{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ae9b674a98d1a1cc", "name": "Possibly dead Python function: parse_runs", "shortDescription": {"text": "Possibly dead Python function: parse_runs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fb286d70a42ab5e", "name": "Very large file: tests/test_slm.py (1106 lines)", "shortDescription": {"text": "Very large file: tests/test_slm.py (1106 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79b5e51fd1056339", "name": "Very large file: research/chain_test_v2.py (1644 lines)", "shortDescription": {"text": "Very large file: research/chain_test_v2.py (1644 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 475 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-909eb64265cce1c7", "name": "Agent authority lacks a verifier contract: .codex/hooks.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/hooks.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb21526c0ae0e511", "name": "Legacy-named symbol `slm_openai_v2` in tests/test_slm.py:570", "shortDescription": {"text": "Legacy-named symbol `slm_openai_v2` in tests/test_slm.py:570"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ca40eeaa0452d60", "name": "Legacy-named symbol `chain_test_v2` in tests/test_smoke_chain.py:43", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in tests/test_smoke_chain.py:43"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63176a67f232ca13", "name": "Legacy-named symbol `test_show_spec_no_spec_on_v1` in tests/test_cli.py:227", "shortDescription": {"text": "Legacy-named symbol `test_show_spec_no_spec_on_v1` in tests/test_cli.py:227"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc791fae43138dc9", "name": "Legacy-named symbol `chain_test_v2` in research/extra_raw_runs.py:18", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_raw_runs.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ced64a50ec52492b", "name": "Legacy-named symbol `chain_test_v2` in research/_test_quota_detector.py:15", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_quota_detector.py:15"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f627c260fde7525", "name": "Legacy-named symbol `chain_results_v2` in research/analyze_chain5_decay.py:3", "shortDescription": {"text": "Legacy-named symbol `chain_results_v2` in research/analyze_chain5_decay.py:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-565245c4501dd781", "name": "Legacy-named symbol `chain_test_v2` in research/extra_with_session_runs.py:18", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_with_session_runs.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c40c2154f9cd901", "name": "Legacy-named symbol `chain_results_v2` in research/chain1_recompute_skipping_run1.py:16", "shortDescription": {"text": "Legacy-named symbol `chain_results_v2` in research/chain1_recompute_skipping_run1.py:16"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75197ac41f0a2243", "name": "Legacy-named symbol `chain_test_v2` in research/_test_timeout_instrumentation.py:29", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_timeout_instrumentation.py:29"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ff2a23547fa00c1", "name": "Legacy-named symbol `chain_test_v2` in research/codex_interleave_isolation.py:22", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/codex_interleave_isolation.py:22"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd4b47c286b2f905", "name": "Legacy-named symbol `chain_test_v2` in research/extra_no_session_runs.py:18", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_no_session_runs.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae8b4fc922973429", "name": "Legacy-named symbol `chain_test_v2` in research/diagnose_t1.py:32", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/diagnose_t1.py:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8dee3af5eae0eea", "name": "Network/subprocess call without timeout or try/except \u2014 research/diagnose_t1.py:164", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 research/diagnose_t1.py:164"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-411722bc340f0d1b", "name": "Legacy-named symbol `chain_test_v2` in research/extra_stacked_runs.py:18", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_stacked_runs.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db94eff22dee03cc", "name": "Legacy-named symbol `chain_test_v2` in research/extra_gated_runs.py:21", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_gated_runs.py:21"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7bb479f9efb5211a", "name": "Legacy-named symbol `chain_test_v2` in research/chain_test.py:44", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/chain_test.py:44"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eaac3ed0d17e3d57", "name": "Commented-code block (7 lines) in research/chain_test.py:42", "shortDescription": {"text": "Commented-code block (7 lines) in research/chain_test.py:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b5c8a307495be8c", "name": "Network/subprocess call without timeout or try/except \u2014 research/chain_test.py:77", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 research/chain_test.py:77"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abd465f39fee86f6", "name": "Legacy-named symbol `chain_results_v2` in research/analyze_uncached_cost.py:19", "shortDescription": {"text": "Legacy-named symbol `chain_results_v2` in research/analyze_uncached_cost.py:19"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bda08ba5ded06ffd", "name": "Commented-code block (7 lines) in research/analyze_uncached_cost.py:57", "shortDescription": {"text": "Commented-code block (7 lines) in research/analyze_uncached_cost.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f086a47d4c2c1545", "name": "Legacy-named symbol `chain_test_v2` in research/_test_slm_native_wiring.py:18", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_slm_native_wiring.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0ed1bc4ed65165", "name": "Legacy-named symbol `chain_test_v2` in research/agentic_variety_test.py:126", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/agentic_variety_test.py:126"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-988f604a36e52134", "name": "Commented-code block (6 lines) in research/agentic_variety_test.py:98", "shortDescription": {"text": "Commented-code block (6 lines) in research/agentic_variety_test.py:98"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f6a7e49364cca6a", "name": "Network/subprocess call without timeout or try/except \u2014 research/agentic_variety_test.py:134", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 research/agentic_variety_test.py:134"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d46860b6e5e9bb6d", "name": "Legacy-named symbol `chain_test_v2` in research/_test_endstate_capture.py:2", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_endstate_capture.py:2"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9a2bcddbe54d57b", "name": "Legacy-named symbol `chain_results_v2` in research/chain_test_v2.py:23", "shortDescription": {"text": "Legacy-named symbol `chain_results_v2` in research/chain_test_v2.py:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-586ef769c248d8d4", "name": "Commented-code block (12 lines) in research/chain_test_v2.py:146", "shortDescription": {"text": "Commented-code block (12 lines) in research/chain_test_v2.py:146"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bfc45d30f8df1acc", "name": "Network/subprocess call without timeout or try/except \u2014 research/chain_test_v2.py:462", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 research/chain_test_v2.py:462"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-97ef5e7228612139", "name": "Legacy-named symbol `chain_test_v2` in research/score_endstate.py:6", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/score_endstate.py:6"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a47399b827b3783", "name": "Legacy-named symbol `chain_test_v2` in research/_test_usage_parser.py:8", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_usage_parser.py:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8395e2e4f9a84b1e", "name": "Legacy-named symbol `chain_test_v2` in research/extra_builtin_runs.py:18", "shortDescription": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_builtin_runs.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac580e4aa201d96c", "name": "Legacy-named symbol `slm_subscription_v2` in prpt/__init__.py:49", "shortDescription": {"text": "Legacy-named symbol `slm_subscription_v2` in prpt/__init__.py:49"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-232a6f5694d84485", "name": "Commented-code block (5 lines) in prpt/handoff.py:43", "shortDescription": {"text": "Commented-code block (5 lines) in prpt/handoff.py:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78f71fcc79672124", "name": "Network/subprocess call without timeout or try/except \u2014 prpt/_subprocess.py:60", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 prpt/_subprocess.py:60"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8b465a439e58297", "name": "Commented-code block (6 lines) in prpt/cli.py:584", "shortDescription": {"text": "Commented-code block (6 lines) in prpt/cli.py:584"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8671eb8437e10d5c", "name": "Commented-code block (6 lines) in prpt/adapters/shell.py:22", "shortDescription": {"text": "Commented-code block (6 lines) in prpt/adapters/shell.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-edf7d49aa3cf2795", "name": "Network/subprocess call without timeout or try/except \u2014 prpt/adapters/shell.py:156", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 prpt/adapters/shell.py:156"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd98e11ba8f712e5", "name": "Commented-code block (8 lines) in prpt/adapters/factory.py:134", "shortDescription": {"text": "Commented-code block (8 lines) in prpt/adapters/factory.py:134"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e5cfd210bd6b098", "name": "Commented-code block (6 lines) in prpt/normalizers/slm_openai_v2.py:107", "shortDescription": {"text": "Commented-code block (6 lines) in prpt/normalizers/slm_openai_v2.py:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dc707529b144b7e5", "name": "Legacy-named symbol `slm_openai_v2` in prpt/normalizers/base.py:270", "shortDescription": {"text": "Legacy-named symbol `slm_openai_v2` in prpt/normalizers/base.py:270"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c462bbdae3fac6f", "name": "Commented-code block (5 lines) in prpt/normalizers/base.py:288", "shortDescription": {"text": "Commented-code block (5 lines) in prpt/normalizers/base.py:288"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-013e6b88ee0acb45", "name": "Commented-code block (5 lines) in prpt/normalizers/slm_subscription.py:100", "shortDescription": {"text": "Commented-code block (5 lines) in prpt/normalizers/slm_subscription.py:100"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6b26770525129636", "name": "Commented-code block (7 lines) in prpt/judges/judge.py:279", "shortDescription": {"text": "Commented-code block (7 lines) in prpt/judges/judge.py:279"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8222918e61a42c7", "name": "Commented-code block (7 lines) in prpt/judges/slm.py:61", "shortDescription": {"text": "Commented-code block (7 lines) in prpt/judges/slm.py:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7923a0a68d0a469", "name": "Commented-code block (5 lines) in prpt/compress/tool_output.py:613", "shortDescription": {"text": "Commented-code block (5 lines) in prpt/compress/tool_output.py:613"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7c3388612267c96", "name": "Network/subprocess call without timeout or try/except \u2014 prpt/core/utils.py:81", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 prpt/core/utils.py:81"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9996447513897762", "name": "30 env vars used in code but missing from .env.example", "shortDescription": {"text": "30 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APPDATA`, `CAPTURE_END_STATE`, `CAPTURE_END_STATE_PYTEST`, `CLAUDE_MODEL`, `CLAUDE_TIMEOUT_SEC`, `CODEX_MODEL`, `CODEX_TIMEOUT_SEC`, `DISABLE_MICROCOMPACT` + 22 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nresearch/analyze_chain5_decay.py:parse_range, research/analyze_chain4_gating.py:parse_range\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\n.claude/hooks/optimize_prompt.py:main, prpt/hooks/optimize_prompt.py:main, .codex/hooks/optimize_prompt.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20336"}, "properties": {"repository": "steyangdot/PromptPilot", "repoUrl": "https://github.com/steyangdot/PromptPilot", "branch": "main"}, "results": [{"ruleId": "scanner-ae9b674a98d1a1cc", "level": "note", "message": {"text": "Possibly dead Python function: parse_runs"}, "properties": {"repobilityId": "3b01dd279fec2568", "scanner": "scanner-primary", "fingerprint": "ae9b674a98d1a1cc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "research/chain1_recompute_skipping_run1.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd843b74d3963b06", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ff29596dff0eef0", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fde4c5793055812", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26eca5024249c767", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fb286d70a42ab5e", "level": "note", "message": {"text": "Very large file: tests/test_slm.py (1106 lines)"}, "properties": {"repobilityId": "8a008458db6a5221", "scanner": "scanner-primary", "fingerprint": "0fb286d70a42ab5e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79b5e51fd1056339", "level": "note", "message": {"text": "Very large file: research/chain_test_v2.py (1644 lines)"}, "properties": {"repobilityId": "4a02060a750c2215", "scanner": "scanner-primary", "fingerprint": "79b5e51fd1056339", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "29c69d237fcfed9c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "bccbc8e1602371e3", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "72c276c2884aa6be", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "a5ff1b50482eb392", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-909eb64265cce1c7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/hooks.json"}, "properties": {"repobilityId": "6befa6c7c9baca08", "scanner": "scanner-primary", "fingerprint": "909eb64265cce1c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/hooks.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb21526c0ae0e511", "level": "note", "message": {"text": "Legacy-named symbol `slm_openai_v2` in tests/test_slm.py:570"}, "properties": {"repobilityId": "ce8979e25ab6f9d6", "scanner": "scanner-primary", "fingerprint": "cb21526c0ae0e511", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5ca40eeaa0452d60", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in tests/test_smoke_chain.py:43"}, "properties": {"repobilityId": "cd0edbf2db7e2143", "scanner": "scanner-primary", "fingerprint": "5ca40eeaa0452d60", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-63176a67f232ca13", "level": "note", "message": {"text": "Legacy-named symbol `test_show_spec_no_spec_on_v1` in tests/test_cli.py:227"}, "properties": {"repobilityId": "9a61f114e4bb5617", "scanner": "scanner-primary", "fingerprint": "63176a67f232ca13", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cc791fae43138dc9", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_raw_runs.py:18"}, "properties": {"repobilityId": "a637dfc93d0053d5", "scanner": "scanner-primary", "fingerprint": "cc791fae43138dc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ced64a50ec52492b", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_quota_detector.py:15"}, "properties": {"repobilityId": "799fa85378798d83", "scanner": "scanner-primary", "fingerprint": "ced64a50ec52492b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8f627c260fde7525", "level": "note", "message": {"text": "Legacy-named symbol `chain_results_v2` in research/analyze_chain5_decay.py:3"}, "properties": {"repobilityId": "d05c61b9b089e422", "scanner": "scanner-primary", "fingerprint": "8f627c260fde7525", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-565245c4501dd781", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_with_session_runs.py:18"}, "properties": {"repobilityId": "4929d54e1b056f6a", "scanner": "scanner-primary", "fingerprint": "565245c4501dd781", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8c40c2154f9cd901", "level": "note", "message": {"text": "Legacy-named symbol `chain_results_v2` in research/chain1_recompute_skipping_run1.py:16"}, "properties": {"repobilityId": "f8d8185beafb823b", "scanner": "scanner-primary", "fingerprint": "8c40c2154f9cd901", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-75197ac41f0a2243", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_timeout_instrumentation.py:29"}, "properties": {"repobilityId": "5d2a8a192bd82cfa", "scanner": "scanner-primary", "fingerprint": "75197ac41f0a2243", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5ff2a23547fa00c1", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/codex_interleave_isolation.py:22"}, "properties": {"repobilityId": "64e5e80059b2ac47", "scanner": "scanner-primary", "fingerprint": "5ff2a23547fa00c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cd4b47c286b2f905", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_no_session_runs.py:18"}, "properties": {"repobilityId": "f0e7b535a36c2ff2", "scanner": "scanner-primary", "fingerprint": "cd4b47c286b2f905", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ae8b4fc922973429", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/diagnose_t1.py:32"}, "properties": {"repobilityId": "84368f52709c10a1", "scanner": "scanner-primary", "fingerprint": "ae8b4fc922973429", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b8dee3af5eae0eea", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 research/diagnose_t1.py:164"}, "properties": {"repobilityId": "dc97d9aa1cc8871a", "scanner": "scanner-primary", "fingerprint": "b8dee3af5eae0eea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-411722bc340f0d1b", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_stacked_runs.py:18"}, "properties": {"repobilityId": "b711ed2f694cfd6f", "scanner": "scanner-primary", "fingerprint": "411722bc340f0d1b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-db94eff22dee03cc", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_gated_runs.py:21"}, "properties": {"repobilityId": "a2c09d737d78c50d", "scanner": "scanner-primary", "fingerprint": "db94eff22dee03cc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7bb479f9efb5211a", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/chain_test.py:44"}, "properties": {"repobilityId": "4a459b69ad2232d2", "scanner": "scanner-primary", "fingerprint": "7bb479f9efb5211a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-eaac3ed0d17e3d57", "level": "none", "message": {"text": "Commented-code block (7 lines) in research/chain_test.py:42"}, "properties": {"repobilityId": "7428db4aace1112a", "scanner": "scanner-primary", "fingerprint": "eaac3ed0d17e3d57", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b5c8a307495be8c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 research/chain_test.py:77"}, "properties": {"repobilityId": "e421fc688e230685", "scanner": "scanner-primary", "fingerprint": "9b5c8a307495be8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-abd465f39fee86f6", "level": "note", "message": {"text": "Legacy-named symbol `chain_results_v2` in research/analyze_uncached_cost.py:19"}, "properties": {"repobilityId": "4c6e9107dc263a99", "scanner": "scanner-primary", "fingerprint": "abd465f39fee86f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bda08ba5ded06ffd", "level": "none", "message": {"text": "Commented-code block (7 lines) in research/analyze_uncached_cost.py:57"}, "properties": {"repobilityId": "5eb3166168a05967", "scanner": "scanner-primary", "fingerprint": "bda08ba5ded06ffd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f086a47d4c2c1545", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_slm_native_wiring.py:18"}, "properties": {"repobilityId": "527ef4b20b3a90bd", "scanner": "scanner-primary", "fingerprint": "f086a47d4c2c1545", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2d0ed1bc4ed65165", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/agentic_variety_test.py:126"}, "properties": {"repobilityId": "7f3261974fc8b975", "scanner": "scanner-primary", "fingerprint": "2d0ed1bc4ed65165", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-988f604a36e52134", "level": "none", "message": {"text": "Commented-code block (6 lines) in research/agentic_variety_test.py:98"}, "properties": {"repobilityId": "e776ec288aa88e0b", "scanner": "scanner-primary", "fingerprint": "988f604a36e52134", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f6a7e49364cca6a", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 research/agentic_variety_test.py:134"}, "properties": {"repobilityId": "7c7b689c6bcbafa5", "scanner": "scanner-primary", "fingerprint": "8f6a7e49364cca6a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d46860b6e5e9bb6d", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_endstate_capture.py:2"}, "properties": {"repobilityId": "3849cebb4637f3eb", "scanner": "scanner-primary", "fingerprint": "d46860b6e5e9bb6d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f9a2bcddbe54d57b", "level": "note", "message": {"text": "Legacy-named symbol `chain_results_v2` in research/chain_test_v2.py:23"}, "properties": {"repobilityId": "e3f6b8a61639ee8a", "scanner": "scanner-primary", "fingerprint": "f9a2bcddbe54d57b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-586ef769c248d8d4", "level": "none", "message": {"text": "Commented-code block (12 lines) in research/chain_test_v2.py:146"}, "properties": {"repobilityId": "bfc506c573b55d68", "scanner": "scanner-primary", "fingerprint": "586ef769c248d8d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bfc45d30f8df1acc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 research/chain_test_v2.py:462"}, "properties": {"repobilityId": "ba36fb492a0eb9cb", "scanner": "scanner-primary", "fingerprint": "bfc45d30f8df1acc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-97ef5e7228612139", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/score_endstate.py:6"}, "properties": {"repobilityId": "34c92b16f77dcb16", "scanner": "scanner-primary", "fingerprint": "97ef5e7228612139", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6a47399b827b3783", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/_test_usage_parser.py:8"}, "properties": {"repobilityId": "35d321fa8289fce5", "scanner": "scanner-primary", "fingerprint": "6a47399b827b3783", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8395e2e4f9a84b1e", "level": "note", "message": {"text": "Legacy-named symbol `chain_test_v2` in research/extra_builtin_runs.py:18"}, "properties": {"repobilityId": "d8ab4ead589b24d8", "scanner": "scanner-primary", "fingerprint": "8395e2e4f9a84b1e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ac580e4aa201d96c", "level": "note", "message": {"text": "Legacy-named symbol `slm_subscription_v2` in prpt/__init__.py:49"}, "properties": {"repobilityId": "c70ff5732d62534b", "scanner": "scanner-primary", "fingerprint": "ac580e4aa201d96c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-232a6f5694d84485", "level": "none", "message": {"text": "Commented-code block (5 lines) in prpt/handoff.py:43"}, "properties": {"repobilityId": "6036a54b0301b132", "scanner": "scanner-primary", "fingerprint": "232a6f5694d84485", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78f71fcc79672124", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 prpt/_subprocess.py:60"}, "properties": {"repobilityId": "7802e0912491556f", "scanner": "scanner-primary", "fingerprint": "78f71fcc79672124", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b8b465a439e58297", "level": "none", "message": {"text": "Commented-code block (6 lines) in prpt/cli.py:584"}, "properties": {"repobilityId": "993695a2b5b707c9", "scanner": "scanner-primary", "fingerprint": "b8b465a439e58297", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8671eb8437e10d5c", "level": "none", "message": {"text": "Commented-code block (6 lines) in prpt/adapters/shell.py:22"}, "properties": {"repobilityId": "27b5a71d7301be31", "scanner": "scanner-primary", "fingerprint": "8671eb8437e10d5c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-edf7d49aa3cf2795", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 prpt/adapters/shell.py:156"}, "properties": {"repobilityId": "90bd31b8f45f0393", "scanner": "scanner-primary", "fingerprint": "edf7d49aa3cf2795", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bd98e11ba8f712e5", "level": "none", "message": {"text": "Commented-code block (8 lines) in prpt/adapters/factory.py:134"}, "properties": {"repobilityId": "0e737d2169eb4714", "scanner": "scanner-primary", "fingerprint": "bd98e11ba8f712e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e5cfd210bd6b098", "level": "none", "message": {"text": "Commented-code block (6 lines) in prpt/normalizers/slm_openai_v2.py:107"}, "properties": {"repobilityId": "a52ae2a34fa0f996", "scanner": "scanner-primary", "fingerprint": "8e5cfd210bd6b098", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dc707529b144b7e5", "level": "note", "message": {"text": "Legacy-named symbol `slm_openai_v2` in prpt/normalizers/base.py:270"}, "properties": {"repobilityId": "a67f2a73bd7f5bb8", "scanner": "scanner-primary", "fingerprint": "dc707529b144b7e5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0c462bbdae3fac6f", "level": "none", "message": {"text": "Commented-code block (5 lines) in prpt/normalizers/base.py:288"}, "properties": {"repobilityId": "1eb86efe1774f54b", "scanner": "scanner-primary", "fingerprint": "0c462bbdae3fac6f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-013e6b88ee0acb45", "level": "none", "message": {"text": "Commented-code block (5 lines) in prpt/normalizers/slm_subscription.py:100"}, "properties": {"repobilityId": "a708d5533bc9b6ac", "scanner": "scanner-primary", "fingerprint": "013e6b88ee0acb45", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6b26770525129636", "level": "none", "message": {"text": "Commented-code block (7 lines) in prpt/judges/judge.py:279"}, "properties": {"repobilityId": "1d79ec466ebb0ea6", "scanner": "scanner-primary", "fingerprint": "6b26770525129636", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8222918e61a42c7", "level": "none", "message": {"text": "Commented-code block (7 lines) in prpt/judges/slm.py:61"}, "properties": {"repobilityId": "42037bf5349a3ca4", "scanner": "scanner-primary", "fingerprint": "f8222918e61a42c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e7923a0a68d0a469", "level": "none", "message": {"text": "Commented-code block (5 lines) in prpt/compress/tool_output.py:613"}, "properties": {"repobilityId": "478c980f8692a145", "scanner": "scanner-primary", "fingerprint": "e7923a0a68d0a469", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7c3388612267c96", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 prpt/core/utils.py:81"}, "properties": {"repobilityId": "bae1bb28424d40c0", "scanner": "scanner-primary", "fingerprint": "f7c3388612267c96", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9996447513897762", "level": "note", "message": {"text": "30 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "b3285186f72a5bb9", "scanner": "scanner-primary", "fingerprint": "9996447513897762", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "386b0ffd14cde5c7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2d8de38ec39d217b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e4f545d6116f7864", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a6f4fa95785e79d9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7ddbe1436af501bd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6b3ae64031034cb8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "5f6df56afdcf84cf", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4d084e5e644652ca", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4631fe3a5cb1409b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2f44fe90c8346c63", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "15d914d2e3974b0e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3b70fa61437403f7", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b166cf57080a06b6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6072fe65f34b8000", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ab91886ed12b398a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "32299c00073444bc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}