{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3b1840ceaf186e3d", "name": "Possibly dead Python function: MatchingFor", "shortDescription": {"text": "Possibly dead Python function: MatchingFor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4c19fdb5fcf9d46", "name": "Possibly dead Python function: m_retype_scratch", "shortDescription": {"text": "Possibly dead Python function: m_retype_scratch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86a21416d6c11a36", "name": "Possibly dead Python function: m_reorder_decls", "shortDescription": {"text": "Possibly dead Python function: m_reorder_decls"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bab45bb90564c5a5", "name": "Possibly dead Python function: m_add_scratch", "shortDescription": {"text": "Possibly dead Python function: m_add_scratch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3a1fab18a38bf53", "name": "Possibly dead Python function: m_remove_scratch", "shortDescription": {"text": "Possibly dead Python function: m_remove_scratch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e0d091da15a7c2a", "name": "Possibly dead Python function: m_swap_cmp", "shortDescription": {"text": "Possibly dead Python function: m_swap_cmp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be050fbe3152ed4f", "name": "Possibly dead Python function: m_split_const", "shortDescription": {"text": "Possibly dead Python function: m_split_const"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2607b86d143a12d", "name": "Possibly dead Python function: m_cache_member", "shortDescription": {"text": "Possibly dead Python function: m_cache_member"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c726110b94b09f3", "name": "Possibly dead Python function: m_reassoc_base_chain", "shortDescription": {"text": "Possibly dead Python function: m_reassoc_base_chain"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-328e3804d94c71b2", "name": "Possibly dead Python function: m_dup_member_read", "shortDescription": {"text": "Possibly dead Python function: m_dup_member_read"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11959fc6404581b9", "name": "Possibly dead Python function: keep_flag", "shortDescription": {"text": "Possibly dead Python function: keep_flag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4696aab0dfba71f", "name": "Possibly dead Python function: unix_path", "shortDescription": {"text": "Possibly dead Python function: unix_path"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92e673b3df0eabe0", "name": "Possibly dead Python function: default_format", "shortDescription": {"text": "Possibly dead Python function: default_format"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fab6b578a8e38b62", "name": "Possibly dead Python function: subninja", "shortDescription": {"text": "Possibly dead Python function: subninja"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4ffc82634c59625", "name": "Possibly dead Python function: expand", "shortDescription": {"text": "Possibly dead Python function: expand"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8104c18fefe4ed0", "name": "Possibly dead Python function: exp", "shortDescription": {"text": "Possibly dead Python function: exp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-071a32741d92b126", "name": "Possibly dead Python function: binutils_url", "shortDescription": {"text": "Possibly dead Python function: binutils_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-649968f5debc6cc6", "name": "Possibly dead Python function: compilers_url", "shortDescription": {"text": "Possibly dead Python function: compilers_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2da7c556e0e9eca4", "name": "Possibly dead Python function: dtk_url", "shortDescription": {"text": "Possibly dead Python function: dtk_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-debd4f1c46304e04", "name": "Possibly dead Python function: objdiff_cli_url", "shortDescription": {"text": "Possibly dead Python function: objdiff_cli_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8db0092ce02cf81c", "name": "Possibly dead Python function: sjiswrap_url", "shortDescription": {"text": "Possibly dead Python function: sjiswrap_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f73ac4d94c3dc54b", "name": "Possibly dead Python function: wibo_url", "shortDescription": {"text": "Possibly dead Python function: wibo_url"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9236b0e098d0a1b6", "name": "Possibly dead Python function: nxt", "shortDescription": {"text": "Possibly dead Python function: nxt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d23fa077a16cac7", "name": "Possibly dead Python function: t_perm_add_self", "shortDescription": {"text": "Possibly dead Python function: t_perm_add_self"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-474a856266c19be9", "name": "Possibly dead Python function: t_cast_roundtrip", "shortDescription": {"text": "Possibly dead Python function: t_cast_roundtrip"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f67e91e13c63da0e", "name": "Possibly dead Python function: t_commute_cmp", "shortDescription": {"text": "Possibly dead Python function: t_commute_cmp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c4f65f45f23c327", "name": "Possibly dead Python function: t_scratch_temp", "shortDescription": {"text": "Possibly dead Python function: t_scratch_temp"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86ca7c7a12ed2d78", "name": "Possibly dead Python function: t_split_decl", "shortDescription": {"text": "Possibly dead Python function: t_split_decl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85342a1d77c482da", "name": "Possibly dead Python function: t_reassoc_add", "shortDescription": {"text": "Possibly dead Python function: t_reassoc_add"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b881f9203fc1e65", "name": "Insecure pattern 'exec_used' in tools/brute.py:9", "shortDescription": {"text": "Insecure pattern 'exec_used' in tools/brute.py:9"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ba9bfab5f283202", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd62886ed710e39a", "name": "Very large file: configure.py (1325 lines)", "shortDescription": {"text": "Very large file: configure.py (1325 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4644a687c4975a94", "name": "Very large file: tools/project.py (2085 lines)", "shortDescription": {"text": "Very large file: tools/project.py (2085 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "4 test file(s) for 58 source file(s) (ratio 0.07). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 497 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-786cd3671ec51236", "name": "Network/subprocess call without timeout or try/except \u2014 tools/sweep_compiler.py:18", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/sweep_compiler.py:18"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b6b1ff1f78e5d7b", "name": "Network/subprocess call without timeout or try/except \u2014 tools/asm_match.py:30", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/asm_match.py:30"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3cf3030b2f7415f", "name": "Network/subprocess call without timeout or try/except \u2014 tools/probe_regalloc.py:9", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/probe_regalloc.py:9"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c358f2ffc8fd76e", "name": "Network/subprocess call without timeout or try/except \u2014 tools/pragma_sweep.py:29", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/pragma_sweep.py:29"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5476553c04a7d6d7", "name": "Network/subprocess call without timeout or try/except \u2014 tools/chk.py:3", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/chk.py:3"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c64df7258135e751", "name": "Network/subprocess call without timeout or try/except \u2014 tools/permute_fn.py:20", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/permute_fn.py:20"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90f96b59169c3937", "name": "Legacy-named symbol `bruteforce_backup` in tools/bruteforce_alloc.py:621", "shortDescription": {"text": "Legacy-named symbol `bruteforce_backup` in tools/bruteforce_alloc.py:621"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4309a2238db8c91a", "name": "Network/subprocess call without timeout or try/except \u2014 tools/brute.py:20", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/brute.py:20"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08d4cd16d5f5115e", "name": "Legacy-named symbol `is_unused` in tools/extract_symbols.py:315", "shortDescription": {"text": "Legacy-named symbol `is_unused` in tools/extract_symbols.py:315"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44721cd996732f60", "name": "Network/subprocess call without timeout or try/except \u2014 tools/dumpdiff.py:7", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/dumpdiff.py:7"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84f70a1451015618", "name": "Network/subprocess call without timeout or try/except \u2014 tools/showdiff.py:6", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/showdiff.py:6"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06924f93c5c75024", "name": "Network/subprocess call without timeout or try/except \u2014 tools/brute_const_reg.py:11", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/brute_const_reg.py:11"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4f67fc490fdcd48", "name": "Network/subprocess call without timeout or try/except \u2014 tools/instr_align.py:17", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/instr_align.py:17"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-640e82cf30fda7c0", "name": "Network/subprocess call without timeout or try/except \u2014 tools/showall.py:7", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/showall.py:7"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bcdb3cba9abcc4c", "name": "Network/subprocess call without timeout or try/except \u2014 tools/cflag_sweep.py:62", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/cflag_sweep.py:62"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f31a53de8aab8bf", "name": "Network/subprocess call without timeout or try/except \u2014 tools/b1_struct_rank.py:8", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/b1_struct_rank.py:8"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82df344795062219", "name": "Network/subprocess call without timeout or try/except \u2014 tools/classify_diff.py:8", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/classify_diff.py:8"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe8c45e31fbadee1", "name": "Network/subprocess call without timeout or try/except \u2014 tools/download_tool.py:145", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/download_tool.py:145"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1771dc0afa3e6fd4", "name": "Legacy-named symbol `is_unused` in tools/map/map_index.py:92", "shortDescription": {"text": "Legacy-named symbol `is_unused` in tools/map/map_index.py:92"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b30a06e1eb5058", "name": "Legacy-named symbol `is_unused` in tools/map/claim_doctor.py:162", "shortDescription": {"text": "Legacy-named symbol `is_unused` in tools/map/claim_doctor.py:162"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17378215ce357544", "name": "Network/subprocess call without timeout or try/except \u2014 tools/map/claim_doctor.py:135", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/map/claim_doctor.py:135"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-906154e11735ab9c", "name": "Legacy-named symbol `is_unused` in tools/map/discrepancy.py:93", "shortDescription": {"text": "Legacy-named symbol `is_unused` in tools/map/discrepancy.py:93"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/attribute_symbols.py:parse_symbols, tools/map_bss_to_files.py:parse_symbols, tools/apply_section_claims.py:parse_symbols, tools/apply_incremental_claims.py:parse_symbols\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/apply_section_claims.py:get_compiled_section_size, tools/apply_incremental_claims.py:get_compiled_section_size, tools/map_sdata2_to_files.py:get_compiled_section_size, tools/fill_sdata2_gaps.py:get_compiled_section_size\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/decompctx.py:get_header_guard_key, tools/decompctx.py:get_header_guard_key\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntools/apply_incremental_claims.py:parse_splits, tools/fill_sdata2_gaps.py:parse_splits, tools/apply_safe_claims.py:parse_splits\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23557"}, "properties": {"repository": "zcanann/FFCC-Decomp", "repoUrl": "https://github.com/zcanann/FFCC-Decomp", "branch": "main"}, "results": [{"ruleId": "scanner-3b1840ceaf186e3d", "level": "note", "message": {"text": "Possibly dead Python function: MatchingFor"}, "properties": {"repobilityId": "d1535ab0532dee84", "scanner": "scanner-primary", "fingerprint": "3b1840ceaf186e3d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "configure.py:469"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4c19fdb5fcf9d46", "level": "note", "message": {"text": "Possibly dead Python function: m_retype_scratch"}, "properties": {"repobilityId": "2394e7fea4457377", "scanner": "scanner-primary", "fingerprint": "b4c19fdb5fcf9d46", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86a21416d6c11a36", "level": "note", "message": {"text": "Possibly dead Python function: m_reorder_decls"}, "properties": {"repobilityId": "64056defff1c36fa", "scanner": "scanner-primary", "fingerprint": "86a21416d6c11a36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:148"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bab45bb90564c5a5", "level": "note", "message": {"text": "Possibly dead Python function: m_add_scratch"}, "properties": {"repobilityId": "1b93c2f303ce61bf", "scanner": "scanner-primary", "fingerprint": "bab45bb90564c5a5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:173"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3a1fab18a38bf53", "level": "note", "message": {"text": "Possibly dead Python function: m_remove_scratch"}, "properties": {"repobilityId": "2d9ed54f3b882ef8", "scanner": "scanner-primary", "fingerprint": "d3a1fab18a38bf53", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:190"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e0d091da15a7c2a", "level": "note", "message": {"text": "Possibly dead Python function: m_swap_cmp"}, "properties": {"repobilityId": "5a5de18beb43957a", "scanner": "scanner-primary", "fingerprint": "8e0d091da15a7c2a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:200"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be050fbe3152ed4f", "level": "note", "message": {"text": "Possibly dead Python function: m_split_const"}, "properties": {"repobilityId": "8bc719c3214d4159", "scanner": "scanner-primary", "fingerprint": "be050fbe3152ed4f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:211"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2607b86d143a12d", "level": "note", "message": {"text": "Possibly dead Python function: m_cache_member"}, "properties": {"repobilityId": "c8c1dd776727745b", "scanner": "scanner-primary", "fingerprint": "a2607b86d143a12d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:233"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c726110b94b09f3", "level": "note", "message": {"text": "Possibly dead Python function: m_reassoc_base_chain"}, "properties": {"repobilityId": "6961d900bd58390c", "scanner": "scanner-primary", "fingerprint": "2c726110b94b09f3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:260"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-328e3804d94c71b2", "level": "note", "message": {"text": "Possibly dead Python function: m_dup_member_read"}, "properties": {"repobilityId": "bfa9a77fbff80bb8", "scanner": "scanner-primary", "fingerprint": "328e3804d94c71b2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute.py:277"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11959fc6404581b9", "level": "note", "message": {"text": "Possibly dead Python function: keep_flag"}, "properties": {"repobilityId": "d785abea1feae2a3", "scanner": "scanner-primary", "fingerprint": "11959fc6404581b9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/project.py:1672"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4696aab0dfba71f", "level": "note", "message": {"text": "Possibly dead Python function: unix_path"}, "properties": {"repobilityId": "e1d1ed0f369dbdf7", "scanner": "scanner-primary", "fingerprint": "e4696aab0dfba71f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/project.py:1775"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92e673b3df0eabe0", "level": "note", "message": {"text": "Possibly dead Python function: default_format"}, "properties": {"repobilityId": "c0ece9df0aa6a255", "scanner": "scanner-primary", "fingerprint": "92e673b3df0eabe0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/project.py:1986"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fab6b578a8e38b62", "level": "note", "message": {"text": "Possibly dead Python function: subninja"}, "properties": {"repobilityId": "b42ac29e931a7d12", "scanner": "scanner-primary", "fingerprint": "fab6b578a8e38b62", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ninja_syntax.py:155"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4ffc82634c59625", "level": "note", "message": {"text": "Possibly dead Python function: expand"}, "properties": {"repobilityId": "094b03ca0a319628", "scanner": "scanner-primary", "fingerprint": "e4ffc82634c59625", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ninja_syntax.py:236"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8104c18fefe4ed0", "level": "note", "message": {"text": "Possibly dead Python function: exp"}, "properties": {"repobilityId": "b7393bddc5f36731", "scanner": "scanner-primary", "fingerprint": "b8104c18fefe4ed0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ninja_syntax.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-071a32741d92b126", "level": "note", "message": {"text": "Possibly dead Python function: binutils_url"}, "properties": {"repobilityId": "f38c325d28bb4bbd", "scanner": "scanner-primary", "fingerprint": "071a32741d92b126", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/download_tool.py:25"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-649968f5debc6cc6", "level": "note", "message": {"text": "Possibly dead Python function: compilers_url"}, "properties": {"repobilityId": "842e7d0d67f95740", "scanner": "scanner-primary", "fingerprint": "649968f5debc6cc6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/download_tool.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2da7c556e0e9eca4", "level": "note", "message": {"text": "Possibly dead Python function: dtk_url"}, "properties": {"repobilityId": "286a96c7d404a254", "scanner": "scanner-primary", "fingerprint": "2da7c556e0e9eca4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/download_tool.py:43"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-debd4f1c46304e04", "level": "note", "message": {"text": "Possibly dead Python function: objdiff_cli_url"}, "properties": {"repobilityId": "5e8de1b8e8a78865", "scanner": "scanner-primary", "fingerprint": "debd4f1c46304e04", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/download_tool.py:59"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8db0092ce02cf81c", "level": "note", "message": {"text": "Possibly dead Python function: sjiswrap_url"}, "properties": {"repobilityId": "e88acc921801cbf2", "scanner": "scanner-primary", "fingerprint": "8db0092ce02cf81c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/download_tool.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f73ac4d94c3dc54b", "level": "note", "message": {"text": "Possibly dead Python function: wibo_url"}, "properties": {"repobilityId": "ce586af4d8714ef3", "scanner": "scanner-primary", "fingerprint": "f73ac4d94c3dc54b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/download_tool.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9236b0e098d0a1b6", "level": "note", "message": {"text": "Possibly dead Python function: nxt"}, "properties": {"repobilityId": "c4a212f505b4055e", "scanner": "scanner-primary", "fingerprint": "9236b0e098d0a1b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:254"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d23fa077a16cac7", "level": "note", "message": {"text": "Possibly dead Python function: t_perm_add_self"}, "properties": {"repobilityId": "db28ff28ad62f452", "scanner": "scanner-primary", "fingerprint": "6d23fa077a16cac7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:269"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-474a856266c19be9", "level": "note", "message": {"text": "Possibly dead Python function: t_cast_roundtrip"}, "properties": {"repobilityId": "2fac60642ea311f1", "scanner": "scanner-primary", "fingerprint": "474a856266c19be9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:282"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f67e91e13c63da0e", "level": "note", "message": {"text": "Possibly dead Python function: t_commute_cmp"}, "properties": {"repobilityId": "1bf701fae79dce1c", "scanner": "scanner-primary", "fingerprint": "f67e91e13c63da0e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:299"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c4f65f45f23c327", "level": "note", "message": {"text": "Possibly dead Python function: t_scratch_temp"}, "properties": {"repobilityId": "e7f35dd533b7d17d", "scanner": "scanner-primary", "fingerprint": "7c4f65f45f23c327", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:313"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86ca7c7a12ed2d78", "level": "note", "message": {"text": "Possibly dead Python function: t_split_decl"}, "properties": {"repobilityId": "e0b228120d6708b9", "scanner": "scanner-primary", "fingerprint": "86ca7c7a12ed2d78", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:379"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85342a1d77c482da", "level": "note", "message": {"text": "Possibly dead Python function: t_reassoc_add"}, "properties": {"repobilityId": "9184b694f80137e0", "scanner": "scanner-primary", "fingerprint": "85342a1d77c482da", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/permute2.py:392"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3b881f9203fc1e65", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in tools/brute.py:9"}, "properties": {"repobilityId": "88db5574b822c5a6", "scanner": "scanner-primary", "fingerprint": "3b881f9203fc1e65", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/brute.py"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bf0fd1430c42e23", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "18a7e8b29eb8f70d", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a380bb21c7e59ac", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5a380bb21c7e59ac", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-cd62886ed710e39a", "level": "note", "message": {"text": "Very large file: configure.py (1325 lines)"}, "properties": {"repobilityId": "cb2fb0b558bc3a2b", "scanner": "scanner-primary", "fingerprint": "cd62886ed710e39a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4644a687c4975a94", "level": "note", "message": {"text": "Very large file: tools/project.py (2085 lines)"}, "properties": {"repobilityId": "f1bf552bf67237b7", "scanner": "scanner-primary", "fingerprint": "4644a687c4975a94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c1abf73ef4b52fc5", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d34dea132f336f68", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "cd147de19468b08e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "69a621a52ef164cd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-786cd3671ec51236", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/sweep_compiler.py:18"}, "properties": {"repobilityId": "77777d00c5232bf7", "scanner": "scanner-primary", "fingerprint": "786cd3671ec51236", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9b6b1ff1f78e5d7b", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/asm_match.py:30"}, "properties": {"repobilityId": "b2f43031ba6e0e01", "scanner": "scanner-primary", "fingerprint": "9b6b1ff1f78e5d7b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d3cf3030b2f7415f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/probe_regalloc.py:9"}, "properties": {"repobilityId": "4a364a20e502dcf6", "scanner": "scanner-primary", "fingerprint": "d3cf3030b2f7415f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5c358f2ffc8fd76e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/pragma_sweep.py:29"}, "properties": {"repobilityId": "4a91556c3d99d063", "scanner": "scanner-primary", "fingerprint": "5c358f2ffc8fd76e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5476553c04a7d6d7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/chk.py:3"}, "properties": {"repobilityId": "77e912bcb22c09c7", "scanner": "scanner-primary", "fingerprint": "5476553c04a7d6d7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c64df7258135e751", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/permute_fn.py:20"}, "properties": {"repobilityId": "2e224b4f413914fe", "scanner": "scanner-primary", "fingerprint": "c64df7258135e751", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-90f96b59169c3937", "level": "note", "message": {"text": "Legacy-named symbol `bruteforce_backup` in tools/bruteforce_alloc.py:621"}, "properties": {"repobilityId": "d4485bbd68b0b6c9", "scanner": "scanner-primary", "fingerprint": "90f96b59169c3937", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4309a2238db8c91a", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/brute.py:20"}, "properties": {"repobilityId": "c815d1d3f161c22a", "scanner": "scanner-primary", "fingerprint": "4309a2238db8c91a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-08d4cd16d5f5115e", "level": "note", "message": {"text": "Legacy-named symbol `is_unused` in tools/extract_symbols.py:315"}, "properties": {"repobilityId": "d3daed00ab87e60d", "scanner": "scanner-primary", "fingerprint": "08d4cd16d5f5115e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-44721cd996732f60", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/dumpdiff.py:7"}, "properties": {"repobilityId": "a575cfb37e26b4ab", "scanner": "scanner-primary", "fingerprint": "44721cd996732f60", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-84f70a1451015618", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/showdiff.py:6"}, "properties": {"repobilityId": "fc9d8240624f543c", "scanner": "scanner-primary", "fingerprint": "84f70a1451015618", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-06924f93c5c75024", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/brute_const_reg.py:11"}, "properties": {"repobilityId": "02105a803eb30a83", "scanner": "scanner-primary", "fingerprint": "06924f93c5c75024", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b4f67fc490fdcd48", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/instr_align.py:17"}, "properties": {"repobilityId": "9c351d9b406cb8dd", "scanner": "scanner-primary", "fingerprint": "b4f67fc490fdcd48", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-640e82cf30fda7c0", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/showall.py:7"}, "properties": {"repobilityId": "67aa1174f8115d50", "scanner": "scanner-primary", "fingerprint": "640e82cf30fda7c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5bcdb3cba9abcc4c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/cflag_sweep.py:62"}, "properties": {"repobilityId": "e7d2e4ba059aeb34", "scanner": "scanner-primary", "fingerprint": "5bcdb3cba9abcc4c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5f31a53de8aab8bf", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/b1_struct_rank.py:8"}, "properties": {"repobilityId": "a28f1663cebc12da", "scanner": "scanner-primary", "fingerprint": "5f31a53de8aab8bf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-82df344795062219", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/classify_diff.py:8"}, "properties": {"repobilityId": "36b7314d11c8a636", "scanner": "scanner-primary", "fingerprint": "82df344795062219", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fe8c45e31fbadee1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/download_tool.py:145"}, "properties": {"repobilityId": "078154b252962457", "scanner": "scanner-primary", "fingerprint": "fe8c45e31fbadee1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1771dc0afa3e6fd4", "level": "note", "message": {"text": "Legacy-named symbol `is_unused` in tools/map/map_index.py:92"}, "properties": {"repobilityId": "3a39b6b54dcb0231", "scanner": "scanner-primary", "fingerprint": "1771dc0afa3e6fd4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b8b30a06e1eb5058", "level": "note", "message": {"text": "Legacy-named symbol `is_unused` in tools/map/claim_doctor.py:162"}, "properties": {"repobilityId": "c36d4a5471b5b933", "scanner": "scanner-primary", "fingerprint": "b8b30a06e1eb5058", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-17378215ce357544", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/map/claim_doctor.py:135"}, "properties": {"repobilityId": "751493364a7be011", "scanner": "scanner-primary", "fingerprint": "17378215ce357544", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-906154e11735ab9c", "level": "note", "message": {"text": "Legacy-named symbol `is_unused` in tools/map/discrepancy.py:93"}, "properties": {"repobilityId": "4bdc3f1c98302585", "scanner": "scanner-primary", "fingerprint": "906154e11735ab9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "c59b9cb47755bdf0", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "95f5947cff535449", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "28af2445ef4f01ca", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b3be9ee022501fb3", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "071d5690afcfebc7", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9fa5b3b585239419", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f47747f8ee3de236", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2c971f455894e30e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "34149d8d9a0f9352", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2b2598a9959a22b9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "37aa008aa69d1ed0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6d00bf1312244ab3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}