{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-733a6b8883904bbf", "name": "Possibly dead Python function: abbreviate_match", "shortDescription": {"text": "Possibly dead Python function: abbreviate_match"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f41b85e90ad75d6", "name": "Possibly dead Python function: render_stub", "shortDescription": {"text": "Possibly dead Python function: render_stub"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c17382629c82890", "name": "Possibly dead Python function: render_real", "shortDescription": {"text": "Possibly dead Python function: render_real"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e27da1a597e585f", "name": "Possibly dead Python function: replacer", "shortDescription": {"text": "Possibly dead Python function: replacer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44875e7e441930d3", "name": "Possibly dead Python function: chapter_sort_key", "shortDescription": {"text": "Possibly dead Python function: chapter_sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d31879c915d0d92", "name": "Possibly dead Python function: sha256_prompt_file", "shortDescription": {"text": "Possibly dead Python function: sha256_prompt_file"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ac99eda70836215", "name": "Possibly dead Python function: appendix_sort_key", "shortDescription": {"text": "Possibly dead Python function: appendix_sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73b4bdbd6a05efc0", "name": "Possibly dead Python function: replacer", "shortDescription": {"text": "Possibly dead Python function: replacer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0619193718cb4a7", "name": "Possibly dead Python function: compute_frontmatter_hash", "shortDescription": {"text": "Possibly dead Python function: compute_frontmatter_hash"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ef5752bd458367e", "name": "Possibly dead Python function: new_run_text", "shortDescription": {"text": "Possibly dead Python function: new_run_text"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01a38499d1ec3459", "name": "Possibly dead Python function: seal", "shortDescription": {"text": "Possibly dead Python function: seal"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab48b158e641b6d3", "name": "Possibly dead Python function: verify_chain", "shortDescription": {"text": "Possibly dead Python function: verify_chain"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86ff7c700711841a", "name": "Possibly dead Python function: to_telemetry_event", "shortDescription": {"text": "Possibly dead Python function: to_telemetry_event"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01570caf7c93e49a", "name": "Possibly dead Python function: new_claim_id", "shortDescription": {"text": "Possibly dead Python function: new_claim_id"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ac99e0155bdef86", "name": "Possibly dead Python function: build_pipeline", "shortDescription": {"text": "Possibly dead Python function: build_pipeline"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22af355e56fa6e8b", "name": "Possibly dead Python function: fix", "shortDescription": {"text": "Possibly dead Python function: fix"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7030aed48765dad1", "name": "Possibly dead Python function: register_fix", "shortDescription": {"text": "Possibly dead Python function: register_fix"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83b17a870c0e27be", "name": "Possibly dead Python function: route_many", "shortDescription": {"text": "Possibly dead Python function: route_many"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-def37e8b59ae4c8d", "name": "Possibly dead Python function: hygiene_finding", "shortDescription": {"text": "Possibly dead Python function: hygiene_finding"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-817a0aec4a583c8b", "name": "Possibly dead Python function: runtime_finding", "shortDescription": {"text": "Possibly dead Python function: runtime_finding"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-849aaaf7a5b419ec", "name": "Possibly dead Python function: model_post_init", "shortDescription": {"text": "Possibly dead Python function: model_post_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca6d1807d0948a51", "name": "Possibly dead Python function: parse_graph_entities", "shortDescription": {"text": "Possibly dead Python function: parse_graph_entities"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80b9d3f6b82750b9", "name": "Possibly dead Python function: parse_security_policies", "shortDescription": {"text": "Possibly dead Python function: parse_security_policies"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c837e1b5dde374ad", "name": "Possibly dead Python function: generate_endpoint_evidence", "shortDescription": {"text": "Possibly dead Python function: generate_endpoint_evidence"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45ab58ab8a0b8e21", "name": "Possibly dead Python function: check_certificate_status", "shortDescription": {"text": "Possibly dead Python function: check_certificate_status"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83e4613163515b79", "name": "Stray `console.log` in TS/JS \u2014 docs/scripts/metadata_drift_scan.js:125", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/scripts/metadata_drift_scan.js:125"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6820fcfd46c56d8a", "name": "Stray `console.log` in TS/JS \u2014 docs/scripts/update_corpus_index.js:96", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/scripts/update_corpus_index.js:96"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b4a298b6f2a3919", "name": "Stray `console.log` in TS/JS \u2014 docs/tools/uiao-governance-cli.js:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/tools/uiao-governance-cli.js:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b0ee90f09e5194b", "name": "Privileged port 914 in use", "shortDescription": {"text": "Privileged port 914 in use"}, "fullDescription": {"text": "Port 914 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9a62f58f6143c65", "name": "Privileged port 498 in use", "shortDescription": {"text": "Privileged port 498 in use"}, "fullDescription": {"text": "Port 498 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e9944ce8b748c17", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cf960ae686198183", "name": "Insecure pattern 'node_child_process' in docs/scripts/metadata_drift_scan.js:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in docs/scripts/metadata_drift_scan.js:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcbff0c4491cb662", "name": "Insecure pattern 'node_child_process' in docs/scripts/update_corpus_index.js:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in docs/scripts/update_corpus_index.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3898f2f7c2048d48", "name": "Insecure pattern 'tls_verify_false' in scripts/enforcement_orchestrator.py:34", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in scripts/enforcement_orchestrator.py:34"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c33a59de0a5c6b6c", "name": "Possible secret in .github/workflows/azure-saas-deploy.yml", "shortDescription": {"text": "Possible secret in .github/workflows/azure-saas-deploy.yml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-401964e3b371861f", "name": "Insecure pattern 'node_child_process' in .github/workflows/spec-test-coverage.yml:78", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/workflows/spec-test-coverage.yml:78"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ad6b9cdb886c054", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/uiao/api/web/static/app.js:32", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/uiao/api/web/static/app.js:32"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e4489f5b57ac242", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38135d62d4659901", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c707fa90593478ff", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc83220c8da9a336", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57f5d21f3dda6370", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7d24e51abf39620", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1c018fc99fc8401", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-149ef59a77881e49", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58e4c397724f5259", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4017990271006a7a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c7de4470ff63437", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef66a3b9c9b405f9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-133d98ea7bb9972b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bd4ee85b7ffb652", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cbe4ba4be843fdf", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-269d703ab1325746", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b53febbfeb6d07b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46ba4ae3086c327e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ee5dcd9a06e6d76", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2571ca15273a01f0", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2b404c7024b0c5a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a84ae642b40b7111", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92ca9a6df38f5564", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00d833c25b5561ae", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "quarto-dev/quarto-actions/setup@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b57601e116bfed9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-881c27cf4a697ae7", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d56d1c7bd6ae2bb4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53b0303fba6b1f2d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccc2afd63e8ca28a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87a5b3c27c282e5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8d32feb44afed43", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c406db54d1a43040", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8004c0903b7173c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acd5b4da0f5d8661", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a024b99732d637c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a378e6fdc3fefc0a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f22ed33d0dec67e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66abbace7b00c635", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d5d99512a2d4961", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6d5924ff00ed314", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa7d7674291ef25d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed58cc3a95512fa2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98d42f81e82edad9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fba3b3458a6c960", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05ee7931cedbc1b4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cdbad85a1273b2c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab29fee265a7d885", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-484ca9912d694122", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-519d45e8f8c242fb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-247ac42715a87c26", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27ef4d60fb1b56f5", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eae1691a53a7a04c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56cb227ecae55165", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bab02c9dcd8d877", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f98ea342526d13c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4183212f89a12fe1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "release-drafter/release-drafter@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-420770c48b8d4613", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b26140f9663ae501", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29faa340b6637c55", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "azure/login@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fccf94c309e7f516", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b8532affeaa7db2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4639339f9b780294", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d37a323e3ed3a48d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8432f52dc57f476e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7ea5e7f66ea4b13", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8da2803837dd377d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d5c124922350323", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c41c00e3b847ab23", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51977a3899cebe53", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99a75721f580c760", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cde33b484a0322c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a98bf1168df3b78", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50cce0c0d1a42085", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e836d5a564a796c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3a8cf49c9efb8d3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92f4d2b27958ffc6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9b5fc6c2d65d20", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be6fd4041aa09f9d", "name": "Very large file: scripts/generate_images.py (1387 lines)", "shortDescription": {"text": "Very large file: scripts/generate_images.py (1387 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4afe559249e5b306", "name": "Very large file: src/uiao/adapters/modernization/active_directory/survey.py (1742 lines)", "shortDescription": {"text": "Very large file: src/uiao/adapters/modernization/active_directory/survey.py (1742 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 958 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 98 placeholder/mock markers across 40 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-229ce3942d79488d", "name": "Legacy-named symbol `is_deprecated` in tests/test_orgpath_codebook.py:200", "shortDescription": {"text": "Legacy-named symbol `is_deprecated` in tests/test_orgpath_codebook.py:200"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a164cfa958786ac7", "name": "Legacy-named symbol `UIAO_007_OrgTree_Modernization_AD_to_EntraID_v1` in tests/test_active_directory_survey_enrichment.p", "shortDescription": {"text": "Legacy-named symbol `UIAO_007_OrgTree_Modernization_AD_to_EntraID_v1` in tests/test_active_directory_survey_enrichment.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c4b5c207f701806", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in tests/test_e2e.py:26", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in tests/test_e2e.py:26"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb7c63239d453808", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in tests/test_models.py:119", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in tests/test_models.py:119"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3452758b82670560", "name": "Legacy-named symbol `uiao_jml_logic_v1` in tests/canon_paths.py:42", "shortDescription": {"text": "Legacy-named symbol `uiao_jml_logic_v1` in tests/canon_paths.py:42"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd03d9e024a37758", "name": "Commented-code block (6 lines) in tests/test_entra_adapter_behavioral.py:72", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_entra_adapter_behavioral.py:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8c3ba90bcbf364ab", "name": "Legacy-named symbol `CanonicalLegacy` in tests/test_drift_output.py:110", "shortDescription": {"text": "Legacy-named symbol `CanonicalLegacy` in tests/test_drift_output.py:110"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3afc6f4be592c05c", "name": "Legacy-named symbol `nLegacy` in tests/test_substrate_walker.py:392", "shortDescription": {"text": "Legacy-named symbol `nLegacy` in tests/test_substrate_walker.py:392"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6367f99a283d3770", "name": "Legacy-named symbol `cd_copy` in tests/test_servicenow_oscal_emitter.py:245", "shortDescription": {"text": "Legacy-named symbol `cd_copy` in tests/test_servicenow_oscal_emitter.py:245"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd2868b7afa71867", "name": "Commented-code block (5 lines) in tests/test_orgtree_readiness_bundle.py:421", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_orgtree_readiness_bundle.py:421"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-afe08b1ee281b1e6", "name": "Commented-code block (6 lines) in tests/test_cli_tenant.py:138", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_cli_tenant.py:138"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b27eaff80dd7c203", "name": "Commented-code block (6 lines) in tests/test_api_smoke.py:46", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_api_smoke.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0473684eeaaf8c65", "name": "Legacy-named symbol `test_get_codebook_serializes_deprecated` in tests/orgtree/test_orgpath_api.py:63", "shortDescription": {"text": "Legacy-named symbol `test_get_codebook_serializes_deprecated` in tests/orgtree/test_orgpath_api.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c4e6168133d2b4f", "name": "Network/subprocess call without timeout or try/except \u2014 diagrams/scripts/pre-render.py:50", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 diagrams/scripts/pre-render.py:50"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70040f53100ca6d0", "name": "Legacy-named symbol `UIAO_002_SCuBA_Technical_Specification_v1` in docs/docs/session-logs/scripts/fix_uiao_002.py:5", "shortDescription": {"text": "Legacy-named symbol `UIAO_002_SCuBA_Technical_Specification_v1` in docs/docs/session-logs/scripts/fix_uiao_002.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68152a7bca893ed0", "name": "Commented-code block (8 lines) in docs/docs/session-logs/scripts/fix_uiao_002.py:7", "shortDescription": {"text": "Commented-code block (8 lines) in docs/docs/session-logs/scripts/fix_uiao_002.py:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a50a9b80c38f3ea", "name": "Legacy-named symbol `UIAO_003_Adapter_Segmentation_Overview_v1` in docs/docs/session-logs/scripts/canon_backfill.py:11", "shortDescription": {"text": "Legacy-named symbol `UIAO_003_Adapter_Segmentation_Overview_v1` in docs/docs/session-logs/scripts/canon_backfill.py:11"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d47b9234d92d7cb1", "name": "Legacy-named symbol `tags_old` in docs/tools/uiao-governance-cli.js:41", "shortDescription": {"text": "Legacy-named symbol `tags_old` in docs/tools/uiao-governance-cli.js:41"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5db83fddc52cb91d", "name": "Commented-code block (9 lines) in docs/tools/aggregate_prompts.py:52", "shortDescription": {"text": "Commented-code block (9 lines) in docs/tools/aggregate_prompts.py:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-557ab3715ff9648e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_orchestrator.py:132", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_orchestrator.py:132"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8569b03c42decfee", "name": "Commented-code block (5 lines) in scripts/generate_patent_figures.py:5", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/generate_patent_figures.py:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f75111390c971655", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/validate_fedramp.py:29", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/validate_fedramp.py:29"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3944bc4199e9fb6e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/cyberark_sync_orchestrator.py:72", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/cyberark_sync_orchestrator.py:72"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40f5fd1fa9ac8c7b", "name": "Commented-code block (5 lines) in scripts/triage_aspirational_signals.py:136", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/triage_aspirational_signals.py:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1f24d9de2d8cc1aa", "name": "Legacy-named symbol `uiao_project_plan_v1` in scripts/plan_to_csv.py:13", "shortDescription": {"text": "Legacy-named symbol `uiao_project_plan_v1` in scripts/plan_to_csv.py:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7df86d4c4a0ccec", "name": "Legacy-named symbol `uiao_pitch_deck_v1` in scripts/generate_pptx.py:14", "shortDescription": {"text": "Legacy-named symbol `uiao_pitch_deck_v1` in scripts/generate_pptx.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc148bc0140c1eb0", "name": "Commented-code block (5 lines) in scripts/scan_publication_gaps.py:86", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/scan_publication_gaps.py:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a54709f7cbf7be0", "name": "Legacy-named symbol `UIAO_002_SCuBA_Technical_Specification_v1` in scripts/reorganize_monorepo.py:120", "shortDescription": {"text": "Legacy-named symbol `UIAO_002_SCuBA_Technical_Specification_v1` in scripts/reorganize_monorepo.py:120"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4b08f9e3547efaf", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/reorganize_monorepo.py:48", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/reorganize_monorepo.py:48"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d951016d21c4ba89", "name": "Legacy-named symbol `canon_refs_deprecated` in scripts/generate_images.py:208", "shortDescription": {"text": "Legacy-named symbol `canon_refs_deprecated` in scripts/generate_images.py:208"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f8cc78221db3f19", "name": "Commented-code block (7 lines) in scripts/generate_images.py:26", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/generate_images.py:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52cfd6cb7128ce16", "name": "Commented-code block (6 lines) in scripts/regenerate_local_images_from_figalt.py:125", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/regenerate_local_images_from_figalt.py:125"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ff504568f962154d", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/enforcement_orchestrator.py:62", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/enforcement_orchestrator.py:62"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9123011d7879fc0c", "name": "Commented-code block (5 lines) in scripts/bundle_section_docx.py:82", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/bundle_section_docx.py:82"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2039d8407d8da5c", "name": "Legacy-named symbol `has_copy` in scripts/tools/appendix_indexer.py:65", "shortDescription": {"text": "Legacy-named symbol `has_copy` in scripts/tools/appendix_indexer.py:65"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbe600e4884548a2", "name": "Commented-code block (7 lines) in scripts/tools/docs_leak_check.py:32", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/tools/docs_leak_check.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-42922df144e1a208", "name": "Legacy-named symbol `with_copy` in scripts/tools/dashboard_exporter.py:117", "shortDescription": {"text": "Legacy-named symbol `with_copy` in scripts/tools/dashboard_exporter.py:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4166a42a3324b159", "name": "Commented-code block (6 lines) in scripts/conmon/migration_readiness.py:50", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/conmon/migration_readiness.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fdca7ca0bf06326f", "name": "Commented-code block (6 lines) in deploy/windows-server/run.py:23", "shortDescription": {"text": "Commented-code block (6 lines) in deploy/windows-server/run.py:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fecc68623817f290", "name": "Commented-code block (6 lines) in inbox/New_FedRAMP_Boundary/inject_images_into_docs.py:99", "shortDescription": {"text": "Commented-code block (6 lines) in inbox/New_FedRAMP_Boundary/inject_images_into_docs.py:99"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-60f5ea26270965f5", "name": "Commented-code block (5 lines) in inbox/drafts/complete-narrative/promote_headings.py:44", "shortDescription": {"text": "Commented-code block (5 lines) in inbox/drafts/complete-narrative/promote_headings.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c4fb523550b26b0", "name": "Legacy-named symbol `model_copy` in inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:199", "shortDescription": {"text": "Legacy-named symbol `model_copy` in inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:199"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07fab0d234a2ec6b", "name": "Commented-code block (6 lines) in inbox/drafts/phase2-runtime-drift-validators/validators.py:210", "shortDescription": {"text": "Commented-code block (6 lines) in inbox/drafts/phase2-runtime-drift-validators/validators.py:210"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-423d767dd454bb26", "name": "Legacy-named symbol `is_deprecated` in src/uiao/governance/drift_engine.py:294", "shortDescription": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/governance/drift_engine.py:294"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e100affc8aca2435", "name": "Commented-code block (6 lines) in src/uiao/governance/cql.py:74", "shortDescription": {"text": "Commented-code block (6 lines) in src/uiao/governance/cql.py:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-de1b9f99cb4eca86", "name": "Commented-code block (5 lines) in src/uiao/governance/ssot_contention.py:368", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/governance/ssot_contention.py:368"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e5f4523b796019aa", "name": "Legacy-named symbol `is_deprecated` in src/uiao/governance/drift.py:333", "shortDescription": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/governance/drift.py:333"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a426aa171d08cdc5", "name": "Commented-code block (5 lines) in src/uiao/governance/drift.py:36", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/governance/drift.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad1096487ca54952", "name": "Commented-code block (5 lines) in src/uiao/governance/entra_authz_supplements.py:30", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/governance/entra_authz_supplements.py:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20216627b8f4fde9", "name": "Commented-code block (5 lines) in src/uiao/adapters/database_base.py:328", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/adapters/database_base.py:328"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e61ff629b177d096", "name": "Legacy-named symbol `winserver_legacy` in src/uiao/adapters/modernization/active_directory/intune_readiness.py:202", "shortDescription": {"text": "Legacy-named symbol `winserver_legacy` in src/uiao/adapters/modernization/active_directory/intune_readiness.py:202"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdabd2e822cac5e7", "name": "Commented-code block (7 lines) in src/uiao/adapters/modernization/active_directory/arc_readiness.py:111", "shortDescription": {"text": "Commented-code block (7 lines) in src/uiao/adapters/modernization/active_directory/arc_readiness.py:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-970eb71fb4e972ee", "name": "Commented-code block (6 lines) in src/uiao/adapters/modernization/active_directory/survey.py:404", "shortDescription": {"text": "Commented-code block (6 lines) in src/uiao/adapters/modernization/active_directory/survey.py:404"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4f43418254efd19e", "name": "Commented-code block (5 lines) in src/uiao/adapters/modernization/pki/inventory.py:72", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/adapters/modernization/pki/inventory.py:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f51742bdbad02e3", "name": "Commented-code block (7 lines) in src/uiao/adapters/scuba/ir/normalize_scuba.py:243", "shortDescription": {"text": "Commented-code block (7 lines) in src/uiao/adapters/scuba/ir/normalize_scuba.py:243"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea8c0a4f225c4d87", "name": "Legacy-named symbol `model_copy` in src/uiao/adapters/scuba/ir/transformer.py:108", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/uiao/adapters/scuba/ir/transformer.py:108"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c78253199d329bb", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/models/canon.py:67", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/models/canon.py:67"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e78144dd024345ab", "name": "Commented-code block (5 lines) in src/uiao/modernization/orgtree/enforcement_projection.py:43", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/modernization/orgtree/enforcement_projection.py:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f9d33f285f23e94", "name": "Legacy-named symbol `is_deprecated` in src/uiao/modernization/orgtree/codebook.py:24", "shortDescription": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/modernization/orgtree/codebook.py:24"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0acf024aae8ed68e", "name": "Commented-code block (5 lines) in src/uiao/api/auth/entra_token.py:85", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/api/auth/entra_token.py:85"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30b4c58539a28275", "name": "Legacy-named symbol `is_deprecated` in src/uiao/api/routes/orgpath.py:20", "shortDescription": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/api/routes/orgpath.py:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d38d0e49bb18d7e", "name": "Legacy-named symbol `is_deprecated` in src/uiao/api/web/console.py:183", "shortDescription": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/api/web/console.py:183"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4b509ce94d41e99", "name": "Network/subprocess call without timeout or try/except \u2014 src/uiao/cli/init.py:171", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/uiao/cli/init.py:171"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c83fad0fa27af9fb", "name": "Commented-code block (7 lines) in src/uiao/cli/tenant.py:132", "shortDescription": {"text": "Commented-code block (7 lines) in src/uiao/cli/tenant.py:132"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7450bfe1d75708fa", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/cli/generate.py:11", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/cli/generate.py:11"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7def09b3ea8015ef", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/utils/context.py:79", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/utils/context.py:79"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc019800a5e341ae", "name": "Commented-code block (6 lines) in src/uiao/orchestrator/orchestrator.py:90", "shortDescription": {"text": "Commented-code block (6 lines) in src/uiao/orchestrator/orchestrator.py:90"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2cab55335d8e9958", "name": "Commented-code block (8 lines) in src/uiao/substrate/walker.py:38", "shortDescription": {"text": "Commented-code block (8 lines) in src/uiao/substrate/walker.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d29502b2b4e8dca7", "name": "Legacy-named symbol `model_copy` in src/uiao/saas/tenant.py:109", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/uiao/saas/tenant.py:109"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25358389d8e60f88", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/generators/pptx.py:300", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/generators/pptx.py:300"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-136d282926a3ad72", "name": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/generators/ssp.py:652", "shortDescription": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/generators/ssp.py:652"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-894d2954d3630d4f", "name": "Legacy-named symbol `leadership_briefing_v1` in src/uiao/generators/docs.py:80", "shortDescription": {"text": "Legacy-named symbol `leadership_briefing_v1` in src/uiao/generators/docs.py:80"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0083a50e0bf92c95", "name": "Commented-code block (5 lines) in src/uiao/generators/sbom.py:29", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/generators/sbom.py:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52463084e9fe220a", "name": "Legacy-named symbol `leadership_briefing_v1` in src/uiao/generators/rich_docx.py:699", "shortDescription": {"text": "Legacy-named symbol `leadership_briefing_v1` in src/uiao/generators/rich_docx.py:699"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f193984b6079cc47", "name": "Commented-code block (5 lines) in src/uiao/generators/rich_docx.py:47", "shortDescription": {"text": "Commented-code block (5 lines) in src/uiao/generators/rich_docx.py:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9803c256ccfe9eb8", "name": "Commented-code block (7 lines) in src/uiao/ksi/evaluate.py:107", "shortDescription": {"text": "Commented-code block (7 lines) in src/uiao/ksi/evaluate.py:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ndiagrams/scripts/validate.py:parse_frontmatter, diagrams/scripts/render.py:parse_frontmatter\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/add_qmd_format_block.py:main, scripts/regenerate_local_images_from_figalt.py:main, scripts/add_lifecycle_to_qmd.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/generate_substrate_status_table.py:main, scripts/generate_sitemap.py:main, scripts/generate_customer_docs_status.py:main, scripts/generate_document_index.py:main\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ninbox/drafts/phase2-runtime-drift-validators/validators.py:check, inbox/drafts/phase2-runtime-drift-validators/validators.py:check, inbox/drafts/phase2-runtime-drift-validators/validators.py:check, inbox/drafts/phase2-runtime-drift-validators/validators.py:check\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4adea4b7b80579c", "name": "FastAPI POST `validate` without auth dependency \u2014 src/uiao/api/routes/orgpath.py:223", "shortDescription": {"text": "FastAPI POST `validate` without auth dependency \u2014 src/uiao/api/routes/orgpath.py:223"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb294c798bfb26e4", "name": "FastAPI POST `run_governance` without auth dependency \u2014 src/uiao/api/web/console.py:276", "shortDescription": {"text": "FastAPI POST `run_governance` without auth dependency \u2014 src/uiao/api/web/console.py:276"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21f40681f0e8d376", "name": "Dangling fetch: POST /orgpath/api/govern (src/uiao/api/web/static/app.js:60)", "shortDescription": {"text": "Dangling fetch: POST /orgpath/api/govern (src/uiao/api/web/static/app.js:60)"}, "fullDescription": {"text": "`src/uiao/api/web/static/app.js:60` calls `POST /orgpath/api/govern` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/orgpath/api/govern`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-932a783785211575", "name": "Unused endpoint: GET /api/auditor/evidence", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/evidence"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/evidence` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4bb00baeb5e1ebd", "name": "Unused endpoint: GET /api/auditor/evidence/{evidence_id}", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/evidence/{evidence_id}"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/evidence/{evidence_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2db4cab52d55abe5", "name": "Unused endpoint: GET /api/auditor/findings", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/findings"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/findings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c58daff5aee4d39d", "name": "Unused endpoint: GET /api/auditor/poam", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/poam"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/poam` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63f56d16b2d2397e", "name": "Unused endpoint: GET /api/auditor/oscal/sar", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/oscal/sar"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/oscal/sar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b0866b15294083f", "name": "Unused endpoint: GET /api/auditor/oscal/ssp", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/oscal/ssp"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/oscal/ssp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c396edab1e2e67c", "name": "Unused endpoint: GET /api/auditor/oscal/poam", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/oscal/poam"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/oscal/poam` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a237483b59ab6e33", "name": "Unused endpoint: GET /api/auditor/oscal/sap", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/oscal/sap"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/oscal/sap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fbde79825176b80", "name": "Unused endpoint: GET /api/auditor/graph/{control_id}", "shortDescription": {"text": "Unused endpoint: GET /api/auditor/graph/{control_id}"}, "fullDescription": {"text": "`src/uiao/api/routes/auditor.py` declares `GET /api/auditor/graph/{control_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12e0d5d55611566c", "name": "Unused endpoint: GET /api/v1/orgpath/codebook", "shortDescription": {"text": "Unused endpoint: GET /api/v1/orgpath/codebook"}, "fullDescription": {"text": "`src/uiao/api/routes/orgpath.py` declares `GET /api/v1/orgpath/codebook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37bd48863f14629b", "name": "Unused endpoint: GET /api/v1/orgpath/principals/{principal_id}/facets", "shortDescription": {"text": "Unused endpoint: GET /api/v1/orgpath/principals/{principal_id}/facets"}, "fullDescription": {"text": "`src/uiao/api/routes/orgpath.py` declares `GET /api/v1/orgpath/principals/{principal_id}/facets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3391980240a79ac", "name": "Unused endpoint: GET /api/v1/orgpath/drift", "shortDescription": {"text": "Unused endpoint: GET /api/v1/orgpath/drift"}, "fullDescription": {"text": "`src/uiao/api/routes/orgpath.py` declares `GET /api/v1/orgpath/drift` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d417d22f300c20b3", "name": "Unused endpoint: POST /api/v1/orgpath/validate", "shortDescription": {"text": "Unused endpoint: POST /api/v1/orgpath/validate"}, "fullDescription": {"text": "`src/uiao/api/routes/orgpath.py` declares `POST /api/v1/orgpath/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-512a13634818900f", "name": "Unused endpoint: GET /policies", "shortDescription": {"text": "Unused endpoint: GET /policies"}, "fullDescription": {"text": "`src/uiao/api/routes/epl.py` declares `GET /policies` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e286f18d9d261cc6", "name": "Unused endpoint: GET /policies/{policy_id}", "shortDescription": {"text": "Unused endpoint: GET /policies/{policy_id}"}, "fullDescription": {"text": "`src/uiao/api/routes/epl.py` declares `GET /policies/{policy_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95f235fd6ce6304d", "name": "Unused endpoint: POST /evaluate", "shortDescription": {"text": "Unused endpoint: POST /evaluate"}, "fullDescription": {"text": "`src/uiao/api/routes/epl.py` declares `POST /evaluate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69a693dfc33637f4", "name": "Unused endpoint: POST /run", "shortDescription": {"text": "Unused endpoint: POST /run"}, "fullDescription": {"text": "`src/uiao/api/routes/boundary.py` declares `POST /run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76afc4e62d1236f4", "name": "Unused endpoint: GET /gaps", "shortDescription": {"text": "Unused endpoint: GET /gaps"}, "fullDescription": {"text": "`src/uiao/api/routes/boundary.py` declares `GET /gaps` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/uiao/api/routes/ztmm.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15d160b46aa256fa", "name": "Unused endpoint: GET /{pillar}", "shortDescription": {"text": "Unused endpoint: GET /{pillar}"}, "fullDescription": {"text": "`src/uiao/api/routes/ztmm.py` declares `GET /{pillar}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83bb031a4d381bd4", "name": "Unused endpoint: POST /findings", "shortDescription": {"text": "Unused endpoint: POST /findings"}, "fullDescription": {"text": "`src/uiao/api/routes/survey.py` declares `POST /findings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec4a5d55b1200f49", "name": "Unused endpoint: GET /queries", "shortDescription": {"text": "Unused endpoint: GET /queries"}, "fullDescription": {"text": "`src/uiao/api/routes/cql.py` declares `GET /queries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fbea83da28df6ae", "name": "Unused endpoint: GET /queries/{name}", "shortDescription": {"text": "Unused endpoint: GET /queries/{name}"}, "fullDescription": {"text": "`src/uiao/api/routes/cql.py` declares `GET /queries/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddf9f18687947d3a", "name": "Unused endpoint: POST /evaluate/{name}", "shortDescription": {"text": "Unused endpoint: POST /evaluate/{name}"}, "fullDescription": {"text": "`src/uiao/api/routes/cql.py` declares `POST /evaluate/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49a8bddc3f6c23e6", "name": "Unused endpoint: GET /api/v1/archive", "shortDescription": {"text": "Unused endpoint: GET /api/v1/archive"}, "fullDescription": {"text": "`src/uiao/api/routes/archive.py` declares `GET /api/v1/archive` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94fc151b8d8ef5be", "name": "Unused endpoint: GET /api/v1/archive/{run_id}/{adapter_id}", "shortDescription": {"text": "Unused endpoint: GET /api/v1/archive/{run_id}/{adapter_id}"}, "fullDescription": {"text": "`src/uiao/api/routes/archive.py` declares `GET /api/v1/archive/{run_id}/{adapter_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d0b75c541565cd9", "name": "Unused endpoint: GET /journal", "shortDescription": {"text": "Unused endpoint: GET /journal"}, "fullDescription": {"text": "`src/uiao/api/routes/enforcement.py` declares `GET /journal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fb886588e645984", "name": "Unused endpoint: POST /dispatch", "shortDescription": {"text": "Unused endpoint: POST /dispatch"}, "fullDescription": {"text": "`src/uiao/api/routes/enforcement.py` declares `POST /dispatch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f6e50d303b27830", "name": "Unused endpoint: GET /codebook", "shortDescription": {"text": "Unused endpoint: GET /codebook"}, "fullDescription": {"text": "`src/uiao/api/web/console.py` declares `GET /codebook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56816244c61e999a", "name": "Unused endpoint: GET /principals", "shortDescription": {"text": "Unused endpoint: GET /principals"}, "fullDescription": {"text": "`src/uiao/api/web/console.py` declares `GET /principals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93ab4e722245e479", "name": "Unused endpoint: GET /govern", "shortDescription": {"text": "Unused endpoint: GET /govern"}, "fullDescription": {"text": "`src/uiao/api/web/console.py` declares `GET /govern` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b9493c233d7f70", "name": "Unused endpoint: POST /api/govern", "shortDescription": {"text": "Unused endpoint: POST /api/govern"}, "fullDescription": {"text": "`src/uiao/api/web/console.py` declares `POST /api/govern` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07a7fad711358625", "name": "Unused endpoint: POST /tenants", "shortDescription": {"text": "Unused endpoint: POST /tenants"}, "fullDescription": {"text": "`src/uiao/saas/control_plane.py` declares `POST /tenants` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-092d7b8020d70b38", "name": "Unused endpoint: GET /tenants", "shortDescription": {"text": "Unused endpoint: GET /tenants"}, "fullDescription": {"text": "`src/uiao/saas/control_plane.py` declares `GET /tenants` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80816cd87fbcfd36", "name": "Unused endpoint: GET /tenants/{tenant_id}", "shortDescription": {"text": "Unused endpoint: GET /tenants/{tenant_id}"}, "fullDescription": {"text": "`src/uiao/saas/control_plane.py` declares `GET /tenants/{tenant_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae1d3d48b460e399", "name": "Unused endpoint: POST /tenants/{tenant_id}/suspend", "shortDescription": {"text": "Unused endpoint: POST /tenants/{tenant_id}/suspend"}, "fullDescription": {"text": "`src/uiao/saas/control_plane.py` declares `POST /tenants/{tenant_id}/suspend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-299d697f947b854f", "name": "Unused endpoint: POST /tenants/{tenant_id}/resume", "shortDescription": {"text": "Unused endpoint: POST /tenants/{tenant_id}/resume"}, "fullDescription": {"text": "`src/uiao/saas/control_plane.py` declares `POST /tenants/{tenant_id}/resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ae797f7f0be512f", "name": "Unused endpoint: DELETE /tenants/{tenant_id}", "shortDescription": {"text": "Unused endpoint: DELETE /tenants/{tenant_id}"}, "fullDescription": {"text": "`src/uiao/saas/control_plane.py` declares `DELETE /tenants/{tenant_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22813"}, "properties": {"repository": "WhalerMike/uiao", "repoUrl": "https://github.com/WhalerMike/uiao", "branch": "main"}, "results": [{"ruleId": "scanner-733a6b8883904bbf", "level": "note", "message": {"text": "Possibly dead Python function: abbreviate_match"}, "properties": {"repobilityId": "659de9f79fe4f8f9", "scanner": "scanner-primary", "fingerprint": "733a6b8883904bbf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "diagrams/scripts/render.py:209"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f41b85e90ad75d6", "level": "note", "message": {"text": "Possibly dead Python function: render_stub"}, "properties": {"repobilityId": "48942ece9d7b4bd1", "scanner": "scanner-primary", "fingerprint": "7f41b85e90ad75d6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tools/generate_images.py:86"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c17382629c82890", "level": "note", "message": {"text": "Possibly dead Python function: render_real"}, "properties": {"repobilityId": "5441d16e36bd9fd4", "scanner": "scanner-primary", "fingerprint": "9c17382629c82890", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tools/generate_images.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e27da1a597e585f", "level": "note", "message": {"text": "Possibly dead Python function: replacer"}, "properties": {"repobilityId": "4c6d041d83cc4187", "scanner": "scanner-primary", "fingerprint": "7e27da1a597e585f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/fix_concept_lists.py:144"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44875e7e441930d3", "level": "note", "message": {"text": "Possibly dead Python function: chapter_sort_key"}, "properties": {"repobilityId": "c892e9f8d65880d5", "scanner": "scanner-primary", "fingerprint": "44875e7e441930d3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/rebuild_orgpath_image_manifest.py:240"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d31879c915d0d92", "level": "note", "message": {"text": "Possibly dead Python function: sha256_prompt_file"}, "properties": {"repobilityId": "54dd38b7f62860a3", "scanner": "scanner-primary", "fingerprint": "8d31879c915d0d92", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_images.py:242"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ac99eda70836215", "level": "note", "message": {"text": "Possibly dead Python function: appendix_sort_key"}, "properties": {"repobilityId": "56609e6ed9c683ce", "scanner": "scanner-primary", "fingerprint": "3ac99eda70836215", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/charter-preprocessor/atobz_preprocess.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73b4bdbd6a05efc0", "level": "note", "message": {"text": "Possibly dead Python function: replacer"}, "properties": {"repobilityId": "4c6d041d83cc4187", "scanner": "scanner-primary", "fingerprint": "73b4bdbd6a05efc0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/charter-preprocessor/atobz_preprocess.py:129"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0619193718cb4a7", "level": "note", "message": {"text": "Possibly dead Python function: compute_frontmatter_hash"}, "properties": {"repobilityId": "157cb48b4db54662", "scanner": "scanner-primary", "fingerprint": "d0619193718cb4a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/tools/sync_canon.py:364"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ef5752bd458367e", "level": "note", "message": {"text": "Possibly dead Python function: new_run_text"}, "properties": {"repobilityId": "706c462794df9891", "scanner": "scanner-primary", "fingerprint": "3ef5752bd458367e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/New_FedRAMP_Boundary/inject_images_into_docs.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01a38499d1ec3459", "level": "note", "message": {"text": "Possibly dead Python function: seal"}, "properties": {"repobilityId": "7aea1fafd9dea73c", "scanner": "scanner-primary", "fingerprint": "01a38499d1ec3459", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:185"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab48b158e641b6d3", "level": "note", "message": {"text": "Possibly dead Python function: verify_chain"}, "properties": {"repobilityId": "babca401c6bbca6a", "scanner": "scanner-primary", "fingerprint": "ab48b158e641b6d3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:206"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86ff7c700711841a", "level": "note", "message": {"text": "Possibly dead Python function: to_telemetry_event"}, "properties": {"repobilityId": "b16463c3d4a92419", "scanner": "scanner-primary", "fingerprint": "86ff7c700711841a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:222"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01570caf7c93e49a", "level": "note", "message": {"text": "Possibly dead Python function: new_claim_id"}, "properties": {"repobilityId": "6a6b40c89f668637", "scanner": "scanner-primary", "fingerprint": "01570caf7c93e49a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:248"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ac99e0155bdef86", "level": "note", "message": {"text": "Possibly dead Python function: build_pipeline"}, "properties": {"repobilityId": "94178ed4d0a083c7", "scanner": "scanner-primary", "fingerprint": "8ac99e0155bdef86", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase2-runtime-drift-validators/validators.py:350"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22af355e56fa6e8b", "level": "note", "message": {"text": "Possibly dead Python function: fix"}, "properties": {"repobilityId": "23c5e4ffb999955f", "scanner": "scanner-primary", "fingerprint": "22af355e56fa6e8b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase3-remediation-contract-and-router/remediation_router.py:175"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7030aed48765dad1", "level": "note", "message": {"text": "Possibly dead Python function: register_fix"}, "properties": {"repobilityId": "c93398a31e3e61c1", "scanner": "scanner-primary", "fingerprint": "7030aed48765dad1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase3-remediation-contract-and-router/remediation_router.py:264"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83b17a870c0e27be", "level": "note", "message": {"text": "Possibly dead Python function: route_many"}, "properties": {"repobilityId": "e2f46f875cd27285", "scanner": "scanner-primary", "fingerprint": "83b17a870c0e27be", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase3-remediation-contract-and-router/remediation_router.py:287"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-def37e8b59ae4c8d", "level": "note", "message": {"text": "Possibly dead Python function: hygiene_finding"}, "properties": {"repobilityId": "dc12a23f4ea54532", "scanner": "scanner-primary", "fingerprint": "def37e8b59ae4c8d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase3-remediation-contract-and-router/drift_finding.py:191"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-817a0aec4a583c8b", "level": "note", "message": {"text": "Possibly dead Python function: runtime_finding"}, "properties": {"repobilityId": "d8f44c5ad3f6eecf", "scanner": "scanner-primary", "fingerprint": "817a0aec4a583c8b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/drafts/phase3-remediation-contract-and-router/drift_finding.py:214"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-849aaaf7a5b419ec", "level": "note", "message": {"text": "Possibly dead Python function: model_post_init"}, "properties": {"repobilityId": "92fde611a57364a6", "scanner": "scanner-primary", "fingerprint": "849aaaf7a5b419ec", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/config.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca6d1807d0948a51", "level": "note", "message": {"text": "Possibly dead Python function: parse_graph_entities"}, "properties": {"repobilityId": "310b2772549be877", "scanner": "scanner-primary", "fingerprint": "ca6d1807d0948a51", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/adapters/m365_parser.py:20"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80b9d3f6b82750b9", "level": "note", "message": {"text": "Possibly dead Python function: parse_security_policies"}, "properties": {"repobilityId": "bc138e3e46fbeea8", "scanner": "scanner-primary", "fingerprint": "80b9d3f6b82750b9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/adapters/m365_parser.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c837e1b5dde374ad", "level": "note", "message": {"text": "Possibly dead Python function: generate_endpoint_evidence"}, "properties": {"repobilityId": "3dd2b42a218e9856", "scanner": "scanner-primary", "fingerprint": "c837e1b5dde374ad", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/adapters/intune_adapter.py:157"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45ab58ab8a0b8e21", "level": "note", "message": {"text": "Possibly dead Python function: check_certificate_status"}, "properties": {"repobilityId": "93becdfde1cb5342", "scanner": "scanner-primary", "fingerprint": "45ab58ab8a0b8e21", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/adapters/pkica_adapter.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83e4613163515b79", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/scripts/metadata_drift_scan.js:125"}, "properties": {"repobilityId": "135cf0a92ddd8b4c", "scanner": "scanner-primary", "fingerprint": "83e4613163515b79", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6820fcfd46c56d8a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/scripts/update_corpus_index.js:96"}, "properties": {"repobilityId": "ae85eb0ce9b3b458", "scanner": "scanner-primary", "fingerprint": "6820fcfd46c56d8a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4b4a298b6f2a3919", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/tools/uiao-governance-cli.js:52"}, "properties": {"repobilityId": "0148ecb04c31fdf5", "scanner": "scanner-primary", "fingerprint": "4b4a298b6f2a3919", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6b0ee90f09e5194b", "level": "warning", "message": {"text": "Privileged port 914 in use"}, "properties": {"repobilityId": "d74882bd93651663", "scanner": "scanner-primary", "fingerprint": "6b0ee90f09e5194b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/canon/release-manifests/platform-server-v1.2.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9a62f58f6143c65", "level": "warning", "message": {"text": "Privileged port 498 in use"}, "properties": {"repobilityId": "dffd766e8d7c46e6", "scanner": "scanner-primary", "fingerprint": "c9a62f58f6143c65", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/canon/release-manifests/platform-server-v1.2.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e9944ce8b748c17", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "a5fc9317a5f7b2d9", "scanner": "scanner-primary", "fingerprint": "8e9944ce8b748c17", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/azure/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-8e9944ce8b748c17", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "89ebc154131509ed", "scanner": "scanner-primary", "fingerprint": "8e9944ce8b748c17", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/azure/Dockerfile"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-cf960ae686198183", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in docs/scripts/metadata_drift_scan.js:7"}, "properties": {"repobilityId": "9fbe46a9ff040283", "scanner": "scanner-primary", "fingerprint": "cf960ae686198183", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/metadata_drift_scan.js"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-dcbff0c4491cb662", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in docs/scripts/update_corpus_index.js:9"}, "properties": {"repobilityId": "504b1e4a2b60899e", "scanner": "scanner-primary", "fingerprint": "dcbff0c4491cb662", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/scripts/update_corpus_index.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-3898f2f7c2048d48", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in scripts/enforcement_orchestrator.py:34"}, "properties": {"repobilityId": "e040d060c4247a82", "scanner": "scanner-primary", "fingerprint": "3898f2f7c2048d48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/enforcement_orchestrator.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-c33a59de0a5c6b6c", "level": "error", "message": {"text": "Possible secret in .github/workflows/azure-saas-deploy.yml"}, "properties": {"repobilityId": "5dfa91370fda148b", "scanner": "scanner-primary", "fingerprint": "c33a59de0a5c6b6c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/azure-saas-deploy.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-401964e3b371861f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/workflows/spec-test-coverage.yml:78"}, "properties": {"repobilityId": "03ddd2048c84d7dd", "scanner": "scanner-primary", "fingerprint": "401964e3b371861f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/spec-test-coverage.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-7ad6b9cdb886c054", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/uiao/api/web/static/app.js:32"}, "properties": {"repobilityId": "c3dd4b0cbaf77e3f", "scanner": "scanner-primary", "fingerprint": "7ad6b9cdb886c054", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/api/web/static/app.js"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-7e4489f5b57ac242", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ceaeae785dfd42c3", "scanner": "scanner-primary", "fingerprint": "7e4489f5b57ac242", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/compliance-mapping.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-7e4489f5b57ac242", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6c1cc6a3f626bd5b", "scanner": "scanner-primary", "fingerprint": "7e4489f5b57ac242", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/compliance-mapping.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-38135d62d4659901", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9eaa7672253f9608", "scanner": "scanner-primary", "fingerprint": "38135d62d4659901", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/build-docs.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-38135d62d4659901", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "840ef65de05827f5", "scanner": "scanner-primary", "fingerprint": "38135d62d4659901", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/build-docs.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-38135d62d4659901", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e26bae5571266ca2", "scanner": "scanner-primary", "fingerprint": "38135d62d4659901", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/build-docs.yml"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-38135d62d4659901", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "51dc88f450f1c00d", "scanner": "scanner-primary", "fingerprint": "38135d62d4659901", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/build-docs.yml"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-c707fa90593478ff", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a052a168cdbb339f", "scanner": "scanner-primary", "fingerprint": "c707fa90593478ff", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/build-docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc83220c8da9a336", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "24466f75e520df1e", "scanner": "scanner-primary", "fingerprint": "fc83220c8da9a336", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/crosswalk-regeneration.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-fc83220c8da9a336", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf46df369b779d98", "scanner": "scanner-primary", "fingerprint": "fc83220c8da9a336", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/crosswalk-regeneration.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-57f5d21f3dda6370", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e44b81c5375a84b8", "scanner": "scanner-primary", "fingerprint": "57f5d21f3dda6370", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-scan.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-57f5d21f3dda6370", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e44b81c5375a84b8", "scanner": "scanner-primary", "fingerprint": "57f5d21f3dda6370", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-scan.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-57f5d21f3dda6370", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b51d027c1e63397", "scanner": "scanner-primary", "fingerprint": "57f5d21f3dda6370", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-scan.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-57f5d21f3dda6370", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c3b74c86a6981f84", "scanner": "scanner-primary", "fingerprint": "57f5d21f3dda6370", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-scan.yml"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-57f5d21f3dda6370", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c00af5c90187a6a3", "scanner": "scanner-primary", "fingerprint": "57f5d21f3dda6370", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-scan.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-e7d24e51abf39620", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "46a54102e0aefd7f", "scanner": "scanner-primary", "fingerprint": "e7d24e51abf39620", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/governance-state-machine.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-f1c018fc99fc8401", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fb1cb1b965c56a3c", "scanner": "scanner-primary", "fingerprint": "f1c018fc99fc8401", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/update-corpus-index.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-f1c018fc99fc8401", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fe36d9369e87bb35", "scanner": "scanner-primary", "fingerprint": "f1c018fc99fc8401", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/update-corpus-index.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-149ef59a77881e49", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "28530f8d8eeb265a", "scanner": "scanner-primary", "fingerprint": "149ef59a77881e49", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/update-corpus-index.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58e4c397724f5259", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ffd5ff2314a809cc", "scanner": "scanner-primary", "fingerprint": "58e4c397724f5259", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/changelog.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4017990271006a7a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0e19b8357a164787", "scanner": "scanner-primary", "fingerprint": "4017990271006a7a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/lint.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c7de4470ff63437", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "79bae33969496e4d", "scanner": "scanner-primary", "fingerprint": "6c7de4470ff63437", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/deploy.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-6c7de4470ff63437", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "91e7f1d06acc157a", "scanner": "scanner-primary", "fingerprint": "6c7de4470ff63437", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/deploy.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-6c7de4470ff63437", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1c2812a6b3be449d", "scanner": "scanner-primary", "fingerprint": "6c7de4470ff63437", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/deploy.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-ef66a3b9c9b405f9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "03f147fde0bdf8f9", "scanner": "scanner-primary", "fingerprint": "ef66a3b9c9b405f9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-133d98ea7bb9972b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6d4ab9b1708e4b8", "scanner": "scanner-primary", "fingerprint": "133d98ea7bb9972b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/governance-cli-check.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-133d98ea7bb9972b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3d0e25cd91b27fa", "scanner": "scanner-primary", "fingerprint": "133d98ea7bb9972b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/governance-cli-check.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6bd4ee85b7ffb652", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "874b1e64e460c030", "scanner": "scanner-primary", "fingerprint": "6bd4ee85b7ffb652", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/dashboard-export.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-6bd4ee85b7ffb652", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "874b1e64e460c030", "scanner": "scanner-primary", "fingerprint": "6bd4ee85b7ffb652", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/dashboard-export.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-6bd4ee85b7ffb652", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68e8a5adeeb9d16f", "scanner": "scanner-primary", "fingerprint": "6bd4ee85b7ffb652", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/dashboard-export.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-6bd4ee85b7ffb652", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dc33ddbe4489ded2", "scanner": "scanner-primary", "fingerprint": "6bd4ee85b7ffb652", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/dashboard-export.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-2cbe4ba4be843fdf", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "da08bd52a3f1c78c", "scanner": "scanner-primary", "fingerprint": "2cbe4ba4be843fdf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/dashboard-export.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-269d703ab1325746", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b43225f82af9b38b", "scanner": "scanner-primary", "fingerprint": "269d703ab1325746", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/metadata-validator.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-269d703ab1325746", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e165ad697f1eef2a", "scanner": "scanner-primary", "fingerprint": "269d703ab1325746", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/metadata-validator.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-269d703ab1325746", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d677c696261585c5", "scanner": "scanner-primary", "fingerprint": "269d703ab1325746", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/metadata-validator.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-269d703ab1325746", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c2bb6aedcf6a6151", "scanner": "scanner-primary", "fingerprint": "269d703ab1325746", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/metadata-validator.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-4b53febbfeb6d07b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3f1841f2dffa79c", "scanner": "scanner-primary", "fingerprint": "4b53febbfeb6d07b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/repo-hygiene.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-4b53febbfeb6d07b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "af4a69f063d481da", "scanner": "scanner-primary", "fingerprint": "4b53febbfeb6d07b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/repo-hygiene.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-46ba4ae3086c327e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ea3664ae28062c9c", "scanner": "scanner-primary", "fingerprint": "46ba4ae3086c327e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/rename-visuals.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4ee5dcd9a06e6d76", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "026442e3b5ededbc", "scanner": "scanner-primary", "fingerprint": "4ee5dcd9a06e6d76", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/cleanup-site-folder.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-2571ca15273a01f0", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f2f062c6e41866a4", "scanner": "scanner-primary", "fingerprint": "2571ca15273a01f0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/cleanup-site-folder.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2b404c7024b0c5a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a7414614da8dd0b2", "scanner": "scanner-primary", "fingerprint": "d2b404c7024b0c5a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/validate-uiao-frontmatter.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-a84ae642b40b7111", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7462c4ba80e0718c", "scanner": "scanner-primary", "fingerprint": "a84ae642b40b7111", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-sync-receive.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-a84ae642b40b7111", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7462c4ba80e0718c", "scanner": "scanner-primary", "fingerprint": "a84ae642b40b7111", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-sync-receive.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-a84ae642b40b7111", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5056fa59900648dc", "scanner": "scanner-primary", "fingerprint": "a84ae642b40b7111", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-sync-receive.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-a84ae642b40b7111", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7e72ed07e43bf31a", "scanner": "scanner-primary", "fingerprint": "a84ae642b40b7111", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-sync-receive.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-a84ae642b40b7111", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1d9f1b3c460b0192", "scanner": "scanner-primary", "fingerprint": "a84ae642b40b7111", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-sync-receive.yml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-92ca9a6df38f5564", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6fbef99d6d6d9ffb", "scanner": "scanner-primary", "fingerprint": "92ca9a6df38f5564", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-sync-receive.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00d833c25b5561ae", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "053d8ea68bb85202", "scanner": "scanner-primary", "fingerprint": "00d833c25b5561ae", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/generate-docs.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-00d833c25b5561ae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efa60cd8e4ef3a6d", "scanner": "scanner-primary", "fingerprint": "00d833c25b5561ae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/generate-docs.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-00d833c25b5561ae", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "efa60cd8e4ef3a6d", "scanner": "scanner-primary", "fingerprint": "00d833c25b5561ae", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/generate-docs.yml"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-6b57601e116bfed9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e70a05877f205fcc", "scanner": "scanner-primary", "fingerprint": "6b57601e116bfed9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/generate-docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-881c27cf4a697ae7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6af629345b94bc1a", "scanner": "scanner-primary", "fingerprint": "881c27cf4a697ae7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/render-and-insert-diagrams.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-881c27cf4a697ae7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dfd94c9a8b474617", "scanner": "scanner-primary", "fingerprint": "881c27cf4a697ae7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/render-and-insert-diagrams.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-d56d1c7bd6ae2bb4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e8c8a9e6246079d2", "scanner": "scanner-primary", "fingerprint": "d56d1c7bd6ae2bb4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/render-and-insert-diagrams.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53b0303fba6b1f2d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "05fb581808f7e93b", "scanner": "scanner-primary", "fingerprint": "53b0303fba6b1f2d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/weekly-metadata-drift-consolidated.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-53b0303fba6b1f2d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9fc7751a7702327c", "scanner": "scanner-primary", "fingerprint": "53b0303fba6b1f2d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/weekly-metadata-drift-consolidated.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-53b0303fba6b1f2d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8109a44a02154df0", "scanner": "scanner-primary", "fingerprint": "53b0303fba6b1f2d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/weekly-metadata-drift-consolidated.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-ccc2afd63e8ca28a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0402a67a4c89d382", "scanner": "scanner-primary", "fingerprint": "ccc2afd63e8ca28a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-detection.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-ccc2afd63e8ca28a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "79d5116165b8f7a5", "scanner": "scanner-primary", "fingerprint": "ccc2afd63e8ca28a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-detection.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-ccc2afd63e8ca28a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1e43bdca3d2b0a78", "scanner": "scanner-primary", "fingerprint": "ccc2afd63e8ca28a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-detection.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-ccc2afd63e8ca28a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81777c0d1412aed2", "scanner": "scanner-primary", "fingerprint": "ccc2afd63e8ca28a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-detection.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-87a5b3c27c282e5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "985d7ad55be00ca4", "scanner": "scanner-primary", "fingerprint": "87a5b3c27c282e5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/drift-detection.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c8d32feb44afed43", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "621de2dcd1cbd6ed", "scanner": "scanner-primary", "fingerprint": "c8d32feb44afed43", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/push-adapters-workflow.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-c406db54d1a43040", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a143eff34ba24017", "scanner": "scanner-primary", "fingerprint": "c406db54d1a43040", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/push-adapters-workflow.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8004c0903b7173c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a44ea9c55988c1da", "scanner": "scanner-primary", "fingerprint": "b8004c0903b7173c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/appendix-sync.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-b8004c0903b7173c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b8467c59d97bad5e", "scanner": "scanner-primary", "fingerprint": "b8004c0903b7173c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/appendix-sync.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-acd5b4da0f5d8661", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "57560a23a2c9fb0c", "scanner": "scanner-primary", "fingerprint": "acd5b4da0f5d8661", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/generate-artifacts.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a024b99732d637c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69fb312c655a09db", "scanner": "scanner-primary", "fingerprint": "3a024b99732d637c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/fix-yaml-hr.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-a378e6fdc3fefc0a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0e951555cf35b2d8", "scanner": "scanner-primary", "fingerprint": "a378e6fdc3fefc0a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/fix-yaml-hr.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f22ed33d0dec67e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cc4e784174b7b87f", "scanner": "scanner-primary", "fingerprint": "5f22ed33d0dec67e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/sync-data-to-core.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-5f22ed33d0dec67e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cc4e784174b7b87f", "scanner": "scanner-primary", "fingerprint": "5f22ed33d0dec67e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/sync-data-to-core.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-66abbace7b00c635", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b7e9d5f9dd1d7f92", "scanner": "scanner-primary", "fingerprint": "66abbace7b00c635", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/document-export.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-6d5d99512a2d4961", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5d7f4be53dc3824", "scanner": "scanner-primary", "fingerprint": "6d5d99512a2d4961", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/link-check.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-6d5d99512a2d4961", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "29a7cf7965cf304b", "scanner": "scanner-primary", "fingerprint": "6d5d99512a2d4961", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/link-check.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-6d5d99512a2d4961", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4504b75f78e1a1a6", "scanner": "scanner-primary", "fingerprint": "6d5d99512a2d4961", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/link-check.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-6d5d99512a2d4961", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b03d6d2f3148528", "scanner": "scanner-primary", "fingerprint": "6d5d99512a2d4961", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/link-check.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-6d5d99512a2d4961", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7e2a5100ccd50f17", "scanner": "scanner-primary", "fingerprint": "6d5d99512a2d4961", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/link-check.yml"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-f6d5924ff00ed314", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "18aee8d5518e7c05", "scanner": "scanner-primary", "fingerprint": "f6d5924ff00ed314", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-validation.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-f6d5924ff00ed314", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "738ce1bf2be4e67d", "scanner": "scanner-primary", "fingerprint": "f6d5924ff00ed314", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/canon-validation.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-fa7d7674291ef25d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "43d97497eee50b4a", "scanner": "scanner-primary", "fingerprint": "fa7d7674291ef25d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/generate_artifacts.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed58cc3a95512fa2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "249e1a3df3e25ac7", "scanner": "scanner-primary", "fingerprint": "ed58cc3a95512fa2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98d42f81e82edad9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1d1f9cb7ed30f556", "scanner": "scanner-primary", "fingerprint": "98d42f81e82edad9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/pr-preview.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-98d42f81e82edad9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "015a2ab7d3b015bb", "scanner": "scanner-primary", "fingerprint": "98d42f81e82edad9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/pr-preview.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-98d42f81e82edad9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "854d9bc06db3a865", "scanner": "scanner-primary", "fingerprint": "98d42f81e82edad9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/.github/workflows/pr-preview.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-6fba3b3458a6c960", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cc0677621025063a", "scanner": "scanner-primary", "fingerprint": "6fba3b3458a6c960", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/substrate-drift.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-6fba3b3458a6c960", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b156c097c4af10c", "scanner": "scanner-primary", "fingerprint": "6fba3b3458a6c960", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/substrate-drift.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-6fba3b3458a6c960", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7dd5d33c4e9e439a", "scanner": "scanner-primary", "fingerprint": "6fba3b3458a6c960", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/substrate-drift.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-05ee7931cedbc1b4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26c3164cc4cd829f", "scanner": "scanner-primary", "fingerprint": "05ee7931cedbc1b4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-canon-check.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-05ee7931cedbc1b4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "76e8299e8e490584", "scanner": "scanner-primary", "fingerprint": "05ee7931cedbc1b4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-canon-check.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-0cdbad85a1273b2c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "486b5fc3f64e6e3b", "scanner": "scanner-primary", "fingerprint": "0cdbad85a1273b2c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mypy.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-0cdbad85a1273b2c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e5b3e15559ead3f3", "scanner": "scanner-primary", "fingerprint": "0cdbad85a1273b2c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mypy.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-ab29fee265a7d885", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "157241d27523a190", "scanner": "scanner-primary", "fingerprint": "ab29fee265a7d885", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-leak-check.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-ab29fee265a7d885", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff0be9d5d8076c98", "scanner": "scanner-primary", "fingerprint": "ab29fee265a7d885", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-leak-check.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-484ca9912d694122", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ab1f95fce381b8d6", "scanner": "scanner-primary", "fingerprint": "484ca9912d694122", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/diagrams-ci.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-519d45e8f8c242fb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b05c6c1c5b295799", "scanner": "scanner-primary", "fingerprint": "519d45e8f8c242fb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publication-gap.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-519d45e8f8c242fb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "91b6e3d386a1932b", "scanner": "scanner-primary", "fingerprint": "519d45e8f8c242fb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publication-gap.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-519d45e8f8c242fb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "939d3f3ded443d9c", "scanner": "scanner-primary", "fingerprint": "519d45e8f8c242fb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publication-gap.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-247ac42715a87c26", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1209facbe1fec45f", "scanner": "scanner-primary", "fingerprint": "247ac42715a87c26", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/schema-validation.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-247ac42715a87c26", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aedad4df8a3bbf49", "scanner": "scanner-primary", "fingerprint": "247ac42715a87c26", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/schema-validation.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-27ef4d60fb1b56f5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "89f906500536c0fc", "scanner": "scanner-primary", "fingerprint": "27ef4d60fb1b56f5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/metadata-validator.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-27ef4d60fb1b56f5", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "92d62e49b8749abe", "scanner": "scanner-primary", "fingerprint": "27ef4d60fb1b56f5", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/metadata-validator.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-eae1691a53a7a04c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b76d9b19b1020ebf", "scanner": "scanner-primary", "fingerprint": "eae1691a53a7a04c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sitemap-drift.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-eae1691a53a7a04c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4d43a7926595011", "scanner": "scanner-primary", "fingerprint": "eae1691a53a7a04c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sitemap-drift.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-eae1691a53a7a04c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4d37ceed9ca30ac9", "scanner": "scanner-primary", "fingerprint": "eae1691a53a7a04c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sitemap-drift.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-56cb227ecae55165", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d8dc7c195d5f4fee", "scanner": "scanner-primary", "fingerprint": "56cb227ecae55165", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pwsh-pack.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-56cb227ecae55165", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6aa6b9489a26445b", "scanner": "scanner-primary", "fingerprint": "56cb227ecae55165", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pwsh-pack.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-3bab02c9dcd8d877", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6c2fcf1458bca72c", "scanner": "scanner-primary", "fingerprint": "3bab02c9dcd8d877", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pwsh-pack.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f98ea342526d13c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54562c17621d79b3", "scanner": "scanner-primary", "fingerprint": "7f98ea342526d13c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/acceptance-tests.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-7f98ea342526d13c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54562c17621d79b3", "scanner": "scanner-primary", "fingerprint": "7f98ea342526d13c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/acceptance-tests.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-7f98ea342526d13c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a0d1f7b8f6e416f", "scanner": "scanner-primary", "fingerprint": "7f98ea342526d13c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/acceptance-tests.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-4183212f89a12fe1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "70d88f95a98f9908", "scanner": "scanner-primary", "fingerprint": "4183212f89a12fe1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-drafter.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-420770c48b8d4613", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a9e3f39ec43b203d", "scanner": "scanner-primary", "fingerprint": "420770c48b8d4613", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-drafter.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b26140f9663ae501", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ea5a61b2ad2fc315", "scanner": "scanner-primary", "fingerprint": "b26140f9663ae501", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scubagear-upstream-track.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-b26140f9663ae501", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "90b81638c853198e", "scanner": "scanner-primary", "fingerprint": "b26140f9663ae501", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scubagear-upstream-track.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-29faa340b6637c55", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "692c44b69ea843d9", "scanner": "scanner-primary", "fingerprint": "29faa340b6637c55", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/azure-saas-deploy.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-fccf94c309e7f516", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1d9a3011a78379f7", "scanner": "scanner-primary", "fingerprint": "fccf94c309e7f516", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/azure-saas-deploy.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b8532affeaa7db2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2a5693b5671cef47", "scanner": "scanner-primary", "fingerprint": "7b8532affeaa7db2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ruff.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-7b8532affeaa7db2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c968bfc6dccf10e4", "scanner": "scanner-primary", "fingerprint": "7b8532affeaa7db2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ruff.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-4639339f9b780294", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b069d7503066030", "scanner": "scanner-primary", "fingerprint": "4639339f9b780294", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fedramp-cr26-roundtrip.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-4639339f9b780294", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "717ab93cc845bb34", "scanner": "scanner-primary", "fingerprint": "4639339f9b780294", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fedramp-cr26-roundtrip.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-4639339f9b780294", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c688b61fb8eaafdd", "scanner": "scanner-primary", "fingerprint": "4639339f9b780294", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/fedramp-cr26-roundtrip.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "111ded8435b78771", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9afabfce865d8cc3", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40de0ea74eab3ee8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1051a99633356d7b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0c3d4499b6cd885", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d37a323e3ed3a48d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7f8c9fbcf752929a", "scanner": "scanner-primary", "fingerprint": "d37a323e3ed3a48d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publication-quality.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-d37a323e3ed3a48d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b7a42edba4f2247a", "scanner": "scanner-primary", "fingerprint": "d37a323e3ed3a48d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publication-quality.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-d37a323e3ed3a48d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "992d0419952faf7c", "scanner": "scanner-primary", "fingerprint": "d37a323e3ed3a48d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publication-quality.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-8432f52dc57f476e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5fcfbfa0cf1cc46c", "scanner": "scanner-primary", "fingerprint": "8432f52dc57f476e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/spec-test-coverage.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-8432f52dc57f476e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "15c81e9836b4fa4a", "scanner": "scanner-primary", "fingerprint": "8432f52dc57f476e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/spec-test-coverage.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-8432f52dc57f476e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "316fbee0e6340153", "scanner": "scanner-primary", "fingerprint": "8432f52dc57f476e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/spec-test-coverage.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-a7ea5e7f66ea4b13", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "65a23e014d08b492", "scanner": "scanner-primary", "fingerprint": "a7ea5e7f66ea4b13", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/conmon-aggregate.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-a7ea5e7f66ea4b13", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "84b7dea6103b1715", "scanner": "scanner-primary", "fingerprint": "a7ea5e7f66ea4b13", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/conmon-aggregate.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-a7ea5e7f66ea4b13", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "280ca60b38487691", "scanner": "scanner-primary", "fingerprint": "a7ea5e7f66ea4b13", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/conmon-aggregate.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-a7ea5e7f66ea4b13", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b14332592552d0a", "scanner": "scanner-primary", "fingerprint": "a7ea5e7f66ea4b13", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/conmon-aggregate.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-a7ea5e7f66ea4b13", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4b14332592552d0a", "scanner": "scanner-primary", "fingerprint": "a7ea5e7f66ea4b13", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/conmon-aggregate.yml"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-8da2803837dd377d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bebd5211242438eb", "scanner": "scanner-primary", "fingerprint": "8da2803837dd377d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/customer-docs-status.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-8da2803837dd377d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6f8ba4fd19cca601", "scanner": "scanner-primary", "fingerprint": "8da2803837dd377d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/customer-docs-status.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-8da2803837dd377d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6b20425d9bdc0c7c", "scanner": "scanner-primary", "fingerprint": "8da2803837dd377d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/customer-docs-status.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-5d5c124922350323", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e4f2b09d48b00729", "scanner": "scanner-primary", "fingerprint": "5d5c124922350323", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/orchestrator-schedule-nightly.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-5d5c124922350323", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7d488dfd7beeb431", "scanner": "scanner-primary", "fingerprint": "5d5c124922350323", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/orchestrator-schedule-nightly.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-5d5c124922350323", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "352228e9aed23b44", "scanner": "scanner-primary", "fingerprint": "5d5c124922350323", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/orchestrator-schedule-nightly.yml"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-c41c00e3b847ab23", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f18e39b14596db99", "scanner": "scanner-primary", "fingerprint": "c41c00e3b847ab23", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/orchestrator-schedule-nightly.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51977a3899cebe53", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "42e6437a842a9b9a", "scanner": "scanner-primary", "fingerprint": "51977a3899cebe53", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pytest.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-51977a3899cebe53", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "506b8af83ec60ec9", "scanner": "scanner-primary", "fingerprint": "51977a3899cebe53", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pytest.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-51977a3899cebe53", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "42e6437a842a9b9a", "scanner": "scanner-primary", "fingerprint": "51977a3899cebe53", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pytest.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-51977a3899cebe53", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "506b8af83ec60ec9", "scanner": "scanner-primary", "fingerprint": "51977a3899cebe53", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pytest.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-99a75721f580c760", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "728a1b511280657c", "scanner": "scanner-primary", "fingerprint": "99a75721f580c760", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pester.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-99a75721f580c760", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e1e408e4787a5d4", "scanner": "scanner-primary", "fingerprint": "99a75721f580c760", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pester.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-99a75721f580c760", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa0c3ac6335d86d0", "scanner": "scanner-primary", "fingerprint": "99a75721f580c760", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pester.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-6cde33b484a0322c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d6b2c7144c1414e", "scanner": "scanner-primary", "fingerprint": "6cde33b484a0322c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/image-gen.yml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-6cde33b484a0322c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "75fce134d8ea6379", "scanner": "scanner-primary", "fingerprint": "6cde33b484a0322c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/image-gen.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-6cde33b484a0322c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e552c5a1292fb7b", "scanner": "scanner-primary", "fingerprint": "6cde33b484a0322c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/image-gen.yml"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-6cde33b484a0322c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d6b2c7144c1414e", "scanner": "scanner-primary", "fingerprint": "6cde33b484a0322c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/image-gen.yml"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-5a98bf1168df3b78", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "616c2e8dd6e777ec", "scanner": "scanner-primary", "fingerprint": "5a98bf1168df3b78", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/image-gen.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50cce0c0d1a42085", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "587603c9f41ecd0b", "scanner": "scanner-primary", "fingerprint": "50cce0c0d1a42085", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/adapter-conformance.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-50cce0c0d1a42085", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "107f906f5460905c", "scanner": "scanner-primary", "fingerprint": "50cce0c0d1a42085", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/adapter-conformance.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-50cce0c0d1a42085", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a28748bc6d8cb22", "scanner": "scanner-primary", "fingerprint": "50cce0c0d1a42085", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/adapter-conformance.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-9e836d5a564a796c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "769c957cbd3db0ee", "scanner": "scanner-primary", "fingerprint": "9e836d5a564a796c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/link-check.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-9e836d5a564a796c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1be5e9588a8cc9ef", "scanner": "scanner-primary", "fingerprint": "9e836d5a564a796c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/link-check.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-9e836d5a564a796c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "770f2caa2fd975eb", "scanner": "scanner-primary", "fingerprint": "9e836d5a564a796c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/link-check.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-d3a8cf49c9efb8d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5c30b579f23d75bb", "scanner": "scanner-primary", "fingerprint": "d3a8cf49c9efb8d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document-index-status.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-d3a8cf49c9efb8d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a87f6b96e941e4d4", "scanner": "scanner-primary", "fingerprint": "d3a8cf49c9efb8d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document-index-status.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-d3a8cf49c9efb8d3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fd184f7463cf8dbd", "scanner": "scanner-primary", "fingerprint": "d3a8cf49c9efb8d3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/document-index-status.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56856cef9a750398", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a041dd49b297b7a", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56856cef9a750398", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a041dd49b297b7a", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 140}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "07999e2d0bba7575", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "07999e2d0bba7575", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56856cef9a750398", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81e2d414a1c4c9a1", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4f643c2c2404b19d", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6a041dd49b297b7a", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-92f4d2b27958ffc6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "96b3dc7896e027d3", "scanner": "scanner-primary", "fingerprint": "92f4d2b27958ffc6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-2e9b5fc6c2d65d20", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0135c2c43af6c24b", "scanner": "scanner-primary", "fingerprint": "2e9b5fc6c2d65d20", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quarto.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be6fd4041aa09f9d", "level": "note", "message": {"text": "Very large file: scripts/generate_images.py (1387 lines)"}, "properties": {"repobilityId": "00c384e6ef97d490", "scanner": "scanner-primary", "fingerprint": "be6fd4041aa09f9d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4afe559249e5b306", "level": "note", "message": {"text": "Very large file: src/uiao/adapters/modernization/active_directory/survey.py (1742 lines)"}, "properties": {"repobilityId": "889bd15d6f68ffdb", "scanner": "scanner-primary", "fingerprint": "4afe559249e5b306", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "e7a065cc4779af57", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "63467112fb3d72ef", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "504c1e22cf5e72c9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f319fe2c71ab5c53", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d195aacc301a82e4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-229ce3942d79488d", "level": "note", "message": {"text": "Legacy-named symbol `is_deprecated` in tests/test_orgpath_codebook.py:200"}, "properties": {"repobilityId": "b61431eae25078ce", "scanner": "scanner-primary", "fingerprint": "229ce3942d79488d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a164cfa958786ac7", "level": "note", "message": {"text": "Legacy-named symbol `UIAO_007_OrgTree_Modernization_AD_to_EntraID_v1` in tests/test_active_directory_survey_enrichment.py:14"}, "properties": {"repobilityId": "8daec5f1f6342f2d", "scanner": "scanner-primary", "fingerprint": "a164cfa958786ac7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6c4b5c207f701806", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in tests/test_e2e.py:26"}, "properties": {"repobilityId": "d9fb3d100c3c3ca4", "scanner": "scanner-primary", "fingerprint": "6c4b5c207f701806", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bb7c63239d453808", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in tests/test_models.py:119"}, "properties": {"repobilityId": "5314552e6213c219", "scanner": "scanner-primary", "fingerprint": "bb7c63239d453808", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3452758b82670560", "level": "note", "message": {"text": "Legacy-named symbol `uiao_jml_logic_v1` in tests/canon_paths.py:42"}, "properties": {"repobilityId": "1052378881c32c0b", "scanner": "scanner-primary", "fingerprint": "3452758b82670560", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dd03d9e024a37758", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_entra_adapter_behavioral.py:72"}, "properties": {"repobilityId": "8446058eaa49ec59", "scanner": "scanner-primary", "fingerprint": "dd03d9e024a37758", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8c3ba90bcbf364ab", "level": "note", "message": {"text": "Legacy-named symbol `CanonicalLegacy` in tests/test_drift_output.py:110"}, "properties": {"repobilityId": "044810c2b6e98837", "scanner": "scanner-primary", "fingerprint": "8c3ba90bcbf364ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3afc6f4be592c05c", "level": "note", "message": {"text": "Legacy-named symbol `nLegacy` in tests/test_substrate_walker.py:392"}, "properties": {"repobilityId": "c23eb4c13321ef94", "scanner": "scanner-primary", "fingerprint": "3afc6f4be592c05c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6367f99a283d3770", "level": "note", "message": {"text": "Legacy-named symbol `cd_copy` in tests/test_servicenow_oscal_emitter.py:245"}, "properties": {"repobilityId": "db531f7d7a13fce0", "scanner": "scanner-primary", "fingerprint": "6367f99a283d3770", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bd2868b7afa71867", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_orgtree_readiness_bundle.py:421"}, "properties": {"repobilityId": "b544b6b5702ec000", "scanner": "scanner-primary", "fingerprint": "bd2868b7afa71867", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-afe08b1ee281b1e6", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_cli_tenant.py:138"}, "properties": {"repobilityId": "2a2fd4abddb2852e", "scanner": "scanner-primary", "fingerprint": "afe08b1ee281b1e6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b27eaff80dd7c203", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_api_smoke.py:46"}, "properties": {"repobilityId": "28bd9d2ac41b36f9", "scanner": "scanner-primary", "fingerprint": "b27eaff80dd7c203", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0473684eeaaf8c65", "level": "note", "message": {"text": "Legacy-named symbol `test_get_codebook_serializes_deprecated` in tests/orgtree/test_orgpath_api.py:63"}, "properties": {"repobilityId": "7a61cb45f9183f36", "scanner": "scanner-primary", "fingerprint": "0473684eeaaf8c65", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5c4e6168133d2b4f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 diagrams/scripts/pre-render.py:50"}, "properties": {"repobilityId": "f92dfae16f12a1f3", "scanner": "scanner-primary", "fingerprint": "5c4e6168133d2b4f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-70040f53100ca6d0", "level": "note", "message": {"text": "Legacy-named symbol `UIAO_002_SCuBA_Technical_Specification_v1` in docs/docs/session-logs/scripts/fix_uiao_002.py:5"}, "properties": {"repobilityId": "2ac376c8603e42b8", "scanner": "scanner-primary", "fingerprint": "70040f53100ca6d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-68152a7bca893ed0", "level": "none", "message": {"text": "Commented-code block (8 lines) in docs/docs/session-logs/scripts/fix_uiao_002.py:7"}, "properties": {"repobilityId": "54b9f06d799ec89e", "scanner": "scanner-primary", "fingerprint": "68152a7bca893ed0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a50a9b80c38f3ea", "level": "note", "message": {"text": "Legacy-named symbol `UIAO_003_Adapter_Segmentation_Overview_v1` in docs/docs/session-logs/scripts/canon_backfill.py:11"}, "properties": {"repobilityId": "16fdc21d1f9faadf", "scanner": "scanner-primary", "fingerprint": "9a50a9b80c38f3ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d47b9234d92d7cb1", "level": "note", "message": {"text": "Legacy-named symbol `tags_old` in docs/tools/uiao-governance-cli.js:41"}, "properties": {"repobilityId": "80b8b79117e14af8", "scanner": "scanner-primary", "fingerprint": "d47b9234d92d7cb1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5db83fddc52cb91d", "level": "none", "message": {"text": "Commented-code block (9 lines) in docs/tools/aggregate_prompts.py:52"}, "properties": {"repobilityId": "5795431f2f7a293c", "scanner": "scanner-primary", "fingerprint": "5db83fddc52cb91d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-557ab3715ff9648e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_orchestrator.py:132"}, "properties": {"repobilityId": "a0a9ab20ec85af16", "scanner": "scanner-primary", "fingerprint": "557ab3715ff9648e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8569b03c42decfee", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/generate_patent_figures.py:5"}, "properties": {"repobilityId": "b18da3e7c3784065", "scanner": "scanner-primary", "fingerprint": "8569b03c42decfee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f75111390c971655", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/validate_fedramp.py:29"}, "properties": {"repobilityId": "6901cb69810b4d74", "scanner": "scanner-primary", "fingerprint": "f75111390c971655", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3944bc4199e9fb6e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/cyberark_sync_orchestrator.py:72"}, "properties": {"repobilityId": "4a4012f791a99222", "scanner": "scanner-primary", "fingerprint": "3944bc4199e9fb6e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-40f5fd1fa9ac8c7b", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/triage_aspirational_signals.py:136"}, "properties": {"repobilityId": "4580e70e19c084eb", "scanner": "scanner-primary", "fingerprint": "40f5fd1fa9ac8c7b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1f24d9de2d8cc1aa", "level": "note", "message": {"text": "Legacy-named symbol `uiao_project_plan_v1` in scripts/plan_to_csv.py:13"}, "properties": {"repobilityId": "2ac8e1fd6763269c", "scanner": "scanner-primary", "fingerprint": "1f24d9de2d8cc1aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a7df86d4c4a0ccec", "level": "note", "message": {"text": "Legacy-named symbol `uiao_pitch_deck_v1` in scripts/generate_pptx.py:14"}, "properties": {"repobilityId": "f73cdb4870df3d78", "scanner": "scanner-primary", "fingerprint": "a7df86d4c4a0ccec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fc148bc0140c1eb0", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/scan_publication_gaps.py:86"}, "properties": {"repobilityId": "4a666ea25244b1ae", "scanner": "scanner-primary", "fingerprint": "fc148bc0140c1eb0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a54709f7cbf7be0", "level": "note", "message": {"text": "Legacy-named symbol `UIAO_002_SCuBA_Technical_Specification_v1` in scripts/reorganize_monorepo.py:120"}, "properties": {"repobilityId": "78ac8395047da278", "scanner": "scanner-primary", "fingerprint": "7a54709f7cbf7be0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d4b08f9e3547efaf", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/reorganize_monorepo.py:48"}, "properties": {"repobilityId": "1ef93533db110d2f", "scanner": "scanner-primary", "fingerprint": "d4b08f9e3547efaf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d951016d21c4ba89", "level": "note", "message": {"text": "Legacy-named symbol `canon_refs_deprecated` in scripts/generate_images.py:208"}, "properties": {"repobilityId": "da65dc35c3776f67", "scanner": "scanner-primary", "fingerprint": "d951016d21c4ba89", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-3f8cc78221db3f19", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/generate_images.py:26"}, "properties": {"repobilityId": "42c3475f787ba0cd", "scanner": "scanner-primary", "fingerprint": "3f8cc78221db3f19", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52cfd6cb7128ce16", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/regenerate_local_images_from_figalt.py:125"}, "properties": {"repobilityId": "631d9501898c6884", "scanner": "scanner-primary", "fingerprint": "52cfd6cb7128ce16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ff504568f962154d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/enforcement_orchestrator.py:62"}, "properties": {"repobilityId": "1ce3270d4f56f10d", "scanner": "scanner-primary", "fingerprint": "ff504568f962154d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9123011d7879fc0c", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/bundle_section_docx.py:82"}, "properties": {"repobilityId": "98b9e20ea0ddb1d5", "scanner": "scanner-primary", "fingerprint": "9123011d7879fc0c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2039d8407d8da5c", "level": "note", "message": {"text": "Legacy-named symbol `has_copy` in scripts/tools/appendix_indexer.py:65"}, "properties": {"repobilityId": "fc3ab8aab3d3b9a5", "scanner": "scanner-primary", "fingerprint": "f2039d8407d8da5c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dbe600e4884548a2", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/tools/docs_leak_check.py:32"}, "properties": {"repobilityId": "5e185391ec7a93cd", "scanner": "scanner-primary", "fingerprint": "dbe600e4884548a2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-42922df144e1a208", "level": "note", "message": {"text": "Legacy-named symbol `with_copy` in scripts/tools/dashboard_exporter.py:117"}, "properties": {"repobilityId": "21b623ea061fd463", "scanner": "scanner-primary", "fingerprint": "42922df144e1a208", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4166a42a3324b159", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/conmon/migration_readiness.py:50"}, "properties": {"repobilityId": "ca9a0a7dc655189c", "scanner": "scanner-primary", "fingerprint": "4166a42a3324b159", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fdca7ca0bf06326f", "level": "none", "message": {"text": "Commented-code block (6 lines) in deploy/windows-server/run.py:23"}, "properties": {"repobilityId": "573708da55e4b5de", "scanner": "scanner-primary", "fingerprint": "fdca7ca0bf06326f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fecc68623817f290", "level": "none", "message": {"text": "Commented-code block (6 lines) in inbox/New_FedRAMP_Boundary/inject_images_into_docs.py:99"}, "properties": {"repobilityId": "8dd57ddc58089f87", "scanner": "scanner-primary", "fingerprint": "fecc68623817f290", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-60f5ea26270965f5", "level": "none", "message": {"text": "Commented-code block (5 lines) in inbox/drafts/complete-narrative/promote_headings.py:44"}, "properties": {"repobilityId": "bc3bbd08bcf77b34", "scanner": "scanner-primary", "fingerprint": "60f5ea26270965f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7c4fb523550b26b0", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in inbox/drafts/phase0-runtime-provenance-envelope/provenance.py:199"}, "properties": {"repobilityId": "4e4eaffe74d8de99", "scanner": "scanner-primary", "fingerprint": "7c4fb523550b26b0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-07fab0d234a2ec6b", "level": "none", "message": {"text": "Commented-code block (6 lines) in inbox/drafts/phase2-runtime-drift-validators/validators.py:210"}, "properties": {"repobilityId": "859433c603f54540", "scanner": "scanner-primary", "fingerprint": "07fab0d234a2ec6b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-423d767dd454bb26", "level": "note", "message": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/governance/drift_engine.py:294"}, "properties": {"repobilityId": "c98adea8f15c30d6", "scanner": "scanner-primary", "fingerprint": "423d767dd454bb26", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e100affc8aca2435", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/uiao/governance/cql.py:74"}, "properties": {"repobilityId": "0af2813a544550c5", "scanner": "scanner-primary", "fingerprint": "e100affc8aca2435", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-de1b9f99cb4eca86", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/governance/ssot_contention.py:368"}, "properties": {"repobilityId": "3d2f2b4dee29027f", "scanner": "scanner-primary", "fingerprint": "de1b9f99cb4eca86", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e5f4523b796019aa", "level": "note", "message": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/governance/drift.py:333"}, "properties": {"repobilityId": "ad6595f8e07e3db9", "scanner": "scanner-primary", "fingerprint": "e5f4523b796019aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a426aa171d08cdc5", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/governance/drift.py:36"}, "properties": {"repobilityId": "456071d68a4ffaae", "scanner": "scanner-primary", "fingerprint": "a426aa171d08cdc5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad1096487ca54952", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/governance/entra_authz_supplements.py:30"}, "properties": {"repobilityId": "af382375b8f9e3ed", "scanner": "scanner-primary", "fingerprint": "ad1096487ca54952", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-20216627b8f4fde9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/adapters/database_base.py:328"}, "properties": {"repobilityId": "f14f257398809ca1", "scanner": "scanner-primary", "fingerprint": "20216627b8f4fde9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e61ff629b177d096", "level": "note", "message": {"text": "Legacy-named symbol `winserver_legacy` in src/uiao/adapters/modernization/active_directory/intune_readiness.py:202"}, "properties": {"repobilityId": "b634a110cea93be8", "scanner": "scanner-primary", "fingerprint": "e61ff629b177d096", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bdabd2e822cac5e7", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/uiao/adapters/modernization/active_directory/arc_readiness.py:111"}, "properties": {"repobilityId": "d4fc700da5b4cd37", "scanner": "scanner-primary", "fingerprint": "bdabd2e822cac5e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-970eb71fb4e972ee", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/uiao/adapters/modernization/active_directory/survey.py:404"}, "properties": {"repobilityId": "b054ca03a06855b1", "scanner": "scanner-primary", "fingerprint": "970eb71fb4e972ee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4f43418254efd19e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/adapters/modernization/pki/inventory.py:72"}, "properties": {"repobilityId": "5c2d810a5b18f835", "scanner": "scanner-primary", "fingerprint": "4f43418254efd19e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f51742bdbad02e3", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/uiao/adapters/scuba/ir/normalize_scuba.py:243"}, "properties": {"repobilityId": "616bd4dc2bdf04d4", "scanner": "scanner-primary", "fingerprint": "3f51742bdbad02e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea8c0a4f225c4d87", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/uiao/adapters/scuba/ir/transformer.py:108"}, "properties": {"repobilityId": "b148da30bb4e492d", "scanner": "scanner-primary", "fingerprint": "ea8c0a4f225c4d87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c78253199d329bb", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/models/canon.py:67"}, "properties": {"repobilityId": "e4db56c9b09daef6", "scanner": "scanner-primary", "fingerprint": "2c78253199d329bb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e78144dd024345ab", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/modernization/orgtree/enforcement_projection.py:43"}, "properties": {"repobilityId": "822d1efb09947c8a", "scanner": "scanner-primary", "fingerprint": "e78144dd024345ab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f9d33f285f23e94", "level": "note", "message": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/modernization/orgtree/codebook.py:24"}, "properties": {"repobilityId": "2fd4fa4848b553cd", "scanner": "scanner-primary", "fingerprint": "9f9d33f285f23e94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0acf024aae8ed68e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/api/auth/entra_token.py:85"}, "properties": {"repobilityId": "fe75c0e9eeef0154", "scanner": "scanner-primary", "fingerprint": "0acf024aae8ed68e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30b4c58539a28275", "level": "note", "message": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/api/routes/orgpath.py:20"}, "properties": {"repobilityId": "1d9dd0b9773a3983", "scanner": "scanner-primary", "fingerprint": "30b4c58539a28275", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8d38d0e49bb18d7e", "level": "note", "message": {"text": "Legacy-named symbol `is_deprecated` in src/uiao/api/web/console.py:183"}, "properties": {"repobilityId": "2ce90529d92688c1", "scanner": "scanner-primary", "fingerprint": "8d38d0e49bb18d7e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a4b509ce94d41e99", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/uiao/cli/init.py:171"}, "properties": {"repobilityId": "5cf838fa5ec118e2", "scanner": "scanner-primary", "fingerprint": "a4b509ce94d41e99", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c83fad0fa27af9fb", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/uiao/cli/tenant.py:132"}, "properties": {"repobilityId": "b4f9c340dd96861f", "scanner": "scanner-primary", "fingerprint": "c83fad0fa27af9fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7450bfe1d75708fa", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/cli/generate.py:11"}, "properties": {"repobilityId": "1580d8b9c2ff9791", "scanner": "scanner-primary", "fingerprint": "7450bfe1d75708fa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7def09b3ea8015ef", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/utils/context.py:79"}, "properties": {"repobilityId": "116f24e8c727e556", "scanner": "scanner-primary", "fingerprint": "7def09b3ea8015ef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bc019800a5e341ae", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/uiao/orchestrator/orchestrator.py:90"}, "properties": {"repobilityId": "3e90a451cc27405a", "scanner": "scanner-primary", "fingerprint": "bc019800a5e341ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2cab55335d8e9958", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/uiao/substrate/walker.py:38"}, "properties": {"repobilityId": "4b3f0b77a2b1fdbf", "scanner": "scanner-primary", "fingerprint": "2cab55335d8e9958", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d29502b2b4e8dca7", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/uiao/saas/tenant.py:109"}, "properties": {"repobilityId": "803f73a9e3066b9c", "scanner": "scanner-primary", "fingerprint": "d29502b2b4e8dca7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-25358389d8e60f88", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/generators/pptx.py:300"}, "properties": {"repobilityId": "39a739fa4981ff5f", "scanner": "scanner-primary", "fingerprint": "25358389d8e60f88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-136d282926a3ad72", "level": "note", "message": {"text": "Legacy-named symbol `uiao_leadership_briefing_v1` in src/uiao/generators/ssp.py:652"}, "properties": {"repobilityId": "98a971ad5a114f46", "scanner": "scanner-primary", "fingerprint": "136d282926a3ad72", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-894d2954d3630d4f", "level": "note", "message": {"text": "Legacy-named symbol `leadership_briefing_v1` in src/uiao/generators/docs.py:80"}, "properties": {"repobilityId": "aa279ed9a2e4d7c4", "scanner": "scanner-primary", "fingerprint": "894d2954d3630d4f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0083a50e0bf92c95", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/generators/sbom.py:29"}, "properties": {"repobilityId": "682c3df01be5cc9a", "scanner": "scanner-primary", "fingerprint": "0083a50e0bf92c95", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52463084e9fe220a", "level": "note", "message": {"text": "Legacy-named symbol `leadership_briefing_v1` in src/uiao/generators/rich_docx.py:699"}, "properties": {"repobilityId": "8080cb74ebd71966", "scanner": "scanner-primary", "fingerprint": "52463084e9fe220a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f193984b6079cc47", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/uiao/generators/rich_docx.py:47"}, "properties": {"repobilityId": "a4681890edf063b7", "scanner": "scanner-primary", "fingerprint": "f193984b6079cc47", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9803c256ccfe9eb8", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/uiao/ksi/evaluate.py:107"}, "properties": {"repobilityId": "8019523ed9e7246c", "scanner": "scanner-primary", "fingerprint": "9803c256ccfe9eb8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "36be358d9e9519c3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "81f99e9cf6e28808", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "89e69db4467cdb43", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2ff89473dddc5362", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c454ac8c065de12e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6aabbb55331c55a8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "48113b3702381cb2", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3b1bdd2869a99249", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "42a3a8eae62a3daa", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "78ed331fa729bd98", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "76d8112719b70a16", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2fcd5bd2d7e8d5ab", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6e2fc2fafda58722", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "459b27c92baf7268", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9259dacc56f4fb46", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aeae565d8c3ccb81", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7df8babbb5dfed1c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "ca4d4b06bea7a0e2", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "00ab93bbce8eedeb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3821312184b98044", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-d4adea4b7b80579c", "level": "error", "message": {"text": "FastAPI POST `validate` without auth dependency \u2014 src/uiao/api/routes/orgpath.py:223"}, "properties": {"repobilityId": "8fd2880b6c24bed8", "scanner": "scanner-primary", "fingerprint": "d4adea4b7b80579c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/api/routes/orgpath.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-eb294c798bfb26e4", "level": "error", "message": {"text": "FastAPI POST `run_governance` without auth dependency \u2014 src/uiao/api/web/console.py:276"}, "properties": {"repobilityId": "06e555509f672ef6", "scanner": "scanner-primary", "fingerprint": "eb294c798bfb26e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/uiao/api/web/console.py"}, "region": {"startLine": 276}}}]}, {"ruleId": "scanner-21f40681f0e8d376", "level": "error", "message": {"text": "Dangling fetch: POST /orgpath/api/govern (src/uiao/api/web/static/app.js:60)"}, "properties": {"repobilityId": "1f1ca62245055616", "scanner": "scanner-primary", "fingerprint": "21f40681f0e8d376", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-932a783785211575", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/evidence"}, "properties": {"repobilityId": "e177e4ce5c324ced", "scanner": "scanner-primary", "fingerprint": "932a783785211575", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4bb00baeb5e1ebd", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/evidence/{evidence_id}"}, "properties": {"repobilityId": "0d205fc613070be3", "scanner": "scanner-primary", "fingerprint": "f4bb00baeb5e1ebd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2db4cab52d55abe5", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/findings"}, "properties": {"repobilityId": "a9941fc48f7a0681", "scanner": "scanner-primary", "fingerprint": "2db4cab52d55abe5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c58daff5aee4d39d", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/poam"}, "properties": {"repobilityId": "603c21fba4c0752c", "scanner": "scanner-primary", "fingerprint": "c58daff5aee4d39d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63f56d16b2d2397e", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/oscal/sar"}, "properties": {"repobilityId": "e89e360f24c582ed", "scanner": "scanner-primary", "fingerprint": "63f56d16b2d2397e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6b0866b15294083f", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/oscal/ssp"}, "properties": {"repobilityId": "8048b423cdaaac0c", "scanner": "scanner-primary", "fingerprint": "6b0866b15294083f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c396edab1e2e67c", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/oscal/poam"}, "properties": {"repobilityId": "cc64104e014e26dc", "scanner": "scanner-primary", "fingerprint": "9c396edab1e2e67c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a237483b59ab6e33", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/oscal/sap"}, "properties": {"repobilityId": "19597052fe708256", "scanner": "scanner-primary", "fingerprint": "a237483b59ab6e33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2fbde79825176b80", "level": "note", "message": {"text": "Unused endpoint: GET /api/auditor/graph/{control_id}"}, "properties": {"repobilityId": "32b9e70e15f4586a", "scanner": "scanner-primary", "fingerprint": "2fbde79825176b80", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-12e0d5d55611566c", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/orgpath/codebook"}, "properties": {"repobilityId": "8cf7311a6783b885", "scanner": "scanner-primary", "fingerprint": "12e0d5d55611566c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-37bd48863f14629b", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/orgpath/principals/{principal_id}/facets"}, "properties": {"repobilityId": "a56420f9c7917a9b", "scanner": "scanner-primary", "fingerprint": "37bd48863f14629b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3391980240a79ac", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/orgpath/drift"}, "properties": {"repobilityId": "149360e9309c703b", "scanner": "scanner-primary", "fingerprint": "a3391980240a79ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d417d22f300c20b3", "level": "note", "message": {"text": "Unused endpoint: POST /api/v1/orgpath/validate"}, "properties": {"repobilityId": "84020dfb4a5f2665", "scanner": "scanner-primary", "fingerprint": "d417d22f300c20b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-512a13634818900f", "level": "note", "message": {"text": "Unused endpoint: GET /policies"}, "properties": {"repobilityId": "2d38c665809ea196", "scanner": "scanner-primary", "fingerprint": "512a13634818900f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e286f18d9d261cc6", "level": "note", "message": {"text": "Unused endpoint: GET /policies/{policy_id}"}, "properties": {"repobilityId": "e14f5dead2139b6f", "scanner": "scanner-primary", "fingerprint": "e286f18d9d261cc6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-95f235fd6ce6304d", "level": "note", "message": {"text": "Unused endpoint: POST /evaluate"}, "properties": {"repobilityId": "a5e46b86a7452497", "scanner": "scanner-primary", "fingerprint": "95f235fd6ce6304d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69a693dfc33637f4", "level": "note", "message": {"text": "Unused endpoint: POST /run"}, "properties": {"repobilityId": "402c4e4377177895", "scanner": "scanner-primary", "fingerprint": "69a693dfc33637f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76afc4e62d1236f4", "level": "note", "message": {"text": "Unused endpoint: GET /gaps"}, "properties": {"repobilityId": "97e2703969e1455d", "scanner": "scanner-primary", "fingerprint": "76afc4e62d1236f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "6efbaf4fbc593797", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-15d160b46aa256fa", "level": "note", "message": {"text": "Unused endpoint: GET /{pillar}"}, "properties": {"repobilityId": "1164231906d67b1f", "scanner": "scanner-primary", "fingerprint": "15d160b46aa256fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83bb031a4d381bd4", "level": "note", "message": {"text": "Unused endpoint: POST /findings"}, "properties": {"repobilityId": "c019ab6bb011b30f", "scanner": "scanner-primary", "fingerprint": "83bb031a4d381bd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec4a5d55b1200f49", "level": "note", "message": {"text": "Unused endpoint: GET /queries"}, "properties": {"repobilityId": "0ca5a1b93bf33276", "scanner": "scanner-primary", "fingerprint": "ec4a5d55b1200f49", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9fbea83da28df6ae", "level": "note", "message": {"text": "Unused endpoint: GET /queries/{name}"}, "properties": {"repobilityId": "3f94b08d143310b7", "scanner": "scanner-primary", "fingerprint": "9fbea83da28df6ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ddf9f18687947d3a", "level": "note", "message": {"text": "Unused endpoint: POST /evaluate/{name}"}, "properties": {"repobilityId": "6ccb28a9a32458a1", "scanner": "scanner-primary", "fingerprint": "ddf9f18687947d3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49a8bddc3f6c23e6", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/archive"}, "properties": {"repobilityId": "fc305141ccd25f71", "scanner": "scanner-primary", "fingerprint": "49a8bddc3f6c23e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94fc151b8d8ef5be", "level": "note", "message": {"text": "Unused endpoint: GET /api/v1/archive/{run_id}/{adapter_id}"}, "properties": {"repobilityId": "efd5b46e236fad0a", "scanner": "scanner-primary", "fingerprint": "94fc151b8d8ef5be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4d0b75c541565cd9", "level": "note", "message": {"text": "Unused endpoint: GET /journal"}, "properties": {"repobilityId": "798d1ac104466e00", "scanner": "scanner-primary", "fingerprint": "4d0b75c541565cd9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fb886588e645984", "level": "note", "message": {"text": "Unused endpoint: POST /dispatch"}, "properties": {"repobilityId": "a0b06f648914e94a", "scanner": "scanner-primary", "fingerprint": "5fb886588e645984", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f6e50d303b27830", "level": "note", "message": {"text": "Unused endpoint: GET /codebook"}, "properties": {"repobilityId": "dfbf415c454d742c", "scanner": "scanner-primary", "fingerprint": "3f6e50d303b27830", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-56816244c61e999a", "level": "note", "message": {"text": "Unused endpoint: GET /principals"}, "properties": {"repobilityId": "adf338c6ee51d06e", "scanner": "scanner-primary", "fingerprint": "56816244c61e999a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93ab4e722245e479", "level": "note", "message": {"text": "Unused endpoint: GET /govern"}, "properties": {"repobilityId": "f633eeb02377273f", "scanner": "scanner-primary", "fingerprint": "93ab4e722245e479", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72b9493c233d7f70", "level": "note", "message": {"text": "Unused endpoint: POST /api/govern"}, "properties": {"repobilityId": "08cdc2c5be0976d8", "scanner": "scanner-primary", "fingerprint": "72b9493c233d7f70", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07a7fad711358625", "level": "note", "message": {"text": "Unused endpoint: POST /tenants"}, "properties": {"repobilityId": "89346aac01c1a987", "scanner": "scanner-primary", "fingerprint": "07a7fad711358625", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-092d7b8020d70b38", "level": "note", "message": {"text": "Unused endpoint: GET /tenants"}, "properties": {"repobilityId": "1c5f1804fbd188aa", "scanner": "scanner-primary", "fingerprint": "092d7b8020d70b38", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-80816cd87fbcfd36", "level": "note", "message": {"text": "Unused endpoint: GET /tenants/{tenant_id}"}, "properties": {"repobilityId": "637547212f6a36a5", "scanner": "scanner-primary", "fingerprint": "80816cd87fbcfd36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ae1d3d48b460e399", "level": "note", "message": {"text": "Unused endpoint: POST /tenants/{tenant_id}/suspend"}, "properties": {"repobilityId": "269bff19060dc7a8", "scanner": "scanner-primary", "fingerprint": "ae1d3d48b460e399", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-299d697f947b854f", "level": "note", "message": {"text": "Unused endpoint: POST /tenants/{tenant_id}/resume"}, "properties": {"repobilityId": "c86df11de1876072", "scanner": "scanner-primary", "fingerprint": "299d697f947b854f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ae797f7f0be512f", "level": "note", "message": {"text": "Unused endpoint: DELETE /tenants/{tenant_id}"}, "properties": {"repobilityId": "bb759b4140c158c3", "scanner": "scanner-primary", "fingerprint": "3ae797f7f0be512f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}