n    \"text\": \"GitHub feedback: agent_instruction_gap\\nPolarity: bad\\nKind: issue_body\\nRepo: xona-labs/xpay\\"}, "properties": {"scanner": "foundry_dataset", "category": "practices", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "scanner-e372c14ff960e812", "name": "Stray `console.log` in TS/JS \u2014 examples/claude-agent.ts:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/claude-agent.ts:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f6f34733b62a441", "name": "Stray `console.log` in TS/JS \u2014 examples/discover-and-pay.ts:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/discover-and-pay.ts:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40a4da60c1c8fd01", "name": "Stray `console.log` in TS/JS \u2014 src/cli/discover.ts:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/discover.ts:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9add8a6621b0108d", "name": "Stray `console.log` in TS/JS \u2014 src/cli/init.ts:93", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/init.ts:93"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72982b64fb4aceb0", "name": "Stray `console.log` in TS/JS \u2014 src/cli/transfer.ts:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/transfer.ts:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50207f6df9d537ec", "name": "Stray `console.log` in TS/JS \u2014 src/cli/history.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/history.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87897da42fd28d4e", "name": "Stray `console.log` in TS/JS \u2014 src/cli/accounts.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/accounts.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1e7266e2cd75525", "name": "Stray `console.log` in TS/JS \u2014 src/cli/guardrail.ts:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/guardrail.ts:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e0a8bbe344a58bb", "name": "Stray `console.log` in TS/JS \u2014 src/cli/biometric.ts:82", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/biometric.ts:82"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9fed897f8c64553", "name": "Stray `console.log` in TS/JS \u2014 src/cli/balance.ts:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/balance.ts:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a428f21159ce2a2f", "name": "Stray `console.log` in TS/JS \u2014 src/cli/pay.ts:66", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/pay.ts:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d1158e831188e5e", "name": "Stray `console.log` in TS/JS \u2014 src/cli/magicblock.ts:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/magicblock.ts:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f09baaf08269165", "name": "Stray `console.log` in TS/JS \u2014 src/cli/sana.ts:37", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/sana.ts:37"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7f85fae7924a464", "name": "Stray `console.log` in TS/JS \u2014 src/cli/common.ts:88", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/common.ts:88"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9ca32a09b9c95ce", "name": "Stray `console.log` in TS/JS \u2014 src/profile/index.ts:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/profile/index.ts:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-58ab59fa19e3500f", "name": "Insecure pattern 'node_child_process' in src/biometric/index.ts:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/biometric/index.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 47 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 165 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d3707070f246e5d0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/magicblock/client.ts:234", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/magicblock/client.ts:234"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81a2d1090e932b76", "name": "Commented-code block (5 lines) in src/transfer/index.ts:202", "shortDescription": {"text": "Commented-code block (5 lines) in src/transfer/index.ts:202"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ef2d5285edfa394f", "name": "Commented-code block (5 lines) in src/x402/svm-payment.ts:62", "shortDescription": {"text": "Commented-code block (5 lines) in src/x402/svm-payment.ts:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23049"}, "properties": {"repository": "xona-labs/xpay", "repoUrl": "https://github.com/xona-labs/xpay", "branch": "main"}, "results": [{"ruleId": "foundry_unresolved_feedback", "level": "warning", "message": {"text": "Foundry mined unresolved feedback: xona-labs/xpay"}, "properties": {"repobilityId": 371400, "scanner": "foundry_dataset", "fingerprint": "cfbea5a822416eeedf15b09d36f1ca6b153191fc7818f10c272932b6c1be7f45", "category": "practices", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Imported from mined Foundry/Fable5 evidence with real GitHub/source provenance. Review source_id before acting.", "evidence": {"meta": {"kind": "graph_query_record", "title": "Human feedback without linked fix evidence", "intent": "Negative/unresolved examples that should not be hallucinated into fixes.", "labels": {"agent_instruction_gap": 1, "issue_or_pull_request_thread": 1, "not_resolved_or_not_observed": 3, "human_reported_issue_no_linked_fix": 1, "thread_has_human_issue_without_fix_context": 2}, "source": "graph_query_export", "motif_id": "unlinked_feedback_needs_evidence", "outcomes": {"not_resolved_or_not_observed": 6}, "polarity": "bad", "query_id": "unresolved_feedback", "severity": "medium", "ci_labels": {}, "synthetic": false, "edge_count": 11, "edge_types": {"repo_has_thread": 1, "comment_has_chain": 1, "thread_has_comment": 1, "chain_has_link_quality": 3, "thread_has_fix_outcome": 1, "thread_has_issue_chain": 1, "thread_has_comment_chain": 1, "issue_chain_has_fix_outcome": 1, "issue_chain_has_comment_chain": 1}, "node_count": 9, "node_types": {"repo": 1, "thread": 1, "comment": 1, "fix_outcome": 1, "issue_chain": 1, "link_quality": 3, "comment_chain": 1}, "query_type": "motif_query", "thread_key": "xona-labs/xpay#1", "issue_number": "1", "quality_tiers": {"unresolved": 3}, "repo_full_name": "xona-labs/xpay", "training_usage": "negative_or_unresolved", "source_motif_id": "graph-pattern-motif-thread-f38745288075704b", "graph_gold_label": "needs_more_evidence", "changed_file_labels": {}}, "text": "Graph query export: Human feedback without linked fix evidence\nQuery id: unresolved_feedback\nQuery type: motif_query\nIntent: Negative/unresolved examples that should not be hallucinated into fixes.\nMotif: unlinked_feedback_needs_evidence\nTraining usage: negative_or_unresolved\nGraph gold label: needs_more_evidence\nRepo: xona-labs/xpay\nThread: xona-labs/xpay#1\nEvidence:\nGraph motif: Human feedback exists without a linked fix\nMotif id: unlinked_feedback_needs_evidence\nPolarity: bad\nTraining usage: negative_or_unresolved\nSeverity: medium\nRepo: xona-labs/xpay\nThread: xona-labs/xpay#1\nGraph gold label: needs_more_evidence\nThread graph evidence:\nGitHub issue/PR evidence subgraph\nThread: xona-labs/xpay#1\nRepo: xona-labs/xpay\nIssue/PR number: 1\nGraph consistency label: needs_more_evidence\nNodes: 9\nEdges: 11\nNode types: {'link_quality': 3, 'thread': 1, 'repo': 1, 'comment': 1, 'comment_chain': 1, 'issue_chain': 1, 'fix_outcome': 1}\nEdge types: {'chain_has_link_quality': 3, 'repo_has_thread': 1, 'thread_has_comment': 1, 'thread_has_comment_chain': 1, 'comment_has_chain': 1, 'thread_has_issue_chain': 1, 'issue_chain_has_comment_chain': 1, 'thread_has_fix_outcome': 1, 'issue_chain_has_fix_outcome': 1}\nLabels: {'not_resolved_or_not_observed': 3, 'thread_has_human_issue_without_fix_context': 2, 'issue_or_pull_request_thread': 1, 'agent_instruction_gap': 1, 'human_reported_issue_no_linked_fix': 1}\nOutcomes: {'not_resolved_or_not_observed': 6}\nQuality tiers: {'unresolved': 3}\nCI labels: {}\nCurriculum targets:\n- Teach models to preserve unresolved human feedback instead of hallucinating fixes.\n- Build issue-to-regression examples where no accepted fix exists yet.\nAssumption checks:\n- Can a commit be linked by issue number, SHA, changed path, or time window?\n- If no link exists, is this explicitly labelled unresolved?", "source": "foundry_mined_dataset", "repo_url": "https://github.com/xona-labs/xpay", "source_id": "graph-query-motif_query-4fbca8993d104fc3", "synthetic": false, "gold_label": "", "graph_label": "", "source_path": "/data/distillate/foundry_data/graph_queries/unresolved_feedback/shard-0.jsonl", "bundle_label": "", "priority_band": "", "priority_score": 0, "repo_full_name": "xona-labs/xpay", "source_dataset": "graph_queries/unresolved_feedback", "training_usage": "negative_or_unresolved"}}}, {"ruleId": "foundry_bad_chain", "level": "error", "message": {"text": "Foundry mined bad chains: xona-labs/xpay"}, "properties": {"repobilityId": 323860, "scanner": "foundry_dataset", "fingerprint": "e30d2e265040a87da07d2bb35d1b477ce58af3aa471c186eb3dbe824df6295aa", "category": "practices", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Imported from mined Foundry/Fable5 evidence with real GitHub/source provenance. Review source_id before acting.", "evidence": {"meta": {"kind": "comment_chain_pattern_product", "source": "comment_chain_pattern_miner", "product": "bad_chains", "synthetic": false, "thread_key": "xona-labs/xpay#1", "human_labels": ["agent_instruction_gap"], "issue_number": "1", "thread_label": "thread_has_human_issue_without_fix_context", "outcome_label": "not_resolved_or_not_observed", "source_backed": true, "max_confidence": 0.0, "repo_full_name": "xona-labs/xpay", "training_usage": "negative_or_unresolved", "confidence_tier": "unresolved", "source_chain_id": "evidence-chain-issue_chain-6b06ddab35862e94", "helicopter_views": {}, "artifact_families": {"docs": 1}, "source_chain_kind": "issue_chain", "changed_file_count": 0, "source_graph_label": "source_artifact_without_verification_graph", "changed_file_labels": {}, "linked_commit_count": 0, "helicopter_view_count": 0, "source_artifact_count": 1, "classification_reasons": ["source_graph_has_real_artifacts", "link_quality_unresolved"], "linked_ci_commit_count": 0, "verification_artifact_count": 0, "design_schema_api_artifact_count": 0}, "text": "Comment chain pattern product: bad_chains\nRepo: xona-labs/xpay\nThread: xona-labs/xpay#1\nOutcome: not_resolved_or_not_observed\nThread label: thread_has_human_issue_without_fix_context\nSource graph label: source_artifact_without_verification_graph\nReasons: source_graph_has_real_artifacts, link_quality_unresolved\nChain evidence:\nIssue/PR evidence chain: xona-labs/xpay#1\nRepo: xona-labs/xpay\nThread label: thread_has_human_issue_without_fix_context\nOutcome: not_resolved_or_not_observed\nComment count: 1\nLinked commit count: 0\nLinked CI commit count: 0\nLinked CI labels: {}\nChanged file count: 0\nLabels: {'agent_instruction_gap': 1}\nPolarities: {'bad': 1}\nChanged file labels: {}\nExamples:\n[\n  {\n    \"id\": \"github-feedback-comment-898d4a591d529625\",\n    \"kind\": \"issue_body\",\n    \"label\": \"agent_instruction_gap\",\n    \"polarity\": \"bad\",\n    \"url\": \"https://github.com/xona-labs/xpay/issues/1\",\n    \"text\": \"GitHub feedback: agent_instruction_gap\\nPolarity: bad\\nKind: issue_body\\nRepo: xona-labs/xpay\\nAuthor: RenatoFloreon (User)\\nURL: https://github.com/xona-labs/xpay/issues/1\\nTitle: Conversion audit idea for xpay\\nBody:\\nHi xona-labs,\\n\\nI found xona-labs/xpay while reviewing agent/x402/devtool projects and ran a quick conversion-readiness pass on https://github.com/xona-labs/xpay.\\n\\nThe practical opportunity is to make the value proposition, CTA path, and proof easier to understand before a developer commits time or money.\\n- I noticed the current H1 is: \\\"Search code, repositories, users, issues, pull requests...\\\".\\n- There are 75 clickable CTA/link elements in the first scan.\\n\\nI sell a focused 24h audit for US$49: readable HTML report, structured JSON, and 3 prioritized quick wins.\\n\\nCheckout: https://buy.stripe.com/6oU3cx1O7cCE9jsgoF7bW01?product=floreon_audit_starter_49&lead=github%3Axona-labs%2Fxpay&target_url=https%3A%2F%2Fgithub.com%2Fxona-labs%2Fxpay\\n\\nIf this is not relevant, no worries.\\n\\nRenato / Floreon\"\n  }\n]\nChanged files:\n[]\nLinked chain ids:\n[\"evidence-chain-comment_to_commit-95042d414cba89a9\"]\nSource graph evidence:\nSource evidence repo graph summary\nRepo: xona-labs/xpay\nGraph label: source_artifact_without_verification_graph\nNodes: 5\nEdges: 6\nNode types: {\"cooccurrence_profile\": 1, \"github_repo_summary\": 1, \"repo\": 1, \"source_artifact\": 1, \"source_bundle\": 1}\nEdge types: {\"artifact_needs_claim_verification\": 1, \"repo_has_cooccurrence_profile\": 1, \"repo_has_github_evidence_summary\": 1, \"repo_has_source_artifact\": 1, \"repo_has_source_bundle\": 1, \"source_bundle_uses_cooccurrence_profile\": 1}\nArtifact families: {\"docs\": 1}\nHelicopter views: {}\nBundle labels: {\"source_backed_graph_pattern_bundle\": 1}\nCo-occurrence labels: {\"general_motif_cooccurrence\": 1}", "source": "foundry_mined_dataset", "repo_url": "https://github.com/xona-labs/xpay", "source_id": "comment-chain-pattern-bad_chains-dc01fdbba14869b5", "synthetic": false, "gold_label": "", "graph_label": "source_artifact_without_verification_graph", "source_path": "/data/distillate/foundry_data/comment_chain_patterns/bad_chains/shard-0.jsonl", "bundle_label": "", "priority_band": "", "priority_score": 0, "repo_full_name": "xona-labs/xpay", "source_dataset": "comment_chain_patterns/bad_chains", "training_usage": "negative_or_unresolved"}}}, {"ruleId": "scanner-e372c14ff960e812", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/claude-agent.ts:42"}, "properties": {"repobilityId": "b20d5ba14c2963f7", "scanner": "scanner-primary", "fingerprint": "e372c14ff960e812", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6f6f34733b62a441", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/discover-and-pay.ts:28"}, "properties": {"repobilityId": "1254584505ba1916", "scanner": "scanner-primary", "fingerprint": "6f6f34733b62a441", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-40a4da60c1c8fd01", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/discover.ts:32"}, "properties": {"repobilityId": "e733e8d360b42aa3", "scanner": "scanner-primary", "fingerprint": "40a4da60c1c8fd01", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9add8a6621b0108d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/init.ts:93"}, "properties": {"repobilityId": "773db9cb5e9d9f45", "scanner": "scanner-primary", "fingerprint": "9add8a6621b0108d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-72982b64fb4aceb0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/transfer.ts:62"}, "properties": {"repobilityId": "cfac2dfddeb80334", "scanner": "scanner-primary", "fingerprint": "72982b64fb4aceb0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-50207f6df9d537ec", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/history.ts:45"}, "properties": {"repobilityId": "b8248f668541bc2d", "scanner": "scanner-primary", "fingerprint": "50207f6df9d537ec", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-87897da42fd28d4e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/accounts.ts:38"}, "properties": {"repobilityId": "d91573f968962ae6", "scanner": "scanner-primary", "fingerprint": "87897da42fd28d4e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f1e7266e2cd75525", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/guardrail.ts:28"}, "properties": {"repobilityId": "0fd12e9a6b1666e7", "scanner": "scanner-primary", "fingerprint": "f1e7266e2cd75525", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1e0a8bbe344a58bb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/biometric.ts:82"}, "properties": {"repobilityId": "fa5be785976738d9", "scanner": "scanner-primary", "fingerprint": "1e0a8bbe344a58bb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a9fed897f8c64553", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/balance.ts:26"}, "properties": {"repobilityId": "cc0a652695bc5260", "scanner": "scanner-primary", "fingerprint": "a9fed897f8c64553", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a428f21159ce2a2f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/pay.ts:66"}, "properties": {"repobilityId": "656cb2c38efe1739", "scanner": "scanner-primary", "fingerprint": "a428f21159ce2a2f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8d1158e831188e5e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/magicblock.ts:33"}, "properties": {"repobilityId": "8dde389f40788101", "scanner": "scanner-primary", "fingerprint": "8d1158e831188e5e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8f09baaf08269165", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/sana.ts:37"}, "properties": {"repobilityId": "d7e0eefbf255f04c", "scanner": "scanner-primary", "fingerprint": "8f09baaf08269165", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a7f85fae7924a464", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/cli/common.ts:88"}, "properties": {"repobilityId": "4edc5940ce0e01ba", "scanner": "scanner-primary", "fingerprint": "a7f85fae7924a464", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c9ca32a09b9c95ce", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/profile/index.ts:9"}, "properties": {"repobilityId": "f4f1ceb897bd1604", "scanner": "scanner-primary", "fingerprint": "c9ca32a09b9c95ce", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-58ab59fa19e3500f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/biometric/index.ts:18"}, "properties": {"repobilityId": "a3c2a34bd66c6902", "scanner": "scanner-primary", "fingerprint": "58ab59fa19e3500f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/biometric/index.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "459cf9cb46b49eb2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "a7454c210c445fb5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "2923892fd1d600aa", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1e42abffe8e74303", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d34373d1a4bede58", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d3707070f246e5d0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/magicblock/client.ts:234"}, "properties": {"repobilityId": "51c726819be8a3f7", "scanner": "scanner-primary", "fingerprint": "d3707070f246e5d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-81a2d1090e932b76", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/transfer/index.ts:202"}, "properties": {"repobilityId": "04610ce3630bb4a2", "scanner": "scanner-primary", "fingerprint": "81a2d1090e932b76", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ef2d5285edfa394f", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/x402/svm-payment.ts:62"}, "properties": {"repobilityId": "71e85d6430641bc1", "scanner": "scanner-primary", "fingerprint": "ef2d5285edfa394f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}